fix(auth): [PenTest]

2017-09-14 06:51:19 -07:00 · 2017-09-14 06:51:19 -07:00 · a93c740189
--- a/docs/3rdpartylicenses.txt
+++ b/docs/3rdpartylicenses.txt
@ -0,0 +1,96 @@
+core-js@2.5.1
+MIT
+Copyright (c) 2014-2017 Denis Pushkarev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+zone.js@0.8.17
+MIT
+The MIT License
+
+Copyright (c) 2016 Google, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+webpack@3.5.6
+MIT
+Copyright JS Foundation and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+@angular/core@4.3.6
+MIT
+MIT
+
+ng2-adal@1.0.1
+MIT
+MIT
+
+@angular/router@4.3.6
+MIT
+MIT
+
+@angular/http@4.3.6
+MIT
+MIT
+
+@angular/forms@4.3.6
+MIT
+MIT
+
+@angular/platform-browser@4.3.6
+MIT
+MIT
+
+@angular/common@4.3.6
+MIT
+MIT
--- a/docs/index.html
+++ b/docs/index.html
@ -1 +1 @@
-<!doctype html><html lang="en"><head><meta charset="utf-8"><title>MlsExcelApp</title><base href="mls-excel-app"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" type="image/x-icon" href="favicon.ico"><!--<link rel="stylesheet" href="styles.css">--><link rel="stylesheet" href="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/css/fabric.min.css"><link rel="stylesheet" href="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/css/fabric.components.min.css"><script src="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/js/fabric.min.js"></script><script src="https://appsforoffice.microsoft.com/lib/1/hosted/Office.js" type="text/javascript"></script><script src="https://unpkg.com/core-js/client/core.min.js"></script><link href="styles.17c3871b523e9c5d8be8.bundle.css" rel="stylesheet"/></head><body><app-root><div class="cs-loader"><div class="cs-loader-inner"><h1 class="title ms-font-xxl">MLS</h1><label>●</label><label>●</label><label>●</label><label>●</label><label>●</label></div></div></app-root><script type="text/javascript" src="inline.2d2fec9bc72681a05c0c.bundle.js"></script><script type="text/javascript" src="polyfills.c7f2b30f4d8ff16ddd31.bundle.js"></script><script type="text/javascript" src="vendor.338191bbac7cc85c65c8.bundle.js"></script><script type="text/javascript" src="main.bd30f851319b8760d272.bundle.js"></script></body></html>
+<!doctype html><html lang="en"><head><meta charset="utf-8"><title>MlsExcelApp</title><base href="mls-excel-app"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" type="image/x-icon" href="favicon.ico"><!--<link rel="stylesheet" href="styles.css">--><link rel="stylesheet" href="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/css/fabric.min.css"><link rel="stylesheet" href="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/css/fabric.components.min.css"><script src="https://static2.sharepointonline.com/files/fabric/office-ui-fabric-js/1.4.0/js/fabric.min.js"></script><script src="https://appsforoffice.microsoft.com/lib/1/hosted/Office.js" type="text/javascript"></script><script src="https://unpkg.com/core-js/client/core.min.js"></script><link href="styles.17c3871b523e9c5d8be8.bundle.css" rel="stylesheet"/></head><body><app-root><div class="cs-loader"><div class="cs-loader-inner"><h1 class="title ms-font-xxl">MLS</h1><label>●</label><label>●</label><label>●</label><label>●</label><label>●</label></div></div></app-root><script type="text/javascript" src="inline.c0532a011c019b07583d.bundle.js"></script><script type="text/javascript" src="polyfills.55206efc080210e2e43f.bundle.js"></script><script type="text/javascript" src="vendor.0329b29bd244f0caa4f6.bundle.js"></script><script type="text/javascript" src="main.006a5b47b79ff505037f.bundle.js"></script></body></html>
--- a/docs/inline.2d2fec9bc72681a05c0c.bundle.js
+++ b/docs/inline.2d2fec9bc72681a05c0c.bundle.js
@ -1 +0,0 @@
-!function(e){function r(n){if(t[n])return t[n].exports;var o=t[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,r),o.l=!0,o.exports}var n=window.webpackJsonp;window.webpackJsonp=function(t,c,u){for(var i,f,a,l=0,s=[];l<t.length;l++)f=t[l],o[f]&&s.push(o[f][0]),o[f]=0;for(i in c)Object.prototype.hasOwnProperty.call(c,i)&&(e[i]=c[i]);for(n&&n(t,c,u);s.length;)s.shift()();if(u)for(l=0;l<u.length;l++)a=r(r.s=u[l]);return a};var t={},o={4:0};r.e=function(e){function n(){u.onerror=u.onload=null,clearTimeout(i);var r=o[e];0!==r&&(r&&r[1](new Error("Loading chunk "+e+" failed.")),o[e]=void 0)}if(0===o[e])return Promise.resolve();if(o[e])return o[e][2];var t=new Promise(function(r,n){o[e]=[r,n]});o[e][2]=t;var c=document.getElementsByTagName("head")[0],u=document.createElement("script");u.type="text/javascript",u.charset="utf-8",u.async=!0,u.timeout=12e4,r.nc&&u.setAttribute("nonce",r.nc),u.src=r.p+""+e+"."+{0:"c7f2b30f4d8ff16ddd31",1:"bd30f851319b8760d272",2:"f88ccefc30e43cf5330e"}[e]+".chunk.js";var i=setTimeout(n,12e4);return u.onerror=u.onload=n,c.appendChild(u),t},r.m=e,r.c=t,r.i=function(e){return e},r.d=function(e,n,t){r.o(e,n)||Object.defineProperty(e,n,{configurable:!1,enumerable:!0,get:t})},r.n=function(e){var n=e&&e.__esModule?function(){return e.default}:function(){return e};return r.d(n,"a",n),n},r.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},r.p="",r.oe=function(e){throw console.error(e),e}}([]);
--- a/docs/inline.c0532a011c019b07583d.bundle.js
+++ b/docs/inline.c0532a011c019b07583d.bundle.js
@ -0,0 +1 @@
+!function(e){function n(r){if(t[r])return t[r].exports;var o=t[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}var r=window.webpackJsonp;window.webpackJsonp=function(t,c,u){for(var a,i,f,l=0,s=[];l<t.length;l++)i=t[l],o[i]&&s.push(o[i][0]),o[i]=0;for(a in c)Object.prototype.hasOwnProperty.call(c,a)&&(e[a]=c[a]);for(r&&r(t,c,u);s.length;)s.shift()();if(u)for(l=0;l<u.length;l++)f=n(n.s=u[l]);return f};var t={},o={4:0};n.e=function(e){function r(){a.onerror=a.onload=null,clearTimeout(i);var n=o[e];0!==n&&(n&&n[1](new Error("Loading chunk "+e+" failed.")),o[e]=void 0)}var t=o[e];if(0===t)return new Promise(function(e){e()});if(t)return t[2];var c=new Promise(function(n,r){t=o[e]=[n,r]});t[2]=c;var u=document.getElementsByTagName("head")[0],a=document.createElement("script");a.type="text/javascript",a.charset="utf-8",a.async=!0,a.timeout=12e4,n.nc&&a.setAttribute("nonce",n.nc),a.src=n.p+""+e+"."+{0:"55206efc080210e2e43f",1:"006a5b47b79ff505037f",2:"f88ccefc30e43cf5330e"}[e]+".chunk.js";var i=setTimeout(r,12e4);return a.onerror=a.onload=r,u.appendChild(a),c},n.m=e,n.c=t,n.d=function(e,r,t){n.o(e,r)||Object.defineProperty(e,r,{configurable:!1,enumerable:!0,get:t})},n.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(r,"a",r),r},n.o=function(e,n){return Object.prototype.hasOwnProperty.call(e,n)},n.p="",n.oe=function(e){throw console.error(e),e}}([]);
--- a/docs/main.006a5b47b79ff505037f.bundle.js
+++ b/docs/main.006a5b47b79ff505037f.bundle.js
--- a/docs/main.bd30f851319b8760d272.bundle.js
+++ b/docs/main.bd30f851319b8760d272.bundle.js
--- a/docs/polyfills.55206efc080210e2e43f.bundle.js
+++ b/docs/polyfills.55206efc080210e2e43f.bundle.js
--- a/docs/polyfills.c7f2b30f4d8ff16ddd31.bundle.js
+++ b/docs/polyfills.c7f2b30f4d8ff16ddd31.bundle.js
--- a/docs/vendor.0329b29bd244f0caa4f6.bundle.js
+++ b/docs/vendor.0329b29bd244f0caa4f6.bundle.js
--- a/docs/vendor.338191bbac7cc85c65c8.bundle.js
+++ b/docs/vendor.338191bbac7cc85c65c8.bundle.js
--- a/package.json
+++ b/package.json
@ -1,6 +1,6 @@
 {
  "name": "mls-excel-app",
-  "version": "0.0.0",
+  "version": "1.0.0",
  "license": "MIT",
  "scripts": {
    "ng": "ng",
@ -27,7 +27,7 @@
    "zone.js": "^0.8.4"
  },
  "devDependencies": {
-    "@angular/cli": "1.2.0",
+    "@angular/cli": "1.4.1",
    "@angular/compiler-cli": "^4.0.0",
    "@angular/language-service": "^4.0.0",
    "@types/jasmine": "~2.5.53",
--- a/src/app/auth/auth-admin/auth-admin.component.html
+++ b/src/app/auth/auth-admin/auth-admin.component.html
@ -17,11 +17,6 @@
        <input id="password" class="input__password" type="password" name="password" required [ngModel]="config.password" #password="ngModel"
        />
      </p>
-      <div class="ms-check">
-        <p>Remember Me</p>
-        <input id="remember" type="checkbox" class="ms-CheckBox" [ngModel]="rememberMe" name="remember" #remember="ngModel">
-      </div>
-
      <button class="input__submit" type="submit" [disabled]="!f.valid">Login</button>
    </form>
  </div>
--- a/src/app/auth/auth-admin/auth-admin.component.ts
+++ b/src/app/auth/auth-admin/auth-admin.component.ts
@ -20,46 +20,24 @@ export class AuthAdminComponent implements OnInit {
  };
  public error: boolean;
  public errorMessage: string;
-  public rememberMe: boolean;

  constructor(private authService: AuthService, private router: Router) {
    this.error = false;
  }

  ngOnInit() {
-    // Checks to see if the user credentials have been stored locally via 'remember me'
-    // Populates them in the form if they exist
-    if (localStorage.getItem('adminUser')) {
-      const data = JSON.parse(localStorage.getItem('adminUser'));
-      this.config = {
-        connection: data.connection,
-        username: data.username,
-        password: data.password
-      };
-      this.rememberMe = true;
-    } else {
-      this.config = {
-        connection: '',
-        username: '',
-        password: ''
-      };
-      this.rememberMe = false;
-    }
+    this.config = {
+      connection: '',
+      username: '',
+      password: ''
+    };
  }

  // Called when the user submits for authentication
-  // Stores credentials locally if user checked the 'Remember Me'
  // Sends a HTTP GET to the specified connection
  // If authentication is successful, reroutes user to web-services
  // Otherwise, user is shown an appropriate error message
  onSubmit(form: NgForm) {
-    // Store credentials if user wants to be remembered
-    if (form.value.remember) {
-      localStorage.setItem('adminUser',
-        JSON.stringify({ connection: form.value.connection, username: form.value.username, password: form.value.password }));
-    } else {
-      localStorage.removeItem('adminUser');
-    }
    this.authService.loginAdmin(form.value.connection, form.value.username, form.value.password)
      .subscribe(
      (data: any) => {
--- a/src/app/auth/auth-azure/auth-azure.component.html
+++ b/src/app/auth/auth-azure/auth-azure.component.html
@ -22,12 +22,6 @@
        <input id="resource" class="input__username" type="text" name="resource" required [ngModel]="config.resource" #resource="ngModel"
        />
      </p>
-
-      <div class="ms-check">
-        <p>Remember Me</p>
-        <input id="remember" type="checkbox" class="ms-CheckBox" name="remember" [ngModel]="rememberMe" #remember="ngModel">
-      </div>
-
      <button class="input__submit" type="submit" [disabled]="!f.valid">Login</button>
    </form>
  </div>
--- a/src/app/auth/auth-azure/auth-azure.component.ts
+++ b/src/app/auth/auth-azure/auth-azure.component.ts
@ -19,56 +19,33 @@ export class AuthAzureComponent implements OnInit {
    };
    public error: boolean;
    public errorMessage: string;
-    public rememberMe: boolean;
-
+    
    constructor(public router: Router, public authService: AuthService) {
        this.error = false;
    }

    public ngOnInit() {
-        // Checks to see if the user credentials have been stored locally via 'remember me'
-        // Populates them in the form if they exist
-        if (localStorage.getItem('aadUser')) {
-            const data = JSON.parse(localStorage.getItem('aadUser'));
-            this.config = {
-                connection: data.connection,
-                tenant: data.tenant,
-                clientid: data.clientid,
-                resource: data.resource
-            };
-            this.rememberMe = true;
-        } else {
-            this.config = {
-                connection: '',
-                tenant: '',
-                clientid: '',
-                resource: ''
-            };
-            this.rememberMe = false;
-        }
+        this.config = {
+            connection: '',
+            tenant: '',
+            clientid: '',
+            resource: ''
+        };
    }

    // Called when user submits form
    // Uses the ADAL npm wrapper package to log the user in
-    // This redirects the user to their AAD sign-in page if they gave a correct tenant
-    // If an incorrect tenant was given, AAD will tell them it doesn't exist and they will have to reload the add-in in order to try again
-    // Note: All error handling here cannot be handled by our app currently because of the redirect.  Until AAD redirects back to our app
+    // This redirects the user to their AAD sign-in page if they gave a correct 
+    // tenant If an incorrect tenant was given, AAD will tell them it doesn't 
+    // exist and they will have to reload the add-in in order to try again
+    // Note: All error handling here cannot be handled by our app currently 
+    // because of the redirect.  Until AAD redirects back to our app
    // all errors are handled by the AAD page.
    login(form: NgForm) {
-        // Store credentials if user wants to be remembered
-        if (form.value.remember) {
-            localStorage.setItem('aadUser',
-                JSON.stringify({
-                    connection: form.value.connection, tenant: form.value.tenant,
-                    clientid: form.value.clientid, resource: form.value.resource
-                }));
-        } else {
-            localStorage.removeItem('aadUser');
-        }
-        this.authService.loginAdal(form.value.connection, form.value.clientid, form.value.tenant, form.value.resource);
+        this.authService.loginAdal(form.value.connection, form.value.clientid, 
+            form.value.tenant, form.value.resource);
    }

-
    get isLoggedIn() {
        return this.authService.isAuthenticated();
    }
				`@ -1 +0,0 @@`
				!function(e){function r(n){if(t[n])return t[n].exports;var o=t[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,r),o.l=!0,o.exports}var n=window.webpackJsonp;window.webpackJsonp=function(t,c,u){for(var i,f,a,l=0,s=[];l<t.length;l++)f=t[l],o[f]&&s.push(o[f][0]),o[f]=0;for(i in c)Object.prototype.hasOwnProperty.call(c,i)&&(e[i]=c[i]);for(n&&n(t,c,u);s.length;)s.shift()();if(u)for(l=0;l<u.length;l++)a=r(r.s=u[l]);return a};var t={},o={4:0};r.e=function(e){function n(){u.onerror=u.onload=null,clearTimeout(i);var r=o[e];0!==r&&(r&&r[1](new Error("Loading chunk "+e+" failed.")),o[e]=void 0)}if(0===o[e])return Promise.resolve();if(o[e])return o[e][2];var t=new Promise(function(r,n){o[e]=[r,n]});o[e][2]=t;var c=document.getElementsByTagName("head")[0],u=document.createElement("script");u.type="text/javascript",u.charset="utf-8",u.async=!0,u.timeout=12e4,r.nc&&u.setAttribute("nonce",r.nc),u.src=r.p+""+e+"."+{0:"c7f2b30f4d8ff16ddd31",1:"bd30f851319b8760d272",2:"f88ccefc30e43cf5330e"}[e]+".chunk.js";var i=setTimeout(n,12e4);return u.onerror=u.onload=n,c.appendChild(u),t},r.m=e,r.c=t,r.i=function(e){return e},r.d=function(e,n,t){r.o(e,n)\|\|Object.defineProperty(e,n,{configurable:!1,enumerable:!0,get:t})},r.n=function(e){var n=e&&e.__esModule?function(){return e.default}:function(){return e};return r.d(n,"a",n),n},r.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},r.p="",r.oe=function(e){throw console.error(e),e}}([]);
				`@ -0,0 +1 @@`
				!function(e){function n(r){if(t[r])return t[r].exports;var o=t[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}var r=window.webpackJsonp;window.webpackJsonp=function(t,c,u){for(var a,i,f,l=0,s=[];l<t.length;l++)i=t[l],o[i]&&s.push(o[i][0]),o[i]=0;for(a in c)Object.prototype.hasOwnProperty.call(c,a)&&(e[a]=c[a]);for(r&&r(t,c,u);s.length;)s.shift()();if(u)for(l=0;l<u.length;l++)f=n(n.s=u[l]);return f};var t={},o={4:0};n.e=function(e){function r(){a.onerror=a.onload=null,clearTimeout(i);var n=o[e];0!==n&&(n&&n[1](new Error("Loading chunk "+e+" failed.")),o[e]=void 0)}var t=o[e];if(0===t)return new Promise(function(e){e()});if(t)return t[2];var c=new Promise(function(n,r){t=o[e]=[n,r]});t[2]=c;var u=document.getElementsByTagName("head")[0],a=document.createElement("script");a.type="text/javascript",a.charset="utf-8",a.async=!0,a.timeout=12e4,n.nc&&a.setAttribute("nonce",n.nc),a.src=n.p+""+e+"."+{0:"55206efc080210e2e43f",1:"006a5b47b79ff505037f",2:"f88ccefc30e43cf5330e"}[e]+".chunk.js";var i=setTimeout(r,12e4);return a.onerror=a.onload=r,u.appendChild(a),c},n.m=e,n.c=t,n.d=function(e,r,t){n.o(e,r)\|\|Object.defineProperty(e,r,{configurable:!1,enumerable:!0,get:t})},n.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(r,"a",r),r},n.o=function(e,n){return Object.prototype.hasOwnProperty.call(e,n)},n.p="",n.oe=function(e){throw console.error(e),e}}([]);