lams-github / lams_common / src / java / org / lamsfoundation / lams / integration

security

Clone Tools

Stats

Commits this week: 0
Total Committers: 13
Last Commit:
Commits this week: 0

Lines of code count not available

Commit Activity

Commits By Day In Week
52 week commits volume
Commits By Day In Week
Commits by day
Commits By Day In Week
Commits by hour
Commits By Hour In Day
Commit calendar
 

Most active committers (90 days)

loading
loading
  • last updated a few seconds ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Friday 14 Oct 2022
9:23 pm

Marcin Cieslak

LDEB-5335 Add structured audit logs on various admin actions

Options
    • -4
    • +4
    ./SsoHandler.java
  2. … 22 more files in changeset.
Friday 07 Oct 2022
8:20 pm

Marcin Cieslak

LDEV-5178 Skip password expiration check on login via integrations

Options
    • -0
    • +2
    ./SsoHandler.java
  2. … 2 more files in changeset.
Friday 08 Jul 2022
5:55 pm

Marcin Cieslak

LDEV-5320 Give more details about course roles being added and removed

This approach uses logs in controllers rather than in services.

Options
    • -10
    • +7
    ./SsoHandler.java
  2. … 5 more files in changeset.
Tuesday 05 Jul 2022
5:33 pm

Marcin Cieslak

LDEV-5320 Audit user being locked out

Options
    • -8
    • +13
    ./SsoHandler.java
Wednesday 04 May 2022
10:46 pm

Marcin Cieslak

LDEV-5311 Send emails with password change link on user import

Options
    • -1
    • +26
    ./RandomPasswordGenerator.java
  2. … 9 more files in changeset.
8:48 pm

Marcin Cieslak

LDEV-5311 Generate passwords for imported users with no passwd provided

Options
    • -0
    • +11
    ./RandomPasswordGenerator.java
  2. … 4 more files in changeset.
Thursday 14 Apr 2022
4:04 am

Marcin Cieslak

LDEV-5304 Make Signup page process CSRF token correctly

Also better detect LoginAs and signup flow.

Options
    • -13
    • +11
    ./SsoHandler.java
  2. … 3 more files in changeset.
Sunday 03 Apr 2022
2:59 pm

Marcin Cieslak

LDEV-5304 Secure login page from CSRF attack

Check for CSRF attack only for regular logins.

For LoginAs feature and integrations existing HTTP session gets

invalidated and so is the CSRF token.

Options
    • -2
    • +12
    ./SsoHandler.java
  2. … 4 more files in changeset.
Monday 21 Mar 2022
5:09 pm

Marcin Cieslak

LDEV-5302 Rename sysadmin role to appadmin

Options
    • -1
    • +1
    ./Authenticator.java
  2. … 181 more files in changeset.
Tuesday 08 Feb 2022
6:40 pm

Marcin Cieslak

LDEV-5284 Use SHA-256 for parameters hash in integration calls

SHA-1 is still supported.

Options
    • -1
    • +8
    ./Authenticator.java
  2. … 7 more files in changeset.
Thursday 03 Feb 2022
10:20 pm

Marcin Cieslak

LDEV-5278 Remove obsolete handler

Options
    • -45
    • +0
    ./CommonDeploymentHandler.java
  2. … 2 more files in changeset.
Thursday 05 Nov 2020
6:56 pm

Marcin Cieslak

LDEV-5094 Add logs to SSO handler

Options
    • -6
    • +59
    ./SsoHandler.java
Saturday 24 Oct 2020
11:38 pm

Marcin Cieslak

LDEV-5094, LDEV-4030 Fix loop of user integrated relogin and lock out

Options
    • -5
    • +14
    ./SsoHandler.java
Friday 16 Oct 2020
5:57 pm

Marcin Cieslak

LDEV-5094 Redirect authenticated user immediately

Detect situation when user is automatically reauthenticating via

integrations and redirect him straight to the desired URL, so the

default servlet does not kick in.

Options
    • -9
    • +15
    ./SsoHandler.java
Tuesday 07 Jul 2020
8:50 pm

Marcin Cieslak

LKC-222 Simplify authorization flow for Workflow Automation

Learners need to already exist in the organisation. Staff gets synced

and added.

Options
    • -1
    • +3
    ./Authenticator.java
  2. … 2 more files in changeset.
Monday 06 Jul 2020
6:52 pm

Marcin Cieslak

LKC-222 Add course and lesson roles to user on WA access

Options
    • -7
    • +5
    ./Authenticator.java
  2. … 4 more files in changeset.
Saturday 11 Jan 2020
5:33 am

Andrey Balan

LDEV-4831 Bypass 2FA if using Login-as

(cherry picked from commit 26e7a51d2a74ef045d6e056752fd60bf510f2024)

Options
    • -4
    • +7
    ./SsoHandler.java
5:33 am

Andrey Balan

LDEV-4831 Bypass 2FA if using Login-as

Options
    • -4
    • +7
    ./SsoHandler.java
Monday 25 Nov 2019
6:09 pm

Marcin Cieslak

Merge remote-tracking branch 'origin/master' into develop

Conflicts:

lams_common/src/java/org/lamsfoundation/lams/integration/security/SsoHandler.java

Options
    • -10
    • +4
    ./SsoHandler.java
Friday 22 Nov 2019
11:55 pm

Marcin Cieslak

LDEV-4030 Prevent failedAttempts overflow in DB

Options
    • -12
    • +6
    ./SsoHandler.java
Thursday 21 Nov 2019
9:36 pm

Marcin Cieslak

Merge remote-tracking branch 'origin/master' into develop

Conflicts:

lams_central/src/java/org/lamsfoundation/lams/web/HomeController.java

lams_central/web/includes/javascript/authoring/authoringGeneral.js

lams_central/web/includes/javascript/authoring/authoringProperty.js

Options
    • -0
    • +3
    ./SsoHandler.java
  2. … 7 more files in changeset.
9:25 pm

Marcin Cieslak

Merge branch 'SP-3'

Options
    • -0
    • +3
    ./SsoHandler.java
  2. … 7 more files in changeset.
Tuesday 05 Nov 2019
11:25 pm

Marcin Cieslak

Merge remote-tracking branch 'origin/master' into develop

Conflicts:

lams_common/src/java/org/lamsfoundation/lams/integration/security/SsoHandler.java

Options
    • -7
    • +0
    ./SsoHandler.java
  2. … 1 more file in changeset.
6:52 pm

Marcin Cieslak

LDEV-4901 Rewrite session invalidation mechanism

On WildFly 8 session invalidation mechanism had some bugs. Marek

introduced a workaround in LDEV-3413. The mechanism was adjusted in

LDEV-4293, especially in this commit

https://code.lamsfoundation.org/fisheye/changelog/lams-github?cs=131ce42e64069f574a2a4a9bc1e5c4be4918e5bb

Newer WildFly versions do not seem to have this bug. A part of

workaround was removed in LDEV-4696, but invalidation mechanism stayed

as if the bugs were still present. The mechanism introduced the problem

with timeouts. Now that the bugs seems to be gone, the invalidation

mechanism was rewritten to a more straightforward version which should

have been used from the start.

It is worth keeping in mind that when one user session is present and

another is being created (another browser, integration call, sysadmin's

LoginAs feature), then user gets authenticated, then old session gets

invalidated and the user gets authenticated AGAIN by WildFly using

cached credentials. Caching is so useful that we can not turn it off. It

means that, though, we need to keep login token generated by

LoginRequestServlet for longer than just first authentication, as we get

authentication call twice. Now we keep it until it is timed out.

Options
    • -9
    • +3
    ./SsoHandler.java
  2. … 3 more files in changeset.
Monday 15 Apr 2019
9:26 pm

Marcin Cieslak

SP-3 Automatically redirect to logout URL configured in sysadmin

Options
    • -0
    • +3
    ./SsoHandler.java
  2. … 7 more files in changeset.
Monday 04 Feb 2019
4:40 pm

Marcin Cieslak

LDEV-4767 Move logout logging to higher level methods

This way we know what triggered logout: manual logout, sysadmin or

duplicate session in another browser.

Timeout logout will be silent.

Options
    • -0
    • +8
    ./SsoHandler.java
  2. … 3 more files in changeset.
4:21 pm

Marcin Cieslak

LDEV-4767 Add IP to login event

Options
    • -12
    • +27
    ./SsoHandler.java
Friday 01 Feb 2019
10:02 pm

Marcin Cieslak

LDEV-4767 Add login and logout event logs

Options
    • -1
    • +6
    ./SsoHandler.java
  2. … 4 more files in changeset.
Saturday 21 Apr 2018
6:33 pm

Marcin Cieslak

Monthly merge from master to lams31

Conflicts:

lams_build/conf/slim/standalone.xml

lams_build/conf/standalone.xml

lams_build/lib/lams/lams-central.jar

lams_build/lib/lams/lams.jar

lams_central/src/java/org/lamsfoundation/lams/authoring/ObjectExtractor.java

lams_central/src/java/org/lamsfoundation/lams/authoring/template/web/LdTemplateAction.java

lams_central/src/java/org/lamsfoundation/lams/authoring/template/web/TBLTemplateAction.java

lams_central/src/java/org/lamsfoundation/lams/authoring/web/AuthoringAction.java

lams_central/src/java/org/lamsfoundation/lams/web/SessionListener.java

lams_common/src/java/org/lamsfoundation/lams/integration/security/SsoHandler.java

lams_tool_preview/src/java/org/lamsfoundation/lams/tool/peerreview/web/action/MonitoringAction.java

lams_tool_scratchie/src/java/org/lamsfoundation/lams/tool/scratchie/service/ScratchieServiceImpl.java

Options
    • -10
    • +11
    ./SsoHandler.java
  2. … 20 more files in changeset.
Tuesday 27 Mar 2018
2:24 pm

Marcin Cieslak

LDEV-4293 Clear login mapping even if user DTO is not present

Options
    • -13
    • +13
    ./SsoHandler.java
  2. … 2 more files in changeset.