Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ask old password during password change #1023

Open
cotosso opened this issue Jan 15, 2025 · 1 comment
Open

Ask old password during password change #1023

cotosso opened this issue Jan 15, 2025 · 1 comment

Comments

@cotosso
Copy link
Contributor

cotosso commented Jan 15, 2025

The current UI allows users to change their password without requiring re-entry of the old password.
Requiring additional authentication during password would enhance system security.

Proposed Solution
Update the password change workflow to require the current password before allowing a new password to be set.

Specifically:
Modify the UI to include a field for the old password.
Update the API to validate the old password as part of the password change request.

@cotosso cotosso moved this to ToDo 🕐 in NethSecurity Jan 15, 2025
@cotosso cotosso added this to the NethSecurity 8.5 milestone Jan 15, 2025
@gsanchietti
Copy link
Member

This change requires extensive modifications and thorough testing. It involves:

  • Removing all calls to ubus to avoid bypass issues.
  • Creating a new API inside the api-server directory to enforce security checks and password change
  • Updating the UI to integrate with the new API.
  • Removing all UI calls togetUciConfig and replacing them with the new API.
  • Deleting the ns.account API.

These changes will significantly affect the codebase and require comprehensive testing to ensure system stability and security. For more details, refer to Issue #1023.

Instances of getUciConfig were found in the following files:

  1. src/lib/standalone/ubus.ts
  2. src/composables/useUciNetworkConfig.ts
  3. src/components/standalone/ssh/SshConfig.vue
  4. src/views/standalone/network/InterfacesAndDevicesView.vue
  5. src/components/standalone/system_settings/GeneralSettings.vue
  6. src/components/standalone/system_settings/TimeSynchronization.vue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: ToDo 🕐
Development

No branches or pull requests

2 participants