forked from ungleich-public/ungleich-user
Sajeyks
dad66040ed
The activation link carried base64-encoded username, password, names
and email, so plaintext passwords ended up in mail archives, browser
history and proxy logs.
Registration now hashes the password to {SSHA} immediately and stores
it in a new PendingRegistration table (migration 0002). The emailed
link is /activate/<token>/ with a random token only, and activation
writes the stored hash into LDAP. Pending entries expire after 24h,
like reset tokens. This also drops the PseudoUser/token-generator
workaround.
Links in emails sent before deployment stop working; those users must
register again.
37 lines
No EOL
1.3 KiB
Python
37 lines
No EOL
1.3 KiB
Python
# The different URLs this service does use
|
|
from django.urls import path
|
|
from django.conf.urls import url
|
|
from django.contrib import admin
|
|
|
|
# Import the classes for the views
|
|
from .views import (
|
|
Register,
|
|
ChangeData,
|
|
ChangePassword,
|
|
ResetPassword,
|
|
DeleteAccount,
|
|
Index,
|
|
LogOut,
|
|
ResetRequest,
|
|
UserCreateAPI,
|
|
ActivateAccount,
|
|
Seeds,
|
|
SeedRetrieveCreate
|
|
)
|
|
|
|
urlpatterns = [
|
|
path('register/', Register.as_view(), name="register"),
|
|
path('create/', UserCreateAPI.as_view(), name="create"),
|
|
path('changedata/', ChangeData.as_view(), name="change_data"),
|
|
path('seeds/', Seeds.as_view(), name="user_seeds"),
|
|
path('resetpassword/', ResetPassword.as_view(), name="reset_password"),
|
|
path('changepassword/', ChangePassword.as_view(), name="change_password"),
|
|
path('deleteaccount/', DeleteAccount.as_view(), name="account_delete"),
|
|
path('index/', Index.as_view(), name="index"),
|
|
path('logout/', LogOut.as_view(), name="logout"),
|
|
path('reset/<str:user>/<str:token>/', ResetRequest.as_view()),
|
|
path('activate/<str:token>/', ActivateAccount.as_view(), name="activate"),
|
|
path('reset/', ResetRequest.as_view(), name="reset"),
|
|
path('otp/', SeedRetrieveCreate.as_view(), name="seed"),
|
|
path('', Index.as_view(), name="login_index"),
|
|
] |