Diffusion Phabricator (master) History

phabricator/src/applications/auth
master

Jan 23 2019

596435b35e30 Support designating a contact number as "primary"
Author
epriestley
Revisions
D20011: Support designating a contact number as "primary"
Browse Repository
Passed
No Audits

12203762b7f0 Allow contact numbers to be enabled and disabled
Author
epriestley
Revisions
D20010: Allow contact numbers to be enabled and disabled
Browse Repository
Passed
No Audits

c4244aa177b8 Allow users to access some settings at the "Add MFA" account setup roadblock
Author
epriestley
Revisions
D20008: Allow users to access some settings at the "Add MFA" account setup roadblock
Browse Repository
Passed
No Audits

f0c6ee48233a Add "Contact Numbers" so we can send users SMS mesages
Author
epriestley
Revisions
D19988: Add "Contact Numbers" so we can send users SMS mesages
Browse Repository
Passed
No Audits

aa483738899d Update `bin/auth` MFA commands for the new "MFA Provider" indirection layer
Author
epriestley
Revisions
D19976: Update `bin/auth` MFA commands for the new "MFA Provider" indirection layer
Browse Repository
Passed
No Audits

0fcff782533a Convert user MFA factors to point at configurable "MFA Providers", not raw "MFA…
Author
epriestley
Revisions
D19975: Convert user MFA factors to point at configurable "MFA Providers", not raw "MFA Factors"
Browse Repository
Passed
No Audits

Jan 21 2019

6138d5885d23 Update documentation to reflect bin/auth changes
Author
amckinley
Revisions
D20007: Update documentation to reflect bin/auth changes
Browse Repository
Passed
No Audits

Jan 19 2019

6bb31de30596 Use the customizable "Welcome Mail" message in welcome mail
Author
epriestley
Revisions
D19995: Use the customizable "Welcome Mail" message in welcome mail
Browse Repository
Passed
No Audits

22ad1ff2c5b1 Show the customized "Login" message on the login screen
Author
epriestley
Revisions
D19994: Show the customized "Login" message on the login screen
Browse Repository
Passed
No Audits

2c713b2d25fd Add "Auth Messages" to support customizing onboarding/welcome flows
Author
epriestley
Revisions
D19992: Add "Auth Messages" to support customizing onboarding/welcome flows
Browse Repository
Passed
No Audits

310ad7f8f47b Put a hard limit on password login attempts from the same remote address
Author
epriestley
Revisions
D19997: Put a hard limit on password login attempts from the same remote address
Browse Repository
Passed
No Audits

Jan 16 2019

a62f334d9503 Add a skeleton for configurable MFA provider types
Author
epriestley
Revisions
D19935: Add a skeleton for configurable MFA provider types
Browse Repository
Passed
No Audits

Jan 4 2019

1f4cf23455d7 Remove "phabricator.csrf-key" and upgrade CSRF hashing to SHA256
Author
epriestley
Revisions
D19946: Remove "phabricator.csrf-key" and upgrade CSRF hashing to SHA256
Browse Repository
Passed
No Audits

Dec 28 2018

1729e7b46792 Improve UI for "wait" and "answered" MFA challenges
Author
epriestley
Revisions
D19908: Improve UI for "wait" and "answered" MFA challenges
Browse Repository
Passed
No Audits

918f4ebcd82c Fix a double-prompt for MFA when recovering a password account
Author
epriestley
Revisions
D19906: Fix a double-prompt for MFA when recovering a password account
Browse Repository
Passed
No Audits

ca39be60914b Make partial sessions expire after 30 minutes, and do not extend them
Author
epriestley
Revisions
D19905: Make partial sessions expire after 30 minutes, and do not extend them
Browse Repository
Passed
No Audits

38c48ae7d048 Remove support for the "TYPE_AUTH_WILLLOGIN" event
Author
epriestley
Revisions
D19904: Remove support for the "TYPE_AUTH_WILLLOGIN" event
Browse Repository
Passed
No Audits

ff49d1ef776b Allow "bin/auth recover" to generate a link which forces a full login session
Author
epriestley
Revisions
D19903: Allow "bin/auth recover" to generate a link which forces a full login session
Browse Repository
Passed
No Audits

1c89b3175f1c Improve UI messaging around "one-shot" vs "session upgrade" MFA
Author
epriestley
Revisions
D19900: Improve UI messaging around "one-shot" vs "session upgrade" MFA
Browse Repository
Passed
No Audits

3da9844564cf Tighten some MFA/TOTP parameters to improve resistance to brute force attacks
Author
epriestley
Revisions
D19898: Tighten some MFA/TOTP parameters to improve resistance to brute force attacks
Browse Repository
Passed
No Audits

543f2b6bf156 Allow any transaction group to be signed with a one-shot "Sign With MFA" action
Author
epriestley
Revisions
D19897: Allow any transaction group to be signed with a one-shot "Sign With MFA" action
Browse Repository
Passed
No Audits

Dec 20 2018

11cf8f05b176 Remove "getApplicationTransactionObject()" from ApplicationTransactionInterface
Author
epriestley
Revisions
D19920: Remove "getApplicationTransactionObject()" from ApplicationTransactionInterface
Browse Repository
Passed
No Audits

937e88c399ab Remove obsolete, no-op implementations of "willRenderTimeline()"
Author
epriestley
Revisions
D19919: Remove obsolete, no-op implementations of "willRenderTimeline()"
Browse Repository
Passed
No Audits

b63783c06718 Carry MFA responses which have been "answered" but not "completed" through the…
Author
epriestley
Revisions
D19895: Carry MFA responses which have been "answered" but not "completed" through the MFA workflow
Browse Repository
Passed
No Audits

ce953ea44790 Explicitly mark MFA challenges as "answered" and "completed"
Author
epriestley
Revisions
D19894: Explicitly mark MFA challenges as "answered" and "completed"
Browse Repository
Passed
No Audits

657f3c380608 When accepting a TOTP response, require it respond explicitly to a specific…
Author
epriestley
Revisions
D19893: When accepting a TOTP response, require it respond explicitly to a specific challenge
Browse Repository
Passed
No Audits

0673e79d6d96 Simplify and correct some challenge TTL lockout code
Author
epriestley
Revisions
D19890: Simplify and correct some challenge TTL lockout code
Browse Repository
Passed
No Audits

Dec 19 2018

979187132d7b Update accountadmin to use new admin empowerment code
Author
amckinley
Revisions
D19915: Update accountadmin to use new admin empowerment code
Browse Repository
Passed
No Audits

Dec 18 2018

46052878b1de Bind MFA challenges to particular workflows, like signing a specific Legalpad…
Author
epriestley
Revisions
D19889: Bind MFA challenges to particular workflows, like signing a specific Legalpad document
Browse Repository
Passed
No Audits

Dec 17 2018

5e94343c7d1a Add a garbage collector for MFA challenges
Author
epriestley
Revisions
D19888: Add a garbage collector for MFA challenges
Browse Repository
Passed
No Audits

b8cbfda07ce6 Track MFA "challenges" so we can bind challenges to sessions and support SMS…
Author
epriestley
Revisions
D19886: Track MFA "challenges" so we can bind challenges to sessions and support SMS and other push MFA
Browse Repository
Passed
No Audits

c731508d748a Require MFA implementations to return a formal result object when validating…
Author
epriestley
Revisions
D19885: Require MFA implementations to return a formal result object when validating factors
Browse Repository
Passed
No Audits

Dec 14 2018

080fb1985f29 Upgrade an old "weakDigest()" inside TOTP synchronization code
Author
epriestley
Revisions
D19884: Upgrade an old "weakDigest()" inside TOTP synchronization code
Browse Repository
Passed
No Audits

1d34238dc945 Upgrade sessions digests to HMAC256, retaining compatibility with old digests
Author
epriestley
Revisions
D19883: Upgrade sessions digests to HMAC256, retaining compatibility with old digests
Browse Repository
Passed
No Audits

c58506aeaace Give sessions real PHIDs and slightly modernize session queries
Author
epriestley
Revisions
D19881: Give sessions real PHIDs and slightly modernize session queries
Browse Repository
Passed
No Audits

Nov 28 2018

1d0b99e1f834 Allow applications to require a High Security token without doing a session…
Author
epriestley
Revisions
D19843: Allow applications to require a High Security token without doing a session upgrade
Browse Repository
Passed
No Audits

Nov 16 2018

49483bdb4823 Use "%P" to protect session key hashes in SessionEngine queries from DarkConsole
Author
epriestley
Revisions
D19812: Use "%P" to protect session key hashes in SessionEngine queries from DarkConsole
Browse Repository
Passed
No Audits

Nov 15 2018

2f10d4adebf9 Continue making application fixes to Phabricator for changes to %Q semantics
Author
epriestley
Revisions
D19790: Continue making application fixes to Phabricator for changes to %Q semantics
Browse Repository
Passed
No Audits

98690ee326ce Update many Phabricator queries for new %Q query semantics
Author
epriestley
Revisions
D19789: Update many Phabricator queries for new %Q query semantics
Browse Repository
Passed
No Audits

Nov 7 2018

8a4bf386552f Use 160-bit TOTP keys rather than 80-bit TOTP keys
Author
epriestley
Revisions
D19792: Use 160-bit TOTP keys rather than 80-bit TOTP keys
Browse Repository
Passed
No Audits

Nov 6 2018

1f6a4cfffe58 Prevent users from selecting excessively bad passwords based on their username…
Author
epriestley
Revisions
D19776: Prevent users from selecting excessively bad passwords based on their username or email address
Browse Repository
Passed
No Audits

Oct 1 2018

4858d43d1601 Add 'autocomplete="off"' to MFA TOTP inputs
Author
epriestley
Revisions
D19722: Add 'autocomplete="off"' to MFA TOTP inputs
Browse Repository
Passed
No Audits

Sep 12 2018

f5e90a363e7a When a user takes actions while in a high security session, note it on the…
Author
epriestley
Revisions
D19665: When a user takes actions while in a high security session, note it on the resulting transactions
Browse Repository
Passed
No Audits

Aug 16 2018

0ccf1410e057 Give PhabricatorAuthPassword a formal CAN_EDIT policy
Author
epriestley
Revisions
D19592: Give PhabricatorAuthPassword a formal CAN_EDIT policy
Browse Repository
Passed
No Audits

Aug 9 2018

6df278bea84a In "bin/ssh-auth", cache a structure instead of a flat file because paths may…
Author
epriestley
Revisions
D19568: In "bin/ssh-auth", cache a structure instead of a flat file because paths may change at runtime
Browse Repository
Passed
No Audits

Apr 25 2018

1b24b486f58a Manage object mailKeys automatically in Mail instead of storing them on objects
Author
epriestley
Revisions
D19399: Manage object mailKeys automatically in Mail instead of storing them on objects
Browse Repository
Passed
No Audits

Mar 1 2018

94d340fcffab Include OAuth targets in "form-action" Content-Security-Policy
Author
epriestley
Revisions
D19159: Include OAuth targets in "form-action" Content-Security-Policy
Browse Repository
Passed
No Audits

ab579f251110 Never generate file download forms which point to the CDN domain, tighten "form…
Author
epriestley
Revisions
D19156: Never generate file download forms which point to the CDN domain, tighten "form-action" CSP
Browse Repository
Passed
No Audits

Feb 18 2018

05a4c55c52be Explicitly add rel="noreferrer" to all external links
Author
epriestley
Revisions
D19118: Explicitly add rel="noreferrer" to all external links
Browse Repository
Passed
No Audits

Feb 11 2018

653bc0fa019f Read lock all transaction edits
Author
epriestley
Revisions
D19059: Read lock all transaction edits
Browse Repository
Passed
No Audits

Feb 8 2018

f090fa7426e4 Use object PHIDs for "Thread-Topic" headers in mail
Author
epriestley
Revisions
D19012: Use object PHIDs for "Thread-Topic" headers in mail
Browse Repository
Passed
No Audits

Jan 26 2018

5529458e14eb Add test coverage for SSH key revocation
Author
epriestley
Revisions
D18929: Add test coverage for SSH key revocation
Browse Repository
Passed
No Audits

deb754dfe173 Make SSH key revocation actually prevent adding the same key back
Author
epriestley
Revisions
D18928: Make SSH key revocation actually prevent adding the same key back
Browse Repository
Passed
No Audits

Jan 23 2018

bf2868c07016 Rename "PhabricatorPasswordHashInterface" to…
Author
epriestley
Revisions
D18916: Rename "PhabricatorPasswordHashInterface" to "PhabricatorAuthPasswordHashInterface"
Browse Repository
Passed
No Audits

3becd5a57c27 Add "bin/auth revoke --list" to explain what can be revoked
Author
epriestley
Revisions
D18910: Add "bin/auth revoke --list" to explain what can be revoked
Browse Repository
Passed
No Audits

21e415299f26 Mark all existing password hashes as "legacy" and start upgrading digest formats
Author
epriestley
Revisions
D18908: Mark all existing password hashes as "legacy" and start upgrading digest formats
Browse Repository
Passed
No Audits

13ef5c6f2314 When administrators revoke SSH keys, don't include a "security warning" in the…
Author
epriestley
Revisions
D18907: When administrators revoke SSH keys, don't include a "security warning" in the mail
Browse Repository
Passed
No Audits

026ec11b9d6b Add a rate limit for guessing old passwords when changing passwords
Author
epriestley
Revisions
D18906: Add a rate limit for guessing old passwords when changing passwords
Browse Repository
Passed
No Audits

abc030fa008b Move account passwords to shared infrastructure
Author
epriestley
Revisions
D18903: Move account passwords to shared infrastructure
Browse Repository
Passed
No Audits

b8a515cb29d8 Bring new password validation into AuthPasswordEngine
Author
epriestley
Revisions
D18902: Bring new password validation into AuthPasswordEngine
Browse Repository
Passed
No Audits

aa3b582c7b72 Remove "set password" from `bin/accountadmin` and let `bin/auth recover`…
Author
epriestley
Revisions
D18901: Remove "set password" from `bin/accountadmin` and let `bin/auth recover` recover anyone
Browse Repository
Passed
No Audits

5a8a56f414fc Prepare the new AuthPassword infrastructure for storing account passwords
Author
epriestley
Revisions
D18900: Prepare the new AuthPassword infrastructure for storing account passwords
Browse Repository
Passed
No Audits

bb12f4bab718 Add test coverage to the PasswordEngine upgrade workflow and fix a few bugs
Author
epriestley
Revisions
D18897: Add test coverage to the PasswordEngine upgrade workflow and fix a few bugs
Browse Repository
Passed
No Audits

c280c85772a3 Consolidate password verification/revocation logic in a new…
Author
epriestley
Revisions
D18896: Consolidate password verification/revocation logic in a new PhabricatorAuthPasswordEngine
Browse Repository
Passed
No Audits

42e2cd9af02e Add a "--force" flag to `bin/auth revoke`
Author
epriestley
Revisions
D18895: Add a "--force" flag to `bin/auth revoke`
Browse Repository
Passed
No Audits

Jan 22 2018

9c00a437848c Add a more modern object for storing password hashes
Author
epriestley
Revisions
D18894: Add a more modern object for storing password hashes
Browse Repository
Passed
No Audits

fa1ecb7f6612 Add a `bin/auth revoke` revoker for SSH keys
Author
epriestley
Revisions
D18893: Add a `bin/auth revoke` revoker for SSH keys
Browse Repository
Passed
No Audits

39c3b10a2f21 Add a `bin/auth revoke` revoker for sessions
Author
epriestley
Revisions
D18892: Add a `bin/auth revoke` revoker for sessions
Browse Repository
Passed
No Audits

7970cf058517 Add a `bin/auth revoke` revoker for temporary tokens
Author
epriestley
Revisions
D18891: Add a `bin/auth revoke` revoker for temporary tokens
Browse Repository
Passed
No Audits

Dec 26 2017

ad4db9b2f3f8 Separate "Set/Reset Password" from "Change Password"
Author
epriestley
Revisions
D18840: Separate "Set/Reset Password" from "Change Password"
Browse Repository
Passed
No Audits

Dec 5 2017

4f8340c05f2b Restore the "Log In" menubar action
Author
epriestley
Revisions
D18818: Restore the "Log In" menubar action
Browse Repository
Passed
No Audits

Nov 28 2017

dc62d18b4736 Allow MFA enrollment before email verification
Author
epriestley
Revisions
D18792: Allow MFA enrollment before email verification
Browse Repository
Passed
No Audits

ab0f61aa323d Tell users to "Wait Patiently" for admin account verification later in the…
Author
epriestley
Revisions
D18791: Tell users to "Wait Patiently" for admin account verification later in the registration process
Browse Repository
Passed
No Audits

Oct 9 2017

5897294fa97e Add spelling TODOs
Author
0
Revisions
D18695: Add spelling TODOs
Browse Repository
Passed
No Audits

9bd6a3705559 Fix spelling
Author
0
Revisions
D18693: Fix spelling
Browse Repository
Failed
No Audits

Sep 20 2017

3fbad684c142 More completely explain why we're refusing to send reset mail to an unverified…
Author
epriestley
Revisions
D18630: More completely explain why we're refusing to send reset mail to an unverified address
Browse Repository
Passed
No Audits

Aug 21 2017

39d19c33ec9c Redirect users back to where they added an SSH Key
Author
Chad Little <chad@phacility.com>
Revisions
D18445: Redirect users back to where they added an SSH Key
Browse Repository
Passed
No Audits

Aug 2 2017

ba4b936dffce Use Log In vs. Login when it's a verb
Author
Chad Little <chad@phacility.com>
Revisions
D18322: Use Log In vs. Login when it's a verb
Browse Repository
Passed
No Audits

May 31 2017

2c0dab055f73 Make "simple" a "button type", not a "color"
Author
epriestley
Revisions
D18048: Make "simple" a "button type", not a "color"
Browse Repository
Passed
No Audits

Apr 14 2017

69053a40f947 Dirty the SSH key cache when usernames change
Author
epriestley
Revisions
D17687: Dirty the SSH key cache when usernames change
Browse Repository
Passed
No Audits

Apr 6 2017

3d816e94dfbe Rename "PhabricatorHash::digest()" to "weakDigest()"
Author
epriestley
Revisions
D17632: Rename "PhabricatorHash::digest()" to "weakDigest()"
Browse Repository
Passed
No Audits

d450a088906e Support HMAC+SHA256 with automatic key generation and management
Author
epriestley
Revisions
D17630: Support HMAC+SHA256 with automatic key generation and management
Browse Repository
Passed
No Audits

Apr 4 2017

873b39be8211 Remove PhabricatorFile::buildFromFileDataOrHash()
Author
epriestley
Revisions
D17617: Remove PhabricatorFile::buildFromFileDataOrHash()
Browse Repository
Passed
No Audits

45b386596e62 Make the Files "TTL" API more structured
Author
epriestley
Revisions
D17616: Make the Files "TTL" API more structured
Browse Repository
Passed
No Audits

Mar 3 2017

8ce25838f541 Provide "bin/auth revoke" with a revoker for Conduit tokens
Author
epriestley
Revisions
D17458: Provide "bin/auth revoke" with a revoker for Conduit tokens
Browse Repository
Passed
No Audits

Feb 22 2017

bf44210dc8f1 Reduce application search engine results list for Dashboards
Author
Chad Little <chad@phacility.com>
Revisions
D17341: Reduce application search engine results list for Dashboards
Browse Repository
Passed
No Audits

Feb 17 2017

a778151f28c1 Fix errors found by PHPStan
Author
vrana
Revisions
D17371: Fix errors found by PHPStan
Browse Repository
Passed
No Audits

Feb 13 2017

8dd7b544fe0a Don't show an auth provider as enabled if it's still being created
Author
amckinley
Revisions
D17337: Don't show an auth provider as enabled if it's still being created
Browse Repository
Passed
No Audits

Jan 21 2017

402b6473d809 Move Favorites and User menus to MenuBarExtensions
Author
epriestley
Revisions
D17239: Move Favorites and User menus to MenuBarExtensions
Browse Repository
Passed
No Audits

Jan 17 2017

6f5dab634db2 Redesign header menus and search
Author
Chad Little <chad@phacility.com>
Revisions
D17209: Redesign header menus and search
Browse Repository
Passed
No Audits

23721799fd0b Explicitly warn the user multiple times when they try to register an external…
Author
epriestley
Revisions
D17212: Explicitly warn the user multiple times when they try to register an external account with an existing email
Browse Repository
Passed
No Audits

Dec 9 2016

9c72c1b1daa9 When rendering the "you were invited" header, query the inviting user with the…
Author
epriestley
Revisions
D17015: When rendering the "you were invited" header, query the inviting user with the omnipotent viewer
Browse Repository
Passed
No Audits

Dec 5 2016

0ad1dd640a09 Remove the Persona login method
Author
eadler
Revisions
D16371: Remove the Persona login method
Browse Repository
Passed
No Audits

Nov 17 2016

2befd239a85e Add session and request hooks to PhabricatorAuthSessionEngine
Author
epriestley
Revisions
D16890: Add session and request hooks to PhabricatorAuthSessionEngine
Browse Repository
Passed
No Audits

Nov 15 2016

7097abbe570c Add a bunch of Phacility-specific code to the upstream, thinly veiled as…
Author
epriestley
Revisions
D16861: Add a bunch of Phacility-specific code to the upstream, thinly veiled as generic code
Browse Repository
Passed
No Audits

Nov 9 2016

706c21375e8f Remove empty implementations of `describeAutomaticCapabilities()`
Author
epriestley
Revisions
D16831: Remove empty implementations of `describeAutomaticCapabilities()`
Browse Repository
Passed
No Audits

Oct 21 2016

c21a71f02489 Cache generation of the SSH authentication keyfile for sshd
Author
epriestley
Revisions
D16744: Cache generation of the SSH authentication keyfile for sshd
Browse Repository
Passed
No Audits

Sep 13 2016

2588b4fac0c1 Added initial class for displaying invisible chars
Author
jcox
Revisions
D16541: Added initial class for displaying invisible chars
Browse Repository
Passed
No Audits

Sep 6 2016

defee9385196 Add Slack authentication adapter
Author
chad
Revisions
D16496: Add Slack authentication adapter
Browse Repository
Passed
No Audits

Aug 29 2016

60d1762a85ce Redesign Config Application
Author
Chad Little <chad@phacility.com>
Revisions
D16468: Redesign Config Application
Browse Repository
Passed
No Audits