feat: Self-service password resets #1484
Labels
No labels
Blocked
Bug
Changelog
Added
Changelog
Missing
Changelog
None
Cherry-picking
Database
Dependencies
Dependencies/Renovate
Difficulty
Easy
Difficulty
Hard
Difficulty
Medium
Documentation
Enhancement
Good first issue
Help wanted
Inherited
Matrix/Administration
Matrix/Appservices
Matrix/Auth
Matrix/Client
Matrix/Core
Matrix/E2EE
Matrix/Federation
Matrix/Hydra
Matrix/MSC
Matrix/Media
Matrix/T&S
Merge
Merge/Manual
Merge/Squash
Meta
Meta/CI
Meta/Packaging
Priority
Blocking
Priority
High
Priority
Low
Security
Status
Confirmed
Status
Duplicate
Status
Invalid
Status
Needs Investigation
Support
Wont fix
old/ci/cd
old/rust
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
continuwuation/continuwuity!1484
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "ginger/password-reset"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This pull request adds support for self-service password resets using links issued by an admin command. Support for password reset emails will be added in a future PR.
Pull request checklist:
mainbranch, and the branch is named something other thanmain.myself, if applicable. This includes ensuring code compiles.
ginger/password-resetto feat: Self-service password resets@ -0,0 +87,4 @@State(services): State<crate::State>,Query(query): Query<PasswordResetQuery>,axum::Form(form): axum::Form<PasswordResetForm>,) -> Result<Response, WebError> {To prevent CSRF, this needs to assert that the Sec-Fetch-Site and Origin headers are from the same domain (or use a CSRF token)
https://www.alexedwards.net/blog/preventing-csrf-in-go
Addressed.
@ -0,0 +16,4 @@#[derive(Debug, Template)]#[template(path = "index.html.j2")]struct Index<'a> {client_domain: &'a str,Using client_domain seems incorrect here, clients can resolve well-known themselves.
oh yeah that is true
8b8c4aadffe74974661d/_continuwuity/f1e33592a0/_continuwuity/cfedde4e338443d2d813bc1443dc1634e3c030e9@ -12,2 +16,3 @@let router = conduwuit_api::router::build(router, &services.server).merge(conduwuit_web::build()).nest("/_continuwuity/", conduwuit_web::build()).route("/", get(async || Redirect::permanent("/_continuwuity/")))A redirect is unnecessary here, and a permanent redirect is a bad idea because someone could put this on their root domain
4a4cf5f8f375f6edb65a75f6edb65a2987bed990/_continuwuity/77eef3c859/_continuwuity/920d21277a2013b246fe0cc188f62c