Link for password reset
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| psiphon |
Fix Committed
|
High
|
Nurlan Turdaliev | ||
Bug Description
Currently, when a user requests a password change, the password is changed to a new random value by the server and the newly generated password is emailed to the user. This is non-standard and also is problematic if a user doesn't receive the new password email for any reason.
The workflow should be as follows (see guest browsing/invites for a sample implementation):
1. User requests a password reset.
2. User receives an email with a unique and difficult to guess link code (similar to invite codes, ie. https:/
2a. The link expires after a time period that is configured in config.php (default to one week).
(See invitation_ttl or email_candidate_ttl for sample implementation)
3. User browses to that link.
3a. This page must be set as "noauth" in httpd.conf.
3b. The link is only valid for all proxies to which the user is currently assigned.
3c. This page must return 404 if the link code is invalid or not present.
4. User is presented with two fields to enter and confirm a new password.
5. If the two entered passwords match, the password is changed for the user.
6. The user is brought to the login screen.
Related branches
- Adam Kruger: Approve
- Rod: Needs Fixing
- Nurlan Turdaliev (community): Needs Resubmitting
-
Diff: 429 lines (+283/-19) (has conflicts)8 files modifiedtrunk/mod_psiphon/httpd_conf/httpd.conf (+1/-1)
trunk/sql/upgrade-2.6.sql (+2/-0)
trunk/tools/psiphon_install.sh (+1/-1)
trunk/www/config.php (+4/-0)
trunk/www/includes/lang.php (+65/-0)
trunk/www/includes/url_helpers.php (+6/-0)
trunk/www/p.php (+193/-0)
trunk/www/reset_password.php (+11/-17)
| Adam P (adam+) wrote | #1 |
| tags: | added: category2 |
| visibility: | private → public |
| tags: | added: category2.1 |
| description: | updated |
| tags: | added: sprint3 |
| Changed in psiphon: | |
| status: | New → Confirmed |
| importance: | Undecided → High |
| description: | updated |
| description: | updated |
| description: | updated |
| description: | updated |
| description: | updated |
| description: | updated |
| description: | updated |
| Changed in psiphon: | |
| assignee: | nobody → Nurlan (nurlan0000) |
| status: | Confirmed → In Progress |
| Nurlan Turdaliev (nurlan0000) wrote | #2 |
| Changed in psiphon: | |
| status: | In Progress → Fix Committed |
See conversation here: https:/