ngcp-panel

Author SHA1 Message Date

Author	SHA1	Message	Date
Rene Krenn	d10becf4b0	TT#151751 refactor persisting subscriber webpassword a multitude of issues popped after introducing bcrypted webpasswords in the database. most recently the PATCH /api/susbcribers rail was reported to reset the webpassword unintentionally. subscriber login fails afterwards, which is a severe issue. the bugs are adressed by this refactorings. the change also introduces a global variable $NGCP::Panel::Utils::Auth::ENCRYPT_SUBSCRIBER_WEBPASSWORDS to control encrypting webpasswords. it is still enabled as of now, but it's worth to consider disabling it. there other ways to have a "cost" for an authentication request, eg. adding a simple sleep(1sec). (cherry picked from commit `5e9066c4fb`) Change-Id: Ice74ebe40b305a50b81624077d39524fd14adbe1	3 years ago
Flaviu Mates	654bb1aabe	TT#92550 - Implement /api/passwordrecovery * The new endpoint will only accept POSTs * The request body should have two parameters called 'new_password' and 'token' * First, look for the token in redis (for admins), if not found, look for it in DB (for subscribers), if neither is found, return Change-Id: I4163a0d5bd886961317b21aeca20c8ccfdeab0dd	5 years ago

Rene Krenn

TT#151751 refactor persisting subscriber webpassword

a multitude of issues popped after introducing bcrypted
webpasswords in the database. most recently the PATCH /api/susbcribers
rail was reported to reset the webpassword unintentionally.
subscriber login fails afterwards, which is a severe issue.

the bugs are adressed by this refactorings. the change also
introduces a global variable

  $NGCP::Panel::Utils::Auth::ENCRYPT_SUBSCRIBER_WEBPASSWORDS

to control encrypting webpasswords. it is still enabled as of now,
but it's worth to consider disabling it. there other ways to have
a "cost" for an authentication request, eg. adding a simple
sleep(1sec).

(cherry picked from commit 5e9066c4fb)

Change-Id: Ice74ebe40b305a50b81624077d39524fd14adbe1

Flaviu Mates

654bb1aabe

TT#92550 - Implement /api/passwordrecovery

* The new endpoint will only accept POSTs
         * The request body should have two parameters
           called 'new_password' and 'token'
	 * First, look for the token in redis (for admins),
	   if not found, look for it in DB (for subscribers),
	   if neither is found, return

Change-Id: I4163a0d5bd886961317b21aeca20c8ccfdeab0dd

2 Commits (5989ef8e902ca40eb718d080cefc8811aa8d2fac)