Make compromised-password validation opt-in - #8767
Open
yguedidi wants to merge 3 commits into
Open
Conversation
✅ Deploy Preview for wallabag-doc ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #8767 +/- ##
============================================
- Coverage 91.59% 91.39% -0.20%
- Complexity 1989 1996 +7
============================================
Files 175 175
Lines 7007 7031 +24
============================================
+ Hits 6418 6426 +8
- Misses 589 605 +16
Flags with carried forward coverage won't be shown. Click here to find out more.
|
yguedidi
force-pushed
the
feat/hibp-password-validation
branch
2 times, most recently
from
March 26, 2026 12:18
60fc027 to
cd170df
Compare
yguedidi
marked this pull request as ready for review
March 26, 2026 12:23
yguedidi
marked this pull request as draft
March 26, 2026 12:24
yguedidi
marked this pull request as ready for review
March 26, 2026 12:24
Kdecherf
requested changes
Mar 26, 2026
Kdecherf
left a comment
Member
There was a problem hiding this comment.
LGTM on the implementation side
However two mandatory changes:
- we need to add a note in the doc about this new security feature and how admin can configure it
- we need to keep it configurable for admin who would like to avoid additional network calls for this kind of feature, I would see this feature as disabled by default
Contributor
Author
seems not possible in the end, for now, to not deploy the change..
@nicosomb @j0k3r any opinion here? to me as it's security related I'd tend to prefer having it enabled by default but allow admins to disable it if they really really want |
yguedidi
marked this pull request as draft
March 31, 2026 23:22
Contributor
Author
yguedidi
force-pushed
the
feat/hibp-password-validation
branch
from
April 7, 2026 08:59
cd170df to
f18dc55
Compare
Add WALLABAG_NO_COMPROMISED_PASSWORDS with a default-off container fallback, wire it into the password form types, enable it in the development .env, and document the setting in the admin parameter reference. The configuration surface and the form-level enforcement are one reviewer question: how the compromised-password feature is activated for normal user flows. Keeping the docs here makes the public opt-in contract visible at the same boundary. The installer path is intentionally deferred to the next commit so production setup behavior can be reviewed separately from the form wiring.
Make InstallCommand honor WALLABAG_NO_COMPROMISED_PASSWORDS before adding the NotCompromisedPassword constraint to the production admin-password prompt. The installer is a distinct review boundary because it extends the opt-in contract to setup-time behavior without touching the already-wired user-facing forms. The test-only password randomization remains in the following commit so the validation-specific fixture cleanup stays isolated.
…dation Update the functional tests to generate random passwords instead of using hardcoded common passwords that the compromised-password check can legitimately reject. Keeping this test-only cleanup separate preserves the story of the feature work and makes it obvious that no runtime behavior changes happen in this commit.
yguedidi
force-pushed
the
feat/hibp-password-validation
branch
from
April 7, 2026 09:31
f18dc55 to
8c49479
Compare
Contributor
Author
|
@Kdecherf PR updated! you can check this force-push diff to see all changes since last time you reviewed, or do a full review as it's small enough :) |
yguedidi
marked this pull request as ready for review
April 7, 2026 09:34
Member
|
I love this feature. Well done! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR makes wallabag's compromised-password validation opt-in. Admins can enable the HIBP-backed check with
WALLABAG_NO_COMPROMISED_PASSWORDS=1; when the variable is absent, wallabag skips the extra network call and leaves password validation unchanged.The same opt-in flag now controls
NewUserType,ChangePasswordType, and the production installer. The committed development.envenables the check for contributors, and the admin parameters documentation explains how to enable it in real deployments.When the check is enabled, wallabag still uses Symfony's
NotCompromisedPasswordconstraint withskipOnError: true, so temporary HIBP failures do not block offline or CI workflows.