forked from ungleich-public/ungleich-user
Sajeyks
dad66040ed
The activation link carried base64-encoded username, password, names
and email, so plaintext passwords ended up in mail archives, browser
history and proxy logs.
Registration now hashes the password to {SSHA} immediately and stores
it in a new PendingRegistration table (migration 0002). The emailed
link is /activate/<token>/ with a random token only, and activation
writes the stored hash into LDAP. Pending entries expire after 24h,
like reset tokens. This also drops the PseudoUser/token-generator
workaround.
Links in emails sent before deployment stop working; those users must
register again.
|
||
|---|---|---|
| .. | ||
| migrations | ||
| static | ||
| templates | ||
| tests | ||
| __init__.py | ||
| env.sample | ||
| forms.py | ||
| models.py | ||
| settings.py | ||
| ungleich_ldap.py | ||
| urls.py | ||
| views.py | ||
| wsgi.py | ||