Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ask old password during password change #1023

Closed
cotosso opened this issue Jan 15, 2025 · 3 comments
Closed

Ask old password during password change #1023

cotosso opened this issue Jan 15, 2025 · 3 comments

Comments

@cotosso
Copy link
Contributor

cotosso commented Jan 15, 2025

The current UI allows users to change their password without requiring re-entry of the old password.
Requiring additional authentication during password would enhance system security.

Proposed Solution
Update the password change workflow to require the current password before allowing a new password to be set.

Specifically:
Modify the UI to include a field for the old password.
Update the API to validate the old password as part of the password change request.

@cotosso cotosso moved this to ToDo 🕐 in NethSecurity Jan 15, 2025
@cotosso cotosso added this to the NethSecurity 8.5 milestone Jan 15, 2025
@gsanchietti
Copy link
Member

This change requires extensive modifications and thorough testing. It involves:

  • Removing all calls to ubus to avoid bypass issues.
  • Creating a new API inside the api-server directory to enforce security checks and password change
  • Updating the UI to integrate with the new API.
  • Removing all UI calls togetUciConfig and replacing them with the new API.
  • Deleting the ns.account API.

These changes will significantly affect the codebase and require comprehensive testing to ensure system stability and security. For more details, refer to Issue #1023.

Instances of getUciConfig were found in the following files:

  1. src/lib/standalone/ubus.ts
  2. src/composables/useUciNetworkConfig.ts
  3. src/components/standalone/ssh/SshConfig.vue
  4. src/views/standalone/network/InterfacesAndDevicesView.vue
  5. src/components/standalone/system_settings/GeneralSettings.vue
  6. src/components/standalone/system_settings/TimeSynchronization.vue

@Tbaile
Copy link
Contributor

Tbaile commented Feb 14, 2025

This might be superseded by #1075

@Tbaile
Copy link
Contributor

Tbaile commented Mar 3, 2025

Subseded by #1075

@Tbaile Tbaile closed this as completed Mar 3, 2025
@github-project-automation github-project-automation bot moved this from ToDo 🕐 to Done ✅ in NethSecurity Mar 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done ✅
Development

No branches or pull requests

3 participants