10 Commits (5e9066c4fba8b4e9802a11cb3b4be79702a87100)

Author	SHA1	Message	Date
Rene Krenn	5e9066c4fb	TT#151751 refactor persisting subscriber webpassword ... a multitude of issues popped after introducing bcrypted webpasswords in the database. most recently the PATCH /api/susbcribers rail was reported to reset the webpassword unintentionally. subscriber login fails afterwards, which is a severe issue. the bugs are adressed by this refactorings. the change also introduces a global variable $NGCP::Panel::Utils::Auth::ENCRYPT_SUBSCRIBER_WEBPASSWORDS to control encrypting webpasswords. it is still enabled as of now, but it's worth to consider disabling it. there other ways to have a "cost" for an authentication request, eg. adding a simple sleep(1sec). Change-Id: I2d47d54a2d83568546ffdd2b211337a5f56be3a2	3 years ago
Kirill Solomko	cc10506b2e	TT#129162 fix subscriber webpassword field validation ... * 'webpassword' field is now also validated for invalid (non-ascii) characters * Fix multiple APP input field validation erros to comma joined. * Adjust 'webpassword' field validation errors to have better readability when there are multiple validation errors Change-Id: I21536f97a4da78cc5192a3abd8cd5adef1b819ec	4 years ago
Kirill Solomko	1cdae0b1e0	TT#125902 add Login CSC v2 support ... * Login CSC v2 button is shown on the subscriber's master data page if www_admin.http_csc.csc_js_enable == 1 or 2 * When the login is triggered an auth token is generated internally followed by a redirect to CSC as /?a=auth_token * move generate_auth_token() into Utils/Auth * improve generate_auth_token() arguments support * add /api/authtokens error handling Change-Id: Idd65400bf8ce6ce48979c736f6a199fb567ffaa4	4 years ago
Kirill Solomko	63812835c0	TT#129162 fix passwork characters check ... * check that the password variable contains a value Change-Id: Iba1cf809d5cd81b3dbbeb4686765a667e339d93f	4 years ago
Kirill Solomko	f4597b6ed7	TT#129162 add bcrypt password characters check ... Change-Id: I08723d02a7e4bc042351444b201d1f96cc986af3	4 years ago
Rene Krenn	8238204682	TT#105100 fix update case for webpasswd db encrytion ... Change-Id: I91de91430434edef744c6b3791749ea81053d1cb	4 years ago
Flaviu Mates	654bb1aabe	TT#92550 - Implement /api/passwordrecovery ... * The new endpoint will only accept POSTs * The request body should have two parameters called 'new_password' and 'token' * First, look for the token in redis (for admins), if not found, look for it in DB (for subscribers), if neither is found, return Change-Id: I4163a0d5bd886961317b21aeca20c8ccfdeab0dd	5 years ago
Flaviu Mates	be14a9242e	TT#84337 - Implement /api/passwordreset ... * The new endpoint will only accept POSTs * The request body should have two parameters called 'type', 'username' and 'domain' * 'type' will accept either 'administrator', in which case only 'username' is needed, or 'subscriber', in which case 'username' and 'domain' will be needed * The regular password reset email will be sent to either the admin or the subscriber Change-Id: If1457c8c625a95295e5e93b6637927e3905698d9	5 years ago
Flaviu Mates	6c645490e6	TT#84453 - Fix error when subscriber logs in on old CSC ... * Add check for existence of webpassword on subscriber log in to prevent the code from trying to use the undefined password * Subscribers with no webpassword cannot log in the old CSC Change-Id: I7b82c014fa5f70fa36ee7282db94a747e54ce2ae	5 years ago
Andreas Granig	8f8e1d5fc9	TT#78557 - Use bcrypt to hash webpassword ... * Change the way webpassword is handled accross NGCP Panel UI/API to comply with new password encryption * At login, if password is not encrypted with high cost due to the ngcp-bcrypt-webpassword script, encrypt it with proper cost * Accept old password format as well until all webpasswords are encrypted Change-Id: Iefa9584a62ab4b7d2a224d10bdd415e9cbb8dfb5	5 years ago