Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Ask old password during password change #1023

Open
cotosso opened this issue Jan 15, 2025 · 1 comment
Open

Ask old password during password change #1023

cotosso opened this issue Jan 15, 2025 · 1 comment

Comments

@cotosso
Copy link
Contributor

cotosso commented Jan 15, 2025

The current UI allows users to change their password without requiring re-entry of the old password.
Requiring additional authentication during password would enhance system security.

Proposed Solution
Update the password change workflow to require the current password before allowing a new password to be set.

Specifically:
Modify the UI to include a field for the old password.
Update the API to validate the old password as part of the password change request.

@cotosso cotosso moved this to ToDo 🕐 in NethSecurity Jan 15, 2025
@cotosso cotosso added this to the NethSecurity 8.5 milestone Jan 15, 2025
@gsanchietti
Copy link
Member

This change requires extensive modifications and thorough testing. It involves:

  • Removing all calls to ubus to avoid bypass issues.
  • Creating a new API inside the api-server directory to enforce security checks and password change
  • Updating the UI to integrate with the new API.
  • Removing all UI calls togetUciConfig and replacing them with the new API.
  • Deleting the ns.account API.

These changes will significantly affect the codebase and require comprehensive testing to ensure system stability and security. For more details, refer to Issue #1023.

Instances of getUciConfig were found in the following files:

  1. src/lib/standalone/ubus.ts
  2. src/composables/useUciNetworkConfig.ts
  3. src/components/standalone/ssh/SshConfig.vue
  4. src/views/standalone/network/InterfacesAndDevicesView.vue
  5. src/components/standalone/system_settings/GeneralSettings.vue
  6. src/components/standalone/system_settings/TimeSynchronization.vue

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
Status: ToDo 🕐
Development

No branches or pull requests

2 participants