Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Password reset request - generally tighten it up#4636

Merged
amercader merged 6 commits into
masterfrom
security_dont_confirm_if_user_exists_2
Feb 8, 2019
Merged

Password reset request - generally tighten it up#4636
amercader merged 6 commits into
masterfrom
security_dont_confirm_if_user_exists_2

Conversation

@davidread
Copy link
Copy Markdown

@davidread davidread commented Jan 25, 2019

Fixes #

  • To reset a password, the user can now only specify username or email - not the looser search done by model.User.search(), which allowed: partial name, partial fullname (and if sysadmin: partial email address) etc
    (This was originally loose to be helpful to users if they forgot their username, but it is more normal these days to only allow resets with your email address. I left in the username option, as explained in the code)
  • Don't confirm whether a user exists or not - this is recommended
  • Logging added for audit purposes

Features:

  • includes tests covering changes
  • includes updated documentation
  • includes user-visible changes
  • includes API changes
  • includes bugfix for possible backport

Please [X] all the boxes above that apply

@davidread davidread force-pushed the security_dont_confirm_if_user_exists_2 branch from 2e5bc9b to 5c5e0d0 Compare January 25, 2019 13:58
@anotheredward
Copy link
Copy Markdown
Contributor

Awesome work @davidread !
I'll use the time I have today to test and review this PR and close mine.
Thanks again :).

Copy link
Copy Markdown
Contributor

@anotheredward anotheredward left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall it's looking pretty good, I've given it a test and added some feedback.
Thanks again for working on this @davidread :) .

Comment thread ckan/views/user.py Outdated
an email with a link to enter a new password.{% endtrans %}</p>
<p>{% trans %}Enter your email address or username into the box and we
will send you an email with a link to enter a new password.
{% endtrans %}</p>
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Allowing users to enter their username is sensible for the case you've specified below (multiple users with the same email), but with the user listing being enabled by default, it essentially means an attacker has similar information available to them (complete listing of all the users, rather than complete listing of emails).

To patch this hole we'll need to get the users listing page disabled by default.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. Let's not couple this PR to that piece of work though.

Comment thread ckan/tests/controllers/test_user.py Outdated
Comment thread ckan/views/user.py
Comment thread ckan/views/user.py
@amercader amercader self-assigned this Jan 31, 2019
David Read and others added 5 commits February 8, 2019 11:17
* Can only specify name or email not - not the looser search done by model.User.search()
  which allowed: partial name, partial fullname (and if sysadmin: partial emails) etc
  (This was originally loose to be helpful, but the balance with security changed)
* Don't confirm whether a user exists or not
* Logging for audit purposes
@davidread davidread force-pushed the security_dont_confirm_if_user_exists_2 branch from 8b71bd7 to c4707dc Compare February 8, 2019 11:17
@davidread
Copy link
Copy Markdown
Author

I've merged @anotheredward 's additions and all is good. Over to you, @amercader for review!

@amercader amercader merged commit 3f34dd4 into master Feb 8, 2019
@amercader
Copy link
Copy Markdown
Member

Looks good to me. Great work @davidread and @anotheredward!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants