* The new endpoint will only accept POSTs
* The request body should have two parameters
called 'new_password' and 'token'
* First, look for the token in redis (for admins),
if not found, look for it in DB (for subscribers),
if neither is found, return
Change-Id: I4163a0d5bd886961317b21aeca20c8ccfdeab0dd
mr9.1
Flaviu Mates
5 years ago
parent
29647d614b
commit
654bb1aabe
@ -0,0 +1,157 @@
|
||||
package NGCP::Panel::Controller::API::PasswordRecovery;
|
||||
use NGCP::Panel::Utils::Generic qw(:all);
|
||||
|
||||
use Sipwise::Base;
|
||||
|
||||
use boolean qw(true);
|
||||
use Data::HAL qw();
|
||||
use Data::HAL::Link qw();
|
||||
use HTTP::Headers qw();
|
||||
use HTTP::Status qw(:constants);
|
||||
|
||||
|
||||
sub allowed_methods{
|
||||
return [qw/POST OPTIONS/];
|
||||
}
|
||||
|
||||
use parent qw/NGCP::Panel::Role::Entities NGCP::Panel::Role::API::PasswordRecovery/;
|
||||
|
||||
sub api_description {
|
||||
return 'Recover password following a password reset request.';
|
||||
}
|
||||
|
||||
sub query_params {
|
||||
return [
|
||||
];
|
||||
}
|
||||
|
||||
sub resource_name{
|
||||
return 'passwordrecovery';
|
||||
}
|
||||
|
||||
sub dispatch_path{
|
||||
return '/api/passwordrecovery/';
|
||||
}
|
||||
|
||||
sub relation{
|
||||
return 'http://purl.org/sipwise/ngcp-api/#rel-passwordrecovery';
|
||||
}
|
||||
|
||||
__PACKAGE__->set_config({
|
||||
action => {
|
||||
map { $_ => {
|
||||
Args => 0,
|
||||
Does => [qw(CheckTrailingSlash RequireSSL)],
|
||||
Method => $_,
|
||||
Path => __PACKAGE__->dispatch_path,
|
||||
} } @{ __PACKAGE__->allowed_methods },
|
||||
},
|
||||
});
|
||||
|
||||
sub POST :Allow {
|
||||
my ($self, $c) = @_;
|
||||
|
||||
my $res;
|
||||
|
||||
$c->user->logout if($c->user);
|
||||
|
||||
my $guard = $c->model('DB')->txn_scope_guard;
|
||||
{
|
||||
my $resource = $self->get_valid_post_data(
|
||||
c => $c,
|
||||
media_type => 'application/json',
|
||||
);
|
||||
last unless $resource;
|
||||
|
||||
my $form = $self->get_form($c);
|
||||
last unless $self->validate_form(
|
||||
c => $c,
|
||||
resource => $resource,
|
||||
form => $form,
|
||||
);
|
||||
|
||||
my ($uuid_bin, $uuid_string);
|
||||
$uuid_string = $resource->{token} // '';
|
||||
|
||||
unless($uuid_string && UUID::parse($uuid_string, $uuid_bin) != -1) {
|
||||
$res = {success => 0};
|
||||
$c->log->error("Invalid password recovery attempt for token '$uuid_string' from '".$c->qs($c->req->address)."'");
|
||||
$c->response->status(HTTP_FORBIDDEN);
|
||||
$c->response->body(JSON::to_json($res));
|
||||
return;
|
||||
}
|
||||
|
||||
my $redis = Redis->new(
|
||||
server => $c->config->{redis}->{central_url},
|
||||
reconnect => 10, every => 500000, # 500ms
|
||||
cnx_timeout => 3,
|
||||
);
|
||||
unless ($redis) {
|
||||
$res = {success => 0};
|
||||
$c->log->error("Failed to connect to central redis url " . $c->config->{redis}->{central_url});
|
||||
$c->response->status(HTTP_INTERNAL_SERVER_ERROR);
|
||||
$c->response->body(JSON::to_json($res));
|
||||
return;
|
||||
}
|
||||
$redis->select($c->config->{'Plugin::Session'}->{redis_db});
|
||||
my $admin = $redis->hget("password_reset:admin::$uuid_string", "user");
|
||||
if ($admin) {
|
||||
$c->log->debug("Entering password recovery for administrator.");
|
||||
my $administrator = $c->model('DB')->resultset('admins')->search({login => $admin})->first;
|
||||
unless ($administrator) {
|
||||
$res = {success => 0};
|
||||
$c->log->error("Invalid password recovery attempt for token '$uuid_string' from '".$c->qs($c->req->address)."'");
|
||||
$c->response->status(HTTP_FORBIDDEN);
|
||||
$c->response->body(JSON::to_json($res));
|
||||
return;
|
||||
}
|
||||
my $ip = $redis->hget("password_reset:admin::$uuid_string", "ip");
|
||||
if ($ip && $ip ne $c->req->address) {
|
||||
$res = {success => 0};
|
||||
$c->log->error("Invalid password recovery attempt for token '$uuid_string' from '".$c->qs($c->req->address)."'");
|
||||
$c->response->status(HTTP_FORBIDDEN);
|
||||
$c->response->body(JSON::to_json($res));
|
||||
return;
|
||||
}
|
||||
$c->log->debug("Updating administrator password.");
|
||||
$administrator->update({
|
||||
saltedpass => NGCP::Panel::Utils::Auth::generate_salted_hash($form->params->{new_password}),
|
||||
});
|
||||
$redis->del("password_reset:admin::$uuid_string");
|
||||
$redis->del("password_reset:admin::$admin");
|
||||
}
|
||||
else {
|
||||
$c->log->debug("Entering password recovery for subscriber.");
|
||||
my $rs = $c->model('DB')->resultset('password_resets')->search({
|
||||
uuid => $uuid_string,
|
||||
timestamp => { '>=' => NGCP::Panel::Utils::DateTime::current_local->epoch - 300 },
|
||||
});
|
||||
|
||||
my $subscriber = $rs->first ? $rs->first->voip_subscriber : undef;
|
||||
unless($subscriber && $subscriber->provisioning_voip_subscriber) {
|
||||
$res = {success => 0};
|
||||
$c->log->error("Invalid password recovery attempt for token '$uuid_string' from '".$c->qs($c->req->address)."'");
|
||||
$c->response->status(HTTP_FORBIDDEN);
|
||||
$c->response->body(JSON::to_json($res));
|
||||
return;
|
||||
}
|
||||
$c->log->debug("Updating subscriber password.");
|
||||
$subscriber->provisioning_voip_subscriber->update({
|
||||
webpassword => NGCP::Panel::Utils::Auth::generate_salted_hash($form->params->{new_password}),
|
||||
});
|
||||
$rs->delete;
|
||||
}
|
||||
|
||||
$guard->commit;
|
||||
|
||||
$res = { success => 1, message => 'Password reset successfuly completed.' };
|
||||
|
||||
$c->response->status(HTTP_OK);
|
||||
$c->response->body(JSON::to_json($res));
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
1;
|
||||
|
||||
# vim: set tabstop=4 expandtab:
|
||||
@ -0,0 +1,35 @@
|
||||
package NGCP::Panel::Form::PasswordRecoveryAPI;
|
||||
|
||||
use HTML::FormHandler::Moose;
|
||||
use Email::Valid;
|
||||
use NGCP::Panel::Utils::Form;
|
||||
extends 'HTML::FormHandler';
|
||||
|
||||
has_field 'new_password' => (
|
||||
type => 'Password',
|
||||
required => 1,
|
||||
label => 'Password',
|
||||
);
|
||||
|
||||
has_field 'token' => (
|
||||
type => 'Text',
|
||||
required => 1,
|
||||
label => 'Token',
|
||||
);
|
||||
|
||||
has_block 'fields' => (
|
||||
tag => 'div',
|
||||
class => [qw/modal-body/],
|
||||
render_list => [qw/new_password token/],
|
||||
);
|
||||
|
||||
sub validate_new_password {
|
||||
my ($self, $field) = @_;
|
||||
my $c = $self->form->ctx;
|
||||
return unless $c;
|
||||
|
||||
NGCP::Panel::Utils::Form::validate_password(c => $c, field => $field);
|
||||
}
|
||||
|
||||
1;
|
||||
# vim: set tabstop=4 expandtab:
|
||||
@ -0,0 +1,24 @@
|
||||
package NGCP::Panel::Role::API::PasswordRecovery;
|
||||
use NGCP::Panel::Utils::Generic qw(:all);
|
||||
|
||||
use Sipwise::Base;
|
||||
|
||||
use parent 'NGCP::Panel::Role::API';
|
||||
|
||||
|
||||
use boolean qw(true);
|
||||
use Data::HAL qw();
|
||||
use Data::HAL::Link qw();
|
||||
use HTTP::Status qw(:constants);
|
||||
|
||||
|
||||
sub _item_rs {
|
||||
}
|
||||
|
||||
sub get_form {
|
||||
my ($self, $c) = @_;
|
||||
return NGCP::Panel::Form::get("NGCP::Panel::Form::PasswordRecoveryAPI", $c);
|
||||
}
|
||||
|
||||
1;
|
||||
# vim: set tabstop=4 expandtab:
|
||||
Loading…
Reference in new issue