commit: c8d11c306452ea36f5690ba1824434dc71bd9f95
parent 6fc38aac8814fa63d6c43d004cb5280131106cb2
Author: Haelwenn <contact+git.pleroma.social@hacktivis.me>
Date: Thu, 19 Nov 2020 16:22:14 +0000
Merge branch '2317-old-reset-tokens' into 'develop'
Resolve "Don't allow old password reset tokens"
Closes #2317
See merge request pleroma/pleroma!3160
Diffstat:
6 files changed, 55 insertions(+), 1 deletion(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -21,6 +21,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
- Configuration: Add `:instance, autofollowing_nicknames` setting to provide a way to make accounts automatically follow new users that register on the local Pleroma instance.
- Ability to view remote timelines, with ex. `/api/v1/timelines/public?instance=lain.com` and streams `public:remote` and `public:remote:media`.
- The site title is now injected as a `title` tag like preloads or metadata.
+- Password reset tokens now are not accepted after a certain age.
<details>
<summary>API Changes</summary>
diff --git a/config/config.exs b/config/config.exs
@@ -263,7 +263,8 @@ config :pleroma, :instance,
length: 16
]
],
- show_reactions: true
+ show_reactions: true,
+ password_reset_token_validity: 60 * 60 * 24
config :pleroma, :welcome,
direct_message: [
diff --git a/docs/configuration/cheatsheet.md b/docs/configuration/cheatsheet.md
@@ -63,6 +63,7 @@ To add configuration to your config file, you can copy it from the base config.
* `external_user_synchronization`: Enabling following/followers counters synchronization for external users.
* `cleanup_attachments`: Remove attachments along with statuses. Does not affect duplicate files and attachments without status. Enabling this will increase load to database when deleting statuses on larger instances.
* `show_reactions`: Let favourites and emoji reactions be viewed through the API (default: `true`).
+* `password_reset_token_validity`: The time after which reset tokens aren't accepted anymore, in seconds (default: one day).
## Welcome
* `direct_message`: - welcome message sent as a direct message.
diff --git a/lib/pleroma/password_reset_token.ex b/lib/pleroma/password_reset_token.ex
@@ -40,6 +40,7 @@ defmodule Pleroma.PasswordResetToken do
@spec reset_password(binary(), map()) :: {:ok, User.t()} | {:error, binary()}
def reset_password(token, data) do
with %{used: false} = token <- Repo.get_by(PasswordResetToken, %{token: token}),
+ false <- expired?(token),
%User{} = user <- User.get_cached_by_id(token.user_id),
{:ok, _user} <- User.reset_password(user, data),
{:ok, token} <- Repo.update(used_changeset(token)) do
@@ -48,4 +49,14 @@ defmodule Pleroma.PasswordResetToken do
_e -> {:error, token}
end
end
+
+ def expired?(%__MODULE__{inserted_at: inserted_at}) do
+ validity = Pleroma.Config.get([:instance, :password_reset_token_validity], 0)
+
+ now = NaiveDateTime.utc_now()
+
+ difference = NaiveDateTime.diff(now, inserted_at)
+
+ difference > validity
+ end
end
diff --git a/lib/pleroma/web/twitter_api/controllers/password_controller.ex b/lib/pleroma/web/twitter_api/controllers/password_controller.ex
@@ -17,6 +17,7 @@ defmodule Pleroma.Web.TwitterAPI.PasswordController do
def reset(conn, %{"token" => token}) do
with %{used: false} = token <- Repo.get_by(PasswordResetToken, %{token: token}),
+ false <- PasswordResetToken.expired?(token),
%User{} = user <- User.get_cached_by_id(token.user_id) do
render(conn, "reset.html", %{
token: token,
diff --git a/test/pleroma/web/twitter_api/password_controller_test.exs b/test/pleroma/web/twitter_api/password_controller_test.exs
@@ -31,9 +31,48 @@ defmodule Pleroma.Web.TwitterAPI.PasswordControllerTest do
assert response =~ "<h2>Password Reset for #{user.nickname}</h2>"
end
+
+ test "it returns an error when the token has expired", %{conn: conn} do
+ clear_config([:instance, :password_reset_token_validity], 0)
+
+ user = insert(:user)
+ {:ok, token} = PasswordResetToken.create_token(user)
+
+ :timer.sleep(2000)
+
+ response =
+ conn
+ |> get("/api/pleroma/password_reset/#{token.token}")
+ |> html_response(:ok)
+
+ assert response =~ "<h2>Invalid Token</h2>"
+ end
end
describe "POST /api/pleroma/password_reset" do
+ test "it fails for an expired token", %{conn: conn} do
+ clear_config([:instance, :password_reset_token_validity], 0)
+
+ user = insert(:user)
+ {:ok, token} = PasswordResetToken.create_token(user)
+ :timer.sleep(2000)
+ {:ok, _access_token} = Token.create(insert(:oauth_app), user, %{})
+
+ params = %{
+ "password" => "test",
+ password_confirmation: "test",
+ token: token.token
+ }
+
+ response =
+ conn
+ |> assign(:user, user)
+ |> post("/api/pleroma/password_reset", %{data: params})
+ |> html_response(:ok)
+
+ refute response =~ "<h2>Password changed!</h2>"
+ end
+
test "it returns HTTP 200", %{conn: conn} do
user = insert(:user)
{:ok, token} = PasswordResetToken.create_token(user)
