Commit graph

98 commits

Author SHA1 Message Date
Nicola Murino
a768dac29d
jwt: increase leeway and add some tests
also export a constant for the Cookie name

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2025-10-11 14:14:21 +02:00
Nicola Murino
0ae2354fed
JWT: replace jwtauth/jwx with lightweight wrapper around go-jose
We replaced the jwtauth and jwx libraries with a minimal custom wrapper
around go-jose because we don’t need the full feature set provided by jwx.
Implementing our own wrapper simplifies the codebase and improves
maintainability.

Moreover, go-jose depends only on the standard library, resulting in a
leaner dependency that still meets all our requirements.

This change also reduces the SFTPGo binary size by approximately 1MB

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2025-10-08 18:10:39 +02:00
Nicola Murino
ddbe40cefa
HTTPD, WebDAV: use http.ResponseController
backport from Enterprise edition

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2025-08-02 18:00:45 +02:00
Nicola Murino
7317674b41
Remove legacy data retention API
Data retention is now managed via the EventManager, introduced in v2.4.0.
This allows scheduling retention checks and sending email or HTTP notifications,
making the old API redundant.

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2025-07-12 22:20:54 +02:00
Nicola Murino
9e2230cc33
Support leading and trailing spaces in user passwords
This improves compatibility with external authentication providers that
allow such characters in passwords.

Passwords created via the WebAdmin UI are still sanitized to prevent user
confusion.

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2025-04-26 14:31:13 +02:00
Nicola Murino
f41f00fec2
httpd: allow to configure referrer policy header
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2025-04-07 18:48:48 +02:00
Nicola Murino
d95d773570
oidc: allow login if the password method is disabled
isLoggedInWithOIDC returns false before login so we need to add
a specific check

Fixes #1879

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2025-03-29 20:28:49 +01:00
Nicola Murino
69ef36b4d9
httpd: add a setting to disable login methods, deprecate the previous one
the previous enabled login methods setting is hard to extend in
a backward compatible way

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2025-01-25 22:00:55 +01:00
Nicola Murino
48258f6e67
httpd: add cross origin resource and embedder policy headers
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2025-01-24 19:34:57 +01:00
Nicola Murino
1f4cb7077a
bad host handler: return a generic error message
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2025-01-06 10:08:25 +01:00
Nicola Murino
deea9ff038
do not return if client IP is not allowed in login API response
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-12-28 18:47:04 +01:00
Nicola Murino
70fc00d7eb
Allow to choose enabled languages
Fixes #1835

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-12-19 19:50:19 +01:00
Nicola Murino
ec90b61bb4
allow to configure JWT tokens and cookies duration
Fixes #1839

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-12-18 18:33:37 +01:00
Nicola Murino
e21c989038
logs: add a specific log structure for successful logins
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-12-07 10:29:33 +01:00
Nicola Murino
d3e76898cd
WebAdmin: refactor template permissions
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-11-26 20:39:36 +01:00
Nicola Murino
3dd412f6e3
WebAdmin and REST API: remove too granular permissions
Our permissions system for admin users is too granular and some
permissions overlap. For example, you can define an administrator
with the "manage_system" permission and not with the "manage_admins"
or "manage_user" permission, but the "manage_system" permission
allows you to restore a backup and then create users and
administrators. The following permissions will be removed:
"manage_admins", "manage_apikeys", "manage_system", "retention_checks",
"manage_event_rules", "manage_roles", "manage_ip_lists". Now you
need to add the "*" permission to replace the removed granular
permissions because the removed permissions allow actions that
should only be allowed to super administrators.
There is no point in having separate, overlapping permissions.

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-11-10 10:46:28 +01:00
Nicola Murino
7aac64531f
WebAdmin: check CSRF header when deleting blocked hosts
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-11-09 18:44:31 +01:00
Nicola Murino
5162c5de87
WebUIs: add a nil check for token in refresh cookie method
token should never be null here because we have an authenticated user
however add the same check as elsewhere

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-09-16 20:11:02 +02:00
Nicola Murino
fa710b36c2
httpd: allow to configure cache control header
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-08-12 21:19:44 +02:00
Nicola Murino
68e62d3d9b
httpd: allow to use proxy protocol
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-08-10 21:02:38 +02:00
Nicola Murino
d94f80c8da
replace utils.Contains with slices.Contains
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-07-24 18:27:13 +02:00
Nicola Murino
b5c821795a
allow to customize name and log from the WebUI
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-07-24 09:14:27 +02:00
Nicola Murino
363770ab84
WebClient shares: add a logout button
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-06-18 19:10:32 +02:00
Nicola Murino
bd5b32101f
csrf: reuse the cookie in reset password
no need to generate a new cookie each time.

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-06-15 15:18:17 +02:00
Nicola Murino
01b666a78f
WebUIs: check login conditions before allowing password reset
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-06-14 19:34:42 +02:00
Nicola Murino
8294952474
WebUIs: refactor CSRF
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-06-14 18:09:32 +02:00
Nicola Murino
08526da153
REST API: fix token invalidation after password change
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-06-07 18:19:05 +02:00
Nicola Murino
50a3c0d911
defender: allow to impose a delay between login attempts
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-05-18 10:35:54 +02:00
Nicola Murino
d3f42e39db
move server version setting to common section
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-05-01 19:42:09 +02:00
Nicola Murino
e1fdc10ef8
remove robots.txt endpoint
This reverts #833 because the contributor did not respond to our
request to sign the CLA

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-04-26 11:00:55 +02:00
Nicola Murino
f38966c6ac
WebClient: refactor long-running tasks to improve browser compatibility
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-03-11 18:19:57 +01:00
Nicola Murino
799fdd7098
allow IPs in defender safe list to exceed max per-host connections
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-02-27 18:22:21 +01:00
Nicola Murino
12f599fd65
WebUI: skip checks for static resource
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-02-25 18:19:21 +01:00
Nicola Murino
a577d8b3cd
WebAdmin: allow to disable 2FA
Before it was only possible using REST API

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-02-23 18:24:07 +01:00
Nicola Murino
de089e51fd
Web: allow to require password change and two-factor for admins
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-02-21 20:45:10 +01:00
Nicola Murino
e61fb42cbc
remove metadata plugin
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-02-17 12:30:47 +01:00
Nicola Murino
ae309d64c4
WebClient: disable indicator if we redirect from the login page
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-02-04 21:13:04 +01:00
Nicola Murino
8385acd0e3
Redirect to two-factor auth page after creating the first admin
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-02-04 20:58:29 +01:00
Nicola Murino
c23d779280
WebClient: load shares using an async request
instead of rendering them directly within the template

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-02-04 14:33:51 +01:00
Nicola Murino
ad80d4e475
WIP new WebAdmin: event rules
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-02-01 20:32:43 +01:00
Nicola Murino
c85601146d
WIP new WebAdmin: event actions
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-01-31 20:49:25 +01:00
Nicola Murino
d381304136
WIP new WebAdmin: admin/admins pages
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-01-22 20:22:41 +01:00
Nicola Murino
3f479c5537
WIP new WebAdmin: roles page
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-01-21 16:49:04 +01:00
Nicola Murino
8648351fc7
WIP new WebAdmin: connections page
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-01-20 15:35:05 +01:00
Nicola Murino
91802fad3e
WIP new WebAdmin: profile, change password, message pages
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-01-18 19:18:57 +01:00
Nicola Murino
d939a82225
user: add TLS certificates
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-01-14 21:36:23 +01:00
Nicola Murino
0722c4369b
WIP new WebAdmin: folders page
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-01-14 16:59:27 +01:00
Nicola Murino
5c8214e121
WIP new WebAdmin: groups page
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-01-11 19:26:13 +01:00
Nicola Murino
e1b5d2fe39
WebAdmin: use the new UI for user pages
Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-01-09 19:54:08 +01:00
Nicola Murino
784b7585c1
remove end year from Copyright notice in files
so we don't have to update all the files every year

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
2024-01-01 11:31:45 +01:00