Password Resets: Don't accept tokens above a certain age.
By default, one day
This commit is contained in:
parent
8a7ee9fe74
commit
11e0d5f9ac
4 changed files with 53 additions and 1 deletions
|
@ -263,7 +263,8 @@
|
|||
length: 16
|
||||
]
|
||||
],
|
||||
show_reactions: true
|
||||
show_reactions: true,
|
||||
password_reset_token_validity: 60 * 60 * 24
|
||||
|
||||
config :pleroma, :welcome,
|
||||
direct_message: [
|
||||
|
|
|
@ -40,6 +40,7 @@ def used_changeset(struct) do
|
|||
@spec reset_password(binary(), map()) :: {:ok, User.t()} | {:error, binary()}
|
||||
def reset_password(token, data) do
|
||||
with %{used: false} = token <- Repo.get_by(PasswordResetToken, %{token: token}),
|
||||
false <- expired?(token),
|
||||
%User{} = user <- User.get_cached_by_id(token.user_id),
|
||||
{:ok, _user} <- User.reset_password(user, data),
|
||||
{:ok, token} <- Repo.update(used_changeset(token)) do
|
||||
|
@ -48,4 +49,14 @@ def reset_password(token, data) do
|
|||
_e -> {:error, token}
|
||||
end
|
||||
end
|
||||
|
||||
def expired?(%__MODULE__{inserted_at: inserted_at}) do
|
||||
validity = Pleroma.Config.get([:instance, :password_reset_token_validity], 0)
|
||||
|
||||
now = NaiveDateTime.utc_now()
|
||||
|
||||
difference = NaiveDateTime.diff(now, inserted_at)
|
||||
|
||||
difference > validity
|
||||
end
|
||||
end
|
||||
|
|
|
@ -17,6 +17,7 @@ defmodule Pleroma.Web.TwitterAPI.PasswordController do
|
|||
|
||||
def reset(conn, %{"token" => token}) do
|
||||
with %{used: false} = token <- Repo.get_by(PasswordResetToken, %{token: token}),
|
||||
false <- PasswordResetToken.expired?(token),
|
||||
%User{} = user <- User.get_cached_by_id(token.user_id) do
|
||||
render(conn, "reset.html", %{
|
||||
token: token,
|
||||
|
|
|
@ -31,9 +31,48 @@ test "it shows password reset form", %{conn: conn} do
|
|||
|
||||
assert response =~ "<h2>Password Reset for #{user.nickname}</h2>"
|
||||
end
|
||||
|
||||
test "it returns an error when the token has expired", %{conn: conn} do
|
||||
clear_config([:instance, :password_reset_token_validity], 0)
|
||||
|
||||
user = insert(:user)
|
||||
{:ok, token} = PasswordResetToken.create_token(user)
|
||||
|
||||
:timer.sleep(2000)
|
||||
|
||||
response =
|
||||
conn
|
||||
|> get("/api/pleroma/password_reset/#{token.token}")
|
||||
|> html_response(:ok)
|
||||
|
||||
assert response =~ "<h2>Invalid Token</h2>"
|
||||
end
|
||||
end
|
||||
|
||||
describe "POST /api/pleroma/password_reset" do
|
||||
test "it fails for an expired token", %{conn: conn} do
|
||||
clear_config([:instance, :password_reset_token_validity], 0)
|
||||
|
||||
user = insert(:user)
|
||||
{:ok, token} = PasswordResetToken.create_token(user)
|
||||
:timer.sleep(2000)
|
||||
{:ok, _access_token} = Token.create(insert(:oauth_app), user, %{})
|
||||
|
||||
params = %{
|
||||
"password" => "test",
|
||||
password_confirmation: "test",
|
||||
token: token.token
|
||||
}
|
||||
|
||||
response =
|
||||
conn
|
||||
|> assign(:user, user)
|
||||
|> post("/api/pleroma/password_reset", %{data: params})
|
||||
|> html_response(:ok)
|
||||
|
||||
refute response =~ "<h2>Password changed!</h2>"
|
||||
end
|
||||
|
||||
test "it returns HTTP 200", %{conn: conn} do
|
||||
user = insert(:user)
|
||||
{:ok, token} = PasswordResetToken.create_token(user)
|
||||
|
|
Loading…
Reference in a new issue