Diffusion Phabricator (master) History

phabricator/src/applications/auth/engine
master

Nov 3 2020

ae5a38f3349f Guarantee terms in PhabricatorAuthPasswordEngine are strings
Author
epriestley
Revisions
D21487: Guarantee terms in PhabricatorAuthPasswordEngine are strings
Browse Repository
Passed
No Audits

Jan 30 2020

12c337098872 When issuing a "no-op" MFA token because no MFA is configured, don't give the…
Author
epriestley
Revisions
D20958: When issuing a "no-op" MFA token because no MFA is configured, don't give the timeline story a badge
Browse Repository
Passed
No Audits

Jul 24 2019

32dd13d43421 Modularize user activity log message types
Author
epriestley
Revisions
D20671: Modularize user activity log message types
Browse Repository
Passed
No Audits

Jun 18 2019

1dd62f79cedb Fix more "msort()" vs "msortv()" callsites
Author
epriestley
Revisions
D20587: Fix more "msort()" vs "msortv()" callsites
Browse Repository
Passed
No Audits

Apr 14 2019

82c46f4b93bd Update "add panel" and "remove panel" Dashboard flows to the new panel storage…
Author
epriestley
Revisions
D20408: Update "add panel" and "remove panel" Dashboard flows to the new panel storage format
Browse Repository
Passed
No Audits

Mar 5 2019

920ab13cfb86 Correct a possible fatal in the non-CSRF Duo MFA workflow
Author
epriestley
Revisions
D20234: Correct a possible fatal in the non-CSRF Duo MFA workflow
Browse Repository
Passed
No Audits

Feb 24 2019

01d0fc443afe Fix a typo
Author
arielyang
Revisions
D20203: Fix a typo
Browse Repository
Passed
No Audits

Jan 28 2019

d8d4efe89e85 Require MFA to edit MFA providers
Author
epriestley
Revisions
D20038: Require MFA to edit MFA providers
Browse Repository
Passed
No Audits

29b4fad94173 Get rid of "throwResult()" for control flow in MFA factors
Author
epriestley
Revisions
D20035: Get rid of "throwResult()" for control flow in MFA factors
Browse Repository
Passed
No Audits

8e5d9c6f0eb5 Allow MFA providers to be deprecated or disabled
Author
epriestley
Revisions
D20031: Allow MFA providers to be deprecated or disabled
Browse Repository
Passed
No Audits

Jan 24 2019

c9ff6ce390d6 Add CSRF to SMS challenges, and pave the way for more MFA types (including Duo)
Author
epriestley
Revisions
D20028: Add CSRF to SMS challenges, and pave the way for more MFA types (including Duo)
Browse Repository
Passed
No Audits

Jan 23 2019

587e9cea19ac Always require MFA to edit contact numbers
Author
epriestley
Revisions
D20024: Always require MFA to edit contact numbers
Browse Repository
Passed
No Audits

e91bc26da685 Don't rate limit users clicking "Wait Patiently" at an MFA gate even if they…
Author
epriestley
Revisions
D20018: Don't rate limit users clicking "Wait Patiently" at an MFA gate even if they typed some text earlier
Browse Repository
Passed
No Audits

0fcff782533a Convert user MFA factors to point at configurable "MFA Providers", not raw "MFA…
Author
epriestley
Revisions
D19975: Convert user MFA factors to point at configurable "MFA Providers", not raw "MFA Factors"
Browse Repository
Passed
No Audits

Jan 4 2019

1f4cf23455d7 Remove "phabricator.csrf-key" and upgrade CSRF hashing to SHA256
Author
epriestley
Revisions
D19946: Remove "phabricator.csrf-key" and upgrade CSRF hashing to SHA256
Browse Repository
Passed
No Audits

Dec 28 2018

918f4ebcd82c Fix a double-prompt for MFA when recovering a password account
Author
epriestley
Revisions
D19906: Fix a double-prompt for MFA when recovering a password account
Browse Repository
Passed
No Audits

ca39be60914b Make partial sessions expire after 30 minutes, and do not extend them
Author
epriestley
Revisions
D19905: Make partial sessions expire after 30 minutes, and do not extend them
Browse Repository
Passed
No Audits

ff49d1ef776b Allow "bin/auth recover" to generate a link which forces a full login session
Author
epriestley
Revisions
D19903: Allow "bin/auth recover" to generate a link which forces a full login session
Browse Repository
Passed
No Audits

1c89b3175f1c Improve UI messaging around "one-shot" vs "session upgrade" MFA
Author
epriestley
Revisions
D19900: Improve UI messaging around "one-shot" vs "session upgrade" MFA
Browse Repository
Passed
No Audits

3da9844564cf Tighten some MFA/TOTP parameters to improve resistance to brute force attacks
Author
epriestley
Revisions
D19898: Tighten some MFA/TOTP parameters to improve resistance to brute force attacks
Browse Repository
Passed
No Audits

Dec 20 2018

b63783c06718 Carry MFA responses which have been "answered" but not "completed" through the…
Author
epriestley
Revisions
D19895: Carry MFA responses which have been "answered" but not "completed" through the MFA workflow
Browse Repository
Passed
No Audits

ce953ea44790 Explicitly mark MFA challenges as "answered" and "completed"
Author
epriestley
Revisions
D19894: Explicitly mark MFA challenges as "answered" and "completed"
Browse Repository
Passed
No Audits

Dec 18 2018

46052878b1de Bind MFA challenges to particular workflows, like signing a specific Legalpad…
Author
epriestley
Revisions
D19889: Bind MFA challenges to particular workflows, like signing a specific Legalpad document
Browse Repository
Passed
No Audits

Dec 17 2018

b8cbfda07ce6 Track MFA "challenges" so we can bind challenges to sessions and support SMS…
Author
epriestley
Revisions
D19886: Track MFA "challenges" so we can bind challenges to sessions and support SMS and other push MFA
Browse Repository
Passed
No Audits

c731508d748a Require MFA implementations to return a formal result object when validating…
Author
epriestley
Revisions
D19885: Require MFA implementations to return a formal result object when validating factors
Browse Repository
Passed
No Audits

Dec 14 2018

1d34238dc945 Upgrade sessions digests to HMAC256, retaining compatibility with old digests
Author
epriestley
Revisions
D19883: Upgrade sessions digests to HMAC256, retaining compatibility with old digests
Browse Repository
Passed
No Audits

c58506aeaace Give sessions real PHIDs and slightly modernize session queries
Author
epriestley
Revisions
D19881: Give sessions real PHIDs and slightly modernize session queries
Browse Repository
Passed
No Audits

Nov 28 2018

1d0b99e1f834 Allow applications to require a High Security token without doing a session…
Author
epriestley
Revisions
D19843: Allow applications to require a High Security token without doing a session upgrade
Browse Repository
Passed
No Audits

Nov 16 2018

49483bdb4823 Use "%P" to protect session key hashes in SessionEngine queries from DarkConsole
Author
epriestley
Revisions
D19812: Use "%P" to protect session key hashes in SessionEngine queries from DarkConsole
Browse Repository
Passed
No Audits

Nov 15 2018

2f10d4adebf9 Continue making application fixes to Phabricator for changes to %Q semantics
Author
epriestley
Revisions
D19790: Continue making application fixes to Phabricator for changes to %Q semantics
Browse Repository
Passed
No Audits

Nov 6 2018

1f6a4cfffe58 Prevent users from selecting excessively bad passwords based on their username…
Author
epriestley
Revisions
D19776: Prevent users from selecting excessively bad passwords based on their username or email address
Browse Repository
Passed
No Audits

Sep 12 2018

f5e90a363e7a When a user takes actions while in a high security session, note it on the…
Author
epriestley
Revisions
D19665: When a user takes actions while in a high security session, note it on the resulting transactions
Browse Repository
Passed
No Audits

Feb 11 2018

653bc0fa019f Read lock all transaction edits
Author
epriestley
Revisions
D19059: Read lock all transaction edits
Browse Repository
Passed
No Audits

Jan 23 2018

bf2868c07016 Rename "PhabricatorPasswordHashInterface" to…
Author
epriestley
Revisions
D18916: Rename "PhabricatorPasswordHashInterface" to "PhabricatorAuthPasswordHashInterface"
Browse Repository
Passed
No Audits

abc030fa008b Move account passwords to shared infrastructure
Author
epriestley
Revisions
D18903: Move account passwords to shared infrastructure
Browse Repository
Passed
No Audits

b8a515cb29d8 Bring new password validation into AuthPasswordEngine
Author
epriestley
Revisions
D18902: Bring new password validation into AuthPasswordEngine
Browse Repository
Passed
No Audits

5a8a56f414fc Prepare the new AuthPassword infrastructure for storing account passwords
Author
epriestley
Revisions
D18900: Prepare the new AuthPassword infrastructure for storing account passwords
Browse Repository
Passed
No Audits

bb12f4bab718 Add test coverage to the PasswordEngine upgrade workflow and fix a few bugs
Author
epriestley
Revisions
D18897: Add test coverage to the PasswordEngine upgrade workflow and fix a few bugs
Browse Repository
Passed
No Audits

c280c85772a3 Consolidate password verification/revocation logic in a new…
Author
epriestley
Revisions
D18896: Consolidate password verification/revocation logic in a new PhabricatorAuthPasswordEngine
Browse Repository
Passed
No Audits

Apr 6 2017

3d816e94dfbe Rename "PhabricatorHash::digest()" to "weakDigest()"
Author
epriestley
Revisions
D17632: Rename "PhabricatorHash::digest()" to "weakDigest()"
Browse Repository
Passed
No Audits

Nov 17 2016

2befd239a85e Add session and request hooks to PhabricatorAuthSessionEngine
Author
epriestley
Revisions
D16890: Add session and request hooks to PhabricatorAuthSessionEngine
Browse Repository
Passed
No Audits

Aug 29 2016

60d1762a85ce Redesign Config Application
Author
Chad Little <chad@phacility.com>
Revisions
D16468: Redesign Config Application
Browse Repository
Passed
No Audits

Aug 22 2016

15ed2b936c37 Update Config Application UI
Author
Chad Little <chad@phacility.com>
Revisions
D16429: Update Config Application UI
Browse Repository
Passed
No Audits

Jun 7 2016

814fa135b036 Centralize "this is the current user for the request" code
Author
epriestley
Revisions
D16066: Centralize "this is the current user for the request" code
Browse Repository
Passed
No Audits

Jun 5 2016

6f1053c206f1 Convert user profile images into a standard cache
Author
epriestley
Revisions
D16040: Convert user profile images into a standard cache
Browse Repository
Passed
No Audits

2b344b2bb500 Make caches misses throw by default intead of inline-generating
Author
epriestley
Revisions
D16042: Make caches misses throw by default intead of inline-generating
Browse Repository
Passed
No Audits

Jun 2 2016

9180f429eb9f Provide a general-purpose, modular user cache for settings and other similar…
Author
epriestley
Revisions
D16001: Provide a general-purpose, modular user cache for settings and other similar data
Browse Repository
Passed
No Audits

Apr 5 2016

46881c4ce507 Add a session engine extension point
Author
epriestley
Revisions
D15629: Add a session engine extension point
Browse Repository
Passed
No Audits

Mar 16 2016

a837c3d73eaf Make temporary token storage/schema more flexible
Author
epriestley
Revisions
D15478: Make temporary token storage/schema more flexible
Browse Repository
Passed
No Audits

8e3ea4e034eb Use new modular temporary auth token constants in one-time login and password…
Author
epriestley
Revisions
D15476: Use new modular temporary auth token constants in one-time login and password reset flows
Browse Repository
Passed
No Audits

Sep 1 2015

29948eaa5bd2 Use phutil_hashes_are_identical() when comparing hashes in Phabricator
Author
epriestley
Revisions
D14026: Use phutil_hashes_are_identical() when comparing hashes in Phabricator
Browse Repository
No Builds
No Audits

Jun 17 2015

4761cb8d7390 Use PhutilInvalidStateException
Author
joshuaspence
Revisions
D13327: Use PhutilInvalidStateException
Browse Repository
No Builds
No Audits

Jun 4 2015

992c19957760 Add "Mailing List" users
Author
epriestley
Revisions
D13123: Add "Mailing List" users
Browse Repository
No Builds
No Audits

Feb 12 2015

d39da529ca26 Legalpad - allow for legalpad documents to be required to be signed for using…
Author
btrahan
Revisions
D11759: Legalpad - allow for legalpad documents to be required to be signed for using Phabricator
Browse Repository
No Builds
No Audits

Feb 11 2015

779744342865 Support invites in the registration and login flow
Author
epriestley
Revisions
D11737: Support invites in the registration and login flow
Browse Repository
No Builds
No Audits

6f90fbdef806 Send emails for email invites
Author
epriestley
Revisions
D11736: Send emails for email invites
Browse Repository
No Builds
No Audits

Feb 10 2015

2a0af8e2995d Add email invites to Phabricator (logic only)
Author
epriestley
Revisions
D11723: Add email invites to Phabricator (logic only)
Browse Repository
No Builds
No Audits

Aug 4 2014

42cf7f6faa10 Make the current session key a component of the CSRF token
Author
epriestley
Revisions
D10136: Make the current session key a component of the CSRF token
Browse Repository
No Builds
Audited

95eeffff7e5d Terminate other sessions on credential changes
Author
epriestley
Revisions
D10135: Terminate other sessions on credential changes
Browse Repository
No Builds
No Audits

May 22 2014

f1534e6feb6a Make password reset emails use one-time tokens
Author
epriestley
Revisions
D9252: Make password reset emails use one-time tokens
Browse Repository
No Builds
No Audits

May 1 2014

a04e138ae247 Minor cleanup of some session code
Author
epriestley
Revisions
D8924: Minor cleanup of some session code
Browse Repository
No Builds
No Audits

50376aad04d2 Require multiple auth factors to establish web sessions
Author
epriestley
Revisions
D8922: Require multiple auth factors to establish web sessions
Browse Repository
No Builds
No Audits

Apr 30 2014

23e654ec2bc8 Rate limit multi-factor actions
Author
epriestley
Revisions
D8911: Rate limit multi-factor actions
Browse Repository
No Builds
No Audits

Apr 28 2014

a017a8e02b51 Make two-factor auth actually work
Author
epriestley
Revisions
D8886: Make two-factor auth actually work
Browse Repository
No Builds
No Audits

3f5a55fa6e5a Let users review their own account activity logs
Author
epriestley
Revisions
D8871: Let users review their own account activity logs
Browse Repository
No Builds
No Audits

f42ec84d0c6b Add "High Security" mode to support multi-factor auth
Author
epriestley
Revisions
D8851: Add "High Security" mode to support multi-factor auth
Browse Repository
No Builds
No Audits

Jan 23 2014

69ddb0ced631 Issue "anonymous" sessions for logged-out users
Author
epriestley
Revisions
D8043: Issue "anonymous" sessions for logged-out users
Browse Repository
No Builds
No Audits

Jan 16 2014

2ec45d42a689 Remove session limits and sequencing
Author
epriestley
Revisions
D7978: Remove session limits and sequencing
Browse Repository
No Builds
No Audits

Jan 15 2014

acb141cf52c1 Expire and garbage collect unused sessions
Author
epriestley
Revisions
D7976: Expire and garbage collect unused sessions
Browse Repository
No Builds
No Audits

Jan 14 2014

d392a8f15700 Replace "web" and "conduit" magic session strings with constants
Author
epriestley
Revisions
D7963: Replace "web" and "conduit" magic session strings with constants
Browse Repository
No Builds
No Audits

eef314b70149 Separate session management from PhabricatorUser
Author
epriestley
Revisions
D7962: Separate session management from PhabricatorUser
Browse Repository
No Builds
No Audits