fix(auth): [PenTest]

microsoft · Sep 14, 2017 · a93c740 · a93c740
2 parents 1b212c3 + e591eef
commit a93c740
Show file tree

Hide file tree

Showing 15 changed files with 122 additions and 82 deletions.
diff --git a/docs/3rdpartylicenses.txt b/docs/3rdpartylicenses.txt
@@ -0,0 +1,96 @@
+[email protected]
+MIT
+Copyright (c) 2014-2017 Denis Pushkarev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+[email protected]
+MIT
+The MIT License
+
+Copyright (c) 2016 Google, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+[email protected]
+MIT
+Copyright JS Foundation and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+@angular/[email protected]
+MIT
+MIT
+
+[email protected]
+MIT
+MIT
+
+@angular/[email protected]
+MIT
+MIT
+
+@angular/[email protected]
+MIT
+MIT
+
+@angular/[email protected]
+MIT
+MIT
+
+@angular/[email protected]
+MIT
+MIT
+
+@angular/[email protected]
+MIT
+MIT
diff --git a/docs/index.html b/docs/index.html
@@ -1 +1 @@
-<!doctype html><html lang="en"><head><meta charset="utf-8"><title>MlsExcelApp</title><base href="mls-excel-app"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" type="image/x-icon" href="favicon.ico"><!--<link rel="stylesheet" href="styles.css">--><link rel="stylesheet" href="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/css/fabric.min.css"><link rel="stylesheet" href="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/css/fabric.components.min.css"><script src="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/js/fabric.min.js"></script><script src="https://appsforoffice.microsoft.com/lib/1/hosted/Office.js" type="text/javascript"></script><script src="https://unpkg.com/core-js/client/core.min.js"></script><link href="styles.17c3871b523e9c5d8be8.bundle.css" rel="stylesheet"/></head><body><app-root><div class="cs-loader"><div class="cs-loader-inner"><h1 class="title ms-font-xxl">MLS</h1><label>●</label><label>●</label><label>●</label><label>●</label><label>●</label></div></div></app-root><script type="text/javascript" src="inline.2d2fec9bc72681a05c0c.bundle.js"></script><script type="text/javascript" src="polyfills.c7f2b30f4d8ff16ddd31.bundle.js"></script><script type="text/javascript" src="vendor.338191bbac7cc85c65c8.bundle.js"></script><script type="text/javascript" src="main.bd30f851319b8760d272.bundle.js"></script></body></html>
+<!doctype html><html lang="en"><head><meta charset="utf-8"><title>MlsExcelApp</title><base href="mls-excel-app"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" type="image/x-icon" href="favicon.ico"><!--<link rel="stylesheet" href="styles.css">--><link rel="stylesheet" href="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/css/fabric.min.css"><link rel="stylesheet" href="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/css/fabric.components.min.css"><script src="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/js/fabric.min.js"></script><script src="https://appsforoffice.microsoft.com/lib/1/hosted/Office.js" type="text/javascript"></script><script src="https://unpkg.com/core-js/client/core.min.js"></script><link href="styles.17c3871b523e9c5d8be8.bundle.css" rel="stylesheet"/></head><body><app-root><div class="cs-loader"><div class="cs-loader-inner"><h1 class="title ms-font-xxl">MLS</h1><label>●</label><label>●</label><label>●</label><label>●</label><label>●</label></div></div></app-root><script type="text/javascript" src="inline.c0532a011c019b07583d.bundle.js"></script><script type="text/javascript" src="polyfills.55206efc080210e2e43f.bundle.js"></script><script type="text/javascript" src="vendor.0329b29bd244f0caa4f6.bundle.js"></script><script type="text/javascript" src="main.006a5b47b79ff505037f.bundle.js"></script></body></html>
diff --git a/docs/inline.2d2fec9bc72681a05c0c.bundle.js b/docs/inline.2d2fec9bc72681a05c0c.bundle.js
diff --git a/docs/inline.c0532a011c019b07583d.bundle.js b/docs/inline.c0532a011c019b07583d.bundle.js
diff --git a/docs/main.006a5b47b79ff505037f.bundle.js b/docs/main.006a5b47b79ff505037f.bundle.js
diff --git a/docs/main.bd30f851319b8760d272.bundle.js b/docs/main.bd30f851319b8760d272.bundle.js
diff --git a/docs/polyfills.55206efc080210e2e43f.bundle.js b/docs/polyfills.55206efc080210e2e43f.bundle.js
diff --git a/docs/polyfills.c7f2b30f4d8ff16ddd31.bundle.js b/docs/polyfills.c7f2b30f4d8ff16ddd31.bundle.js
diff --git a/docs/vendor.0329b29bd244f0caa4f6.bundle.js b/docs/vendor.0329b29bd244f0caa4f6.bundle.js
diff --git a/docs/vendor.338191bbac7cc85c65c8.bundle.js b/docs/vendor.338191bbac7cc85c65c8.bundle.js
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mls-excel-app",
-  "version": "0.0.0",
+  "version": "1.0.0",
   "license": "MIT",
   "scripts": {
     "ng": "ng",
@@ -27,7 +27,7 @@
     "zone.js": "^0.8.4"
   },
   "devDependencies": {
-    "@angular/cli": "1.2.0",
+    "@angular/cli": "1.4.1",
     "@angular/compiler-cli": "^4.0.0",
     "@angular/language-service": "^4.0.0",
     "@types/jasmine": "~2.5.53",

diff --git a/src/app/auth/auth-admin/auth-admin.component.html b/src/app/auth/auth-admin/auth-admin.component.html
@@ -17,11 +17,6 @@ <h2 class="ms-font-xl ms-fontWeight-light">On Premises Authentication</h2>
         <input id="password" class="input__password" type="password" name="password" required [ngModel]="config.password" #password="ngModel"
         />
       </p>
-      <div class="ms-check">
-        <p>Remember Me</p>
-        <input id="remember" type="checkbox" class="ms-CheckBox" [ngModel]="rememberMe" name="remember" #remember="ngModel">
-      </div>
-
       <button class="input__submit" type="submit" [disabled]="!f.valid">Login</button>
     </form>
   </div>

diff --git a/src/app/auth/auth-admin/auth-admin.component.ts b/src/app/auth/auth-admin/auth-admin.component.ts
@@ -20,46 +20,24 @@ export class AuthAdminComponent implements OnInit {
   };
   public error: boolean;
   public errorMessage: string;
-  public rememberMe: boolean;
 
   constructor(private authService: AuthService, private router: Router) {
     this.error = false;
   }
 
   ngOnInit() {
-    // Checks to see if the user credentials have been stored locally via 'remember me'
-    // Populates them in the form if they exist
-    if (localStorage.getItem('adminUser')) {
-      const data = JSON.parse(localStorage.getItem('adminUser'));
-      this.config = {
-        connection: data.connection,
-        username: data.username,
-        password: data.password
-      };
-      this.rememberMe = true;
-    } else {
-      this.config = {
-        connection: '',
-        username: '',
-        password: ''
-      };
-      this.rememberMe = false;
-    }
+    this.config = {
+      connection: '',
+      username: '',
+      password: ''
+    };
   }
 
   // Called when the user submits for authentication
-  // Stores credentials locally if user checked the 'Remember Me'
   // Sends a HTTP GET to the specified connection
   // If authentication is successful, reroutes user to web-services
   // Otherwise, user is shown an appropriate error message
   onSubmit(form: NgForm) {
-    // Store credentials if user wants to be remembered
-    if (form.value.remember) {
-      localStorage.setItem('adminUser',
-        JSON.stringify({ connection: form.value.connection, username: form.value.username, password: form.value.password }));
-    } else {
-      localStorage.removeItem('adminUser');
-    }
     this.authService.loginAdmin(form.value.connection, form.value.username, form.value.password)
       .subscribe(
       (data: any) => {

diff --git a/src/app/auth/auth-azure/auth-azure.component.html b/src/app/auth/auth-azure/auth-azure.component.html
@@ -22,12 +22,6 @@ <h2 class="ms-font-xl ms-fontWeight-light">Azure Authentication</h2>
         <input id="resource" class="input__username" type="text" name="resource" required [ngModel]="config.resource" #resource="ngModel"
         />
       </p>
-
-      <div class="ms-check">
-        <p>Remember Me</p>
-        <input id="remember" type="checkbox" class="ms-CheckBox" name="remember" [ngModel]="rememberMe" #remember="ngModel">
-      </div>
-
       <button class="input__submit" type="submit" [disabled]="!f.valid">Login</button>
     </form>
   </div>

diff --git a/src/app/auth/auth-azure/auth-azure.component.ts b/src/app/auth/auth-azure/auth-azure.component.ts
@@ -19,56 +19,33 @@ export class AuthAzureComponent implements OnInit {
     };
     public error: boolean;
     public errorMessage: string;
-    public rememberMe: boolean;
-
+
     constructor(public router: Router, public authService: AuthService) {
         this.error = false;
     }
 
     public ngOnInit() {
-        // Checks to see if the user credentials have been stored locally via 'remember me'
-        // Populates them in the form if they exist
-        if (localStorage.getItem('aadUser')) {
-            const data = JSON.parse(localStorage.getItem('aadUser'));
-            this.config = {
-                connection: data.connection,
-                tenant: data.tenant,
-                clientid: data.clientid,
-                resource: data.resource
-            };
-            this.rememberMe = true;
-        } else {
-            this.config = {
-                connection: '',
-                tenant: '',
-                clientid: '',
-                resource: ''
-            };
-            this.rememberMe = false;
-        }
+        this.config = {
+            connection: '',
+            tenant: '',
+            clientid: '',
+            resource: ''
+        };
     }
 
     // Called when user submits form
     // Uses the ADAL npm wrapper package to log the user in
-    // This redirects the user to their AAD sign-in page if they gave a correct tenant
-    // If an incorrect tenant was given, AAD will tell them it doesn't exist and they will have to reload the add-in in order to try again
-    // Note: All error handling here cannot be handled by our app currently because of the redirect.  Until AAD redirects back to our app
+    // This redirects the user to their AAD sign-in page if they gave a correct 
+    // tenant If an incorrect tenant was given, AAD will tell them it doesn't 
+    // exist and they will have to reload the add-in in order to try again
+    // Note: All error handling here cannot be handled by our app currently 
+    // because of the redirect.  Until AAD redirects back to our app
     // all errors are handled by the AAD page.
     login(form: NgForm) {
-        // Store credentials if user wants to be remembered
-        if (form.value.remember) {
-            localStorage.setItem('aadUser',
-                JSON.stringify({
-                    connection: form.value.connection, tenant: form.value.tenant,
-                    clientid: form.value.clientid, resource: form.value.resource
-                }));
-        } else {
-            localStorage.removeItem('aadUser');
-        }
-        this.authService.loginAdal(form.value.connection, form.value.clientid, form.value.tenant, form.value.resource);
+        this.authService.loginAdal(form.value.connection, form.value.clientid, 
+            form.value.tenant, form.value.resource);
     }
 
-
     get isLoggedIn() {
         return this.authService.isAuthenticated();
     }
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		<!doctype html><html lang="en"><head><meta charset="utf-8"><title>MlsExcelApp</title><base href="mls-excel-app"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" type="image/x-icon" href="favicon.ico"><!--<link rel="stylesheet" href="styles.css">--><link rel="stylesheet" href="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/css/fabric.min.css"><link rel="stylesheet" href="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/css/fabric.components.min.css"><script src="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/js/fabric.min.js"></script><script src="https://appsforoffice.microsoft.com/lib/1/hosted/Office.js" type="text/javascript"></script><script src="https://unpkg.com/core-js/client/core.min.js"></script><link href="styles.17c3871b523e9c5d8be8.bundle.css" rel="stylesheet"/></head><body><app-root><div class="cs-loader"><div class="cs-loader-inner"><h1 class="title ms-font-xxl">MLS</h1><label>●</label><label>●</label><label>●</label><label>●</label><label>●</label></div></div></app-root><script type="text/javascript" src="inline.2d2fec9bc72681a05c0c.bundle.js"></script><script type="text/javascript" src="polyfills.c7f2b30f4d8ff16ddd31.bundle.js"></script><script type="text/javascript" src="vendor.338191bbac7cc85c65c8.bundle.js"></script><script type="text/javascript" src="main.bd30f851319b8760d272.bundle.js"></script></body></html>
		<!doctype html><html lang="en"><head><meta charset="utf-8"><title>MlsExcelApp</title><base href="mls-excel-app"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" type="image/x-icon" href="favicon.ico"><!--<link rel="stylesheet" href="styles.css">--><link rel="stylesheet" href="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/css/fabric.min.css"><link rel="stylesheet" href="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/css/fabric.components.min.css"><script src="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/js/fabric.min.js"></script><script src="https://appsforoffice.microsoft.com/lib/1/hosted/Office.js" type="text/javascript"></script><script src="https://unpkg.com/core-js/client/core.min.js"></script><link href="styles.17c3871b523e9c5d8be8.bundle.css" rel="stylesheet"/></head><body><app-root><div class="cs-loader"><div class="cs-loader-inner"><h1 class="title ms-font-xxl">MLS</h1><label>●</label><label>●</label><label>●</label><label>●</label><label>●</label></div></div></app-root><script type="text/javascript" src="inline.c0532a011c019b07583d.bundle.js"></script><script type="text/javascript" src="polyfills.55206efc080210e2e43f.bundle.js"></script><script type="text/javascript" src="vendor.0329b29bd244f0caa4f6.bundle.js"></script><script type="text/javascript" src="main.006a5b47b79ff505037f.bundle.js"></script></body></html>