ngcp-panel

Commit Graph

Author	SHA1	Message	Date
Kirill Solomko	60fa23cb68	MT#60585 add user ban support * users for admin/subscriber realms are now banned if failed to login X amount of times (UI/API). * rework Redis connection and it's now a Catalyst plugin NGCP::Redis accessed by $c->redis_get_connection({database => 19}), the connection per database, per worker process is established only once and then reused (with auto built-in reconnect support). * remove Utils::Redis.pm as it does not have any code/logic anymore. * ban values are taken from $config->{security}{login} as - ban_enable: 1 - ban_expire_time: 3600 ban expire time in seconds - max_attempts: 5 * if max_attempts set to 0, the ban functionality is disabled as it requires to be at least 1 to work. * upon successful login or ban, the failed attempts counter is removed * the failed attempts counter is also removed automatically with the expire time equals "ban_expire_time" or otherwise 3600 seconds. * user bans are logged into panel.log * banned user receives exactly the same return page/codes as per invalid logic. Change-Id: I05cc68c623ee289488fc64f1af50527004dcaae1	10 months ago
Alexander Lutay	6fbf99e461	TT#130659 Improve debug log layout (common style, removing plus/star markers) It was close to impossible to read ngcp-panel debug log due to: * missing clear marker of the start reuqest processing, use '**' once only some personal markers (like '+++++++') have been removed as they have no meaning for other developers. Let's remove the personal markers and work to make the panel debug log well readable for all developers. Change-Id: I69faff3ab2258fc156e88c7b8da0edfef14c3e6e	4 years ago
Kirill Solomko	53408c2e94	TT#130750 do not pack() jwt secret * the extra packing of the secret key during encode/decode conflicts with the API v2 implementation * move JWT "typ" from the payload to the header Change-Id: Ica5822d810d6eaf7b3ae017f7037f25637b6f861	4 years ago
Flaviu Mates	eb13492026	TT#88904 - Store admin id and jwt key in localStorage * on administrator login, store said variables so we can automatically log in to v2 without having to redirect Change-Id: I50d79996198561c54e555d264388d26610905ca6	5 years ago
Flaviu Mates	be14a9242e	TT#84337 - Implement /api/passwordreset * The new endpoint will only accept POSTs * The request body should have two parameters called 'type', 'username' and 'domain' * 'type' will accept either 'administrator', in which case only 'username' is needed, or 'subscriber', in which case 'username' and 'domain' will be needed * The regular password reset email will be sent to either the admin or the subscriber Change-Id: If1457c8c625a95295e5e93b6637927e3905698d9	5 years ago
Flaviu Mates	9907936d47	TT#76108 - Implement password reset mechanism for admins * Introduce endopint '/resetpassword' for asking for password reset using admin username * Create form for introducing username * Create url with unique token pointing to '/recoverpassword' where admin user can introduce new password and email said url to admin's email address * Create form for setting new password * Store username and unique token in Redis expiring in 5 minutes to store password reset attempt and identify it when user accesses url in email * Limit admin access to be able to only change own password due to new password reset possibility as requested in TT#76110 Change-Id: Ie3acb961444398afa5b2fdc85e3ca8ceccf9244a	5 years ago
Andreas Granig	8f8e1d5fc9	TT#78557 - Use bcrypt to hash webpassword * Change the way webpassword is handled accross NGCP Panel UI/API to comply with new password encryption * At login, if password is not encrypted with high cost due to the ngcp-bcrypt-webpassword script, encrypt it with proper cost * Accept old password format as well until all webpasswords are encrypted Change-Id: Iefa9584a62ab4b7d2a224d10bdd415e9cbb8dfb5	5 years ago
Rene Krenn	cae5270af5	TT#56340 panel logline obfuscation adds gdpr obfuscation quoting for: + subscriber numbers + subscriber ip addresses + subscriber usernames + any logmessage "DATA": query parameters, form data, response data + subscriber uuid's + call id's + callforward sip uri's the quoting is centralized by $c->qs() ("quote sensitive"), using catalyst plugin mechanism. escape symbols are set to « (\x{ab}) and » (\x{bb}). generate_logfile_data_inventory.pl was modified to mark loglines with "gdpr affected" status, if $c->qs() was used in a log message. Change-Id: I0f42d7992594232ae33e5666b0a64009211c5b76	6 years ago
Rene Krenn	76b88062a1	TT#56411 honor use_session => 0 for bcrypt auth Revert "Revert "TT#56411 honor use_session => 0 for bcrypt auth WIP"" This reverts commit `1cfc524f80`. Change-Id: I7eb0842bd61a4aaddbe50206fb974110ead8efb6	6 years ago
Rene Krenn	1cfc524f80	Revert "TT#56411 honor use_session => 0 for bcrypt auth WIP" This reverts commit `4789f6b61f`. Change-Id: I6b514443afe9e2a8dbc1ae4a527a38fd3fc1d1c6	6 years ago
Rene Krenn	4789f6b61f	TT#56411 honor use_session => 0 for bcrypt auth WIP Change-Id: I549c4e6fc18b7cb738e99b3a6e254a47db3af0cf	6 years ago
Gerhard Jungwirth	f916bdcf3f	TT#37104 fix Subroutines::ProhibitBuiltinHomonyms perlcritic error to fix sipwise TAP tests. Change-Id: I622eb8063694a0056d55796001ff35242b0ea847	7 years ago
Gerhard Jungwirth	001474fd7f	TT#34800 inflate/deflate DateTime for timestamps inflate/deflate DateTime for simple (complete) timestamps considering the correct timezone at the latest possible point in the action chains: on form-level as well as in the DataTables json output. Change-Id: Icfe94d6d5a9ac02d9fca0f4b8d048d86cf66cffa	7 years ago
Andreas Granig	0d3bf6b1ce	TT#22827 Implement form factory This patch reuses existing forms by clearing them, rather than re-instantiating them again and again. Also, panel start time should be better due to less package pre-loading. Change-Id: Ia3e64fd4b4084bb5ec35a669c5840c9fc3c58f2e	8 years ago
Andreas Granig	5918c162e1	TT#12601 API must implement bcrypt auth/migration Not only the web login must support bcrypt auth, but also the API access. Change-Id: Iee7c5b7a073000e797725919a5752f9eaf77c958	8 years ago
Andreas Granig	8ad683d5ae	TT#12601 Move admin pass to bcrypt and drop cert For the migration of the admin pwd, the logic is as follows: 1. If the admin has a bcrypt password already, use this 2. If not, perform auth via md5, then clear the md5 column and write a salted bcrypt hash instead. For dropping the ssl client cert, we simply not store anymore the client certificate in the DB. As a result, you cannot download the certs (pem, p12) after creation anymore, so we immediately download the two certs in a zip file after creation. A cost of 13 takes 500ms on an i7-5500U CPU @ 2.40GHz, which seems to be a reasonable value. Change-Id: I1ce21321c58d8c57d7ddce1541995f64821b0053	8 years ago
Gerhard Jungwirth	6d883c6de3	MT#21141 fix login redirect between realms by using a relative target url (without the host part) we make sure, that when logging in as an admin we don't get redirected to a subscriber page or vice versa. also simplifying the login controller a bit. Change-Id: Ib9f0cdf7c687b711f8b357816e17a175efdfd1fe	9 years ago
Andreas Granig	04a64e1493	MT#16465 partly remove namespace::sweep and others Remove namespace::sweep Remove MooseX stuff Remove perl5i Remove Moose where possible Change-Id: I4f873afb466f4e58a04c3304ff74df2185470b03	10 years ago
Gerhard Jungwirth	3f211601f7	MT#14901 remove reseller login page there is no such realm configured anyways Change-Id: I802934b54daa333f186ba84af78313ab12f60a9b	10 years ago
Andreas Granig	cb9c14af54	MT#10869 Allow webusername to be an email address Change-Id: Iff38fc7c8ba675eff62dfd19fd6d0f4ab98f77f2	10 years ago
Andreas Granig	7563aeeb43	MT#7625 Check subscriber status is active on login	11 years ago
Irina Peshinskaya	cd07b84a1c	MT#5879 Preparations to merge into master Part 1.	11 years ago
Irina Peshinskaya	4dc64f5853	MT#5879 Attempt to fix invoice/template Also configuration of cancel button on confirm modal. Fix contract-balance getting. Fix page numbers in generated invoice.	11 years ago
Andreas Granig	aed5d7ef09	MT#6843 Implement password auto-generation.	11 years ago
Andreas Granig	bf5ec092bb	MT#6789 Add subscriber email and password recovery - subscribers can hold an email address - implement process for web password recovery	11 years ago
Andreas Granig	0f26d8fcbe	MT#3961 Update German localization.	11 years ago
Andreas Granig	71658e12a7	MT#5599 Rework auth/authz for pwd-based API access Cleanup unnecessary realms. Use roles instead of realms for authz. HTTP basic auth for api access. Use admin/reseller roles instead of api_admin/api_reseller. Fix API::Root invalid_user detaching.	12 years ago
Gerhard Jungwirth	204fb95b3a	MT#4707 log IP on failed login	12 years ago
Andreas Granig	05553d0406	MT#4413 Remove debugging messages. This even breaks domain creation for PBX.	12 years ago
Andreas Granig	af5cc9b14a	Try to avoid wrong redirect to login after login.	12 years ago
Andreas Granig	f2b57291ba	Only allow subscriber logins from active accounts.	12 years ago
Andreas Granig	06fc0fa4dd	Fix subscriber login and add basic widgets.	12 years ago
Andreas Granig	5160759f38	Implement subscriber login.	12 years ago
Andreas Granig	85365959dd	Fix customer determination in dashboard. Properly filter by product class.	12 years ago
Andreas Granig	ba46a201a9	Use Sipwise::Base instead of Moose.	12 years ago
Andreas Granig	ab79afbb67	Fix config paths and dbalias creation. In case a subscriber is created from within the customer view, then also clear the created objects and write a dbalias.	12 years ago
Andreas Granig	21af84fdf6	Lots of cleanups and bugfixes and back-nav. Implement automatic back navigation. Fix subscriber creation. Unify controller handling.	12 years ago
Andreas Granig	fced11b461	Rework Administrator handling. Use is_superuser as admin indicator. Only show admins, no resellers (will be handled in another view/ctrl). Allow updates without reentering password. Hide internal fields in view. Set sane default values.	12 years ago
Andreas Granig	db12421890	Cleanup unused var.	12 years ago
Andreas Granig	97b7f01164	Add simple role handling via realm check.	12 years ago
Andreas Granig	1f50a3ae50	Fix administrator handling. Actually use admins table for authentication of reseller and admin. Save pass as md5 hash (should be bcrypt at some point!) Display proper user name in view.	12 years ago
Lars Dieckow	7ed2dccb52	less log spam by default	12 years ago
Gerhard Jungwirth	ade81ba964	Align template path to general structure.	12 years ago
Andreas Granig	51969bc880	Use proper auth realm for login action.	12 years ago
Andreas Granig	d2d0fef99b	Rework form rendering to use formhandler.	12 years ago
Andreas Granig	be3a9f6521	Use formhandler for forms. WIP. Needs adaptions to stylesheets to format error messages properly.	12 years ago
Andreas Granig	76e9d458d4	Add basic error handling. Will be rebuilt using formhandler.	12 years ago
Andreas Granig	11fecbd7ae	Implement basic authentication logic.	12 years ago

48 Commits (60fa23cb681afe3223794eccd0d6d8f6cb426152)