Strong passwords for admins#9347
Merged
andreslucena merged 64 commits intodecidim:developfrom Jun 23, 2022
Merged
Conversation
added 8 commits
May 20, 2022 18:26
Contributor
Can we also update this to the docs @lahdeero ? |
7 tasks
Make the admin password configuration options match the ENV var names a bit better.
Contributor
|
All changes done @andreslucena. |
andreslucena
requested changes
Jun 22, 2022
Member
andreslucena
left a comment
There was a problem hiding this comment.
One last minute change, sorry! Talking with other people from @decidim/product, and we agreed that it can be difficult to have two seed passwords (one for admins and another for users). Can you change the default seed password to decidim123456789 to everyone 🙏🏽? Thanks
For consistency reasons, use the same password for regular users and administrators after adding the stronger administrator password rules.
Contributor
|
Done @andreslucena |
andreslucena
added a commit
that referenced
this pull request
Jun 29, 2022
* Initial * Cant reuse old passwords * Update user seeds and factory * Update previous passwords and change time in model * Update seeds * Update passowrd in invite admin spec * Lock user to change password view * Show error when passwords doesnt match * Add validator test and update comments * Change method names * Add secondary notification to change password page * Update admins default password to docs * Rename the commands and forms (remove admin from the names) * Rename the password change paths * Do not log out the user after successful password change * Refine the change password translations * Show the required indicator for the password change fields * Require the password change also for the admin panel * Fix the migration, simplify the logic and improve its performance * Fix the form class name in the password form spec * Fix correct page title expectation for the admin password change spec * DRY password validator + do not disable the rest of the validations for admins * Make attr_readers private as they are only used within the command * Better naming for the concern methods * Do not require permissions to access the change password page * Simplify the password confirmation check in the form * Correct SoC Refactor the needs_password_update? method to the correct place * Move the admin password validators to the PasswordValidator class To simplify the logic where this is used, let's have these all in the same validator. * Simplify generating the password field options * Remove the strong admin password validation from the user model This is now part of the PasswordValidator so we don't need to manually validate it in the model either. * Remove spec for removed class * Limit the password change routes for signed in user * Move the admin password validation specs to the password validator spec * Move the strong password validation error message to correct place * Fix the admin password validation system specs after modifying messages * Move the password validator spec to correct folder * Move the checks for the password change save to the hook method * Remove unnecessary controller method * Simlify the admin check * Remove unused i18n key * Skip password repeated validation if disabled or password was not changed * Do not compare empty passwords in the password repeated check * Fix the password validator spec after the latest changes * Fix the user test factory after the admin password validation changes * Set the user factory password at the after `:build` hook * Do not add the `required` attribute on the label element * Delete the `required` option from the i18n label * Fix the authentication spec after applying the front-end rules After applying the front-end rules (min and max length) to the password fields, the authentication spec was broken. * Mark the protected methods as private As the PasswordValidator is no longer extended, let's mark these methods as private. * System spec for user cannot enter the admin panel if password expired * Only return admin password length when the feature is enabled Co-authored-by: Andrés Pereira de Lucena <andreslucena@users.noreply.github.com> * Update the admin password in the install docs * Allow configuring the admin password configs through ENV vars * Test the admin env vars * Refine the admin password configuration names after introducing ENV vars Make the admin password configuration options match the ENV var names a bit better. * Add documentation for the admin password ENV vars * Add CHANGELOG entry for the strong admin passwords feature * Change the default password form decidim123456 to decidim123456789 For consistency reasons, use the same password for regular users and administrators after adding the stronger administrator password rules. * For consistency, change the system admin example password Co-authored-by: Eero Lahdenperä <eero.lahdenpera@mainiotech.fi> Co-authored-by: Antti Hukkanen <antti.hukkanen@mainiotech.fi> Co-authored-by: Andrés Pereira de Lucena <andreslucena@users.noreply.github.com>
andreslucena
added a commit
that referenced
this pull request
Jul 6, 2022
* Initial * Cant reuse old passwords * Update user seeds and factory * Update previous passwords and change time in model * Update seeds * Update passowrd in invite admin spec * Lock user to change password view * Show error when passwords doesnt match * Add validator test and update comments * Change method names * Add secondary notification to change password page * Update admins default password to docs * Rename the commands and forms (remove admin from the names) * Rename the password change paths * Do not log out the user after successful password change * Refine the change password translations * Show the required indicator for the password change fields * Require the password change also for the admin panel * Fix the migration, simplify the logic and improve its performance * Fix the form class name in the password form spec * Fix correct page title expectation for the admin password change spec * DRY password validator + do not disable the rest of the validations for admins * Make attr_readers private as they are only used within the command * Better naming for the concern methods * Do not require permissions to access the change password page * Simplify the password confirmation check in the form * Correct SoC Refactor the needs_password_update? method to the correct place * Move the admin password validators to the PasswordValidator class To simplify the logic where this is used, let's have these all in the same validator. * Simplify generating the password field options * Remove the strong admin password validation from the user model This is now part of the PasswordValidator so we don't need to manually validate it in the model either. * Remove spec for removed class * Limit the password change routes for signed in user * Move the admin password validation specs to the password validator spec * Move the strong password validation error message to correct place * Fix the admin password validation system specs after modifying messages * Move the password validator spec to correct folder * Move the checks for the password change save to the hook method * Remove unnecessary controller method * Simlify the admin check * Remove unused i18n key * Skip password repeated validation if disabled or password was not changed * Do not compare empty passwords in the password repeated check * Fix the password validator spec after the latest changes * Fix the user test factory after the admin password validation changes * Set the user factory password at the after `:build` hook * Do not add the `required` attribute on the label element * Delete the `required` option from the i18n label * Fix the authentication spec after applying the front-end rules After applying the front-end rules (min and max length) to the password fields, the authentication spec was broken. * Mark the protected methods as private As the PasswordValidator is no longer extended, let's mark these methods as private. * System spec for user cannot enter the admin panel if password expired * Only return admin password length when the feature is enabled Co-authored-by: Andrés Pereira de Lucena <andreslucena@users.noreply.github.com> * Update the admin password in the install docs * Allow configuring the admin password configs through ENV vars * Test the admin env vars * Refine the admin password configuration names after introducing ENV vars Make the admin password configuration options match the ENV var names a bit better. * Add documentation for the admin password ENV vars * Add CHANGELOG entry for the strong admin passwords feature * Change the default password form decidim123456 to decidim123456789 For consistency reasons, use the same password for regular users and administrators after adding the stronger administrator password rules. * For consistency, change the system admin example password Co-authored-by: Eero Lahdenperä <eero.lahdenpera@mainiotech.fi> Co-authored-by: Antti Hukkanen <antti.hukkanen@mainiotech.fi> Co-authored-by: Andrés Pereira de Lucena <andreslucena@users.noreply.github.com>
eliegaboriau
pushed a commit
to eliegaboriau/decidim
that referenced
this pull request
Oct 25, 2022
* Initial * Cant reuse old passwords * Update user seeds and factory * Update previous passwords and change time in model * Update seeds * Update passowrd in invite admin spec * Lock user to change password view * Show error when passwords doesnt match * Add validator test and update comments * Change method names * Add secondary notification to change password page * Update admins default password to docs * Rename the commands and forms (remove admin from the names) * Rename the password change paths * Do not log out the user after successful password change * Refine the change password translations * Show the required indicator for the password change fields * Require the password change also for the admin panel * Fix the migration, simplify the logic and improve its performance * Fix the form class name in the password form spec * Fix correct page title expectation for the admin password change spec * DRY password validator + do not disable the rest of the validations for admins * Make attr_readers private as they are only used within the command * Better naming for the concern methods * Do not require permissions to access the change password page * Simplify the password confirmation check in the form * Correct SoC Refactor the needs_password_update? method to the correct place * Move the admin password validators to the PasswordValidator class To simplify the logic where this is used, let's have these all in the same validator. * Simplify generating the password field options * Remove the strong admin password validation from the user model This is now part of the PasswordValidator so we don't need to manually validate it in the model either. * Remove spec for removed class * Limit the password change routes for signed in user * Move the admin password validation specs to the password validator spec * Move the strong password validation error message to correct place * Fix the admin password validation system specs after modifying messages * Move the password validator spec to correct folder * Move the checks for the password change save to the hook method * Remove unnecessary controller method * Simlify the admin check * Remove unused i18n key * Skip password repeated validation if disabled or password was not changed * Do not compare empty passwords in the password repeated check * Fix the password validator spec after the latest changes * Fix the user test factory after the admin password validation changes * Set the user factory password at the after `:build` hook * Do not add the `required` attribute on the label element * Delete the `required` option from the i18n label * Fix the authentication spec after applying the front-end rules After applying the front-end rules (min and max length) to the password fields, the authentication spec was broken. * Mark the protected methods as private As the PasswordValidator is no longer extended, let's mark these methods as private. * System spec for user cannot enter the admin panel if password expired * Only return admin password length when the feature is enabled Co-authored-by: Andrés Pereira de Lucena <andreslucena@users.noreply.github.com> * Update the admin password in the install docs * Allow configuring the admin password configs through ENV vars * Test the admin env vars * Refine the admin password configuration names after introducing ENV vars Make the admin password configuration options match the ENV var names a bit better. * Add documentation for the admin password ENV vars * Add CHANGELOG entry for the strong admin passwords feature * Change the default password form decidim123456 to decidim123456789 For consistency reasons, use the same password for regular users and administrators after adding the stronger administrator password rules. * For consistency, change the system admin example password Co-authored-by: Eero Lahdenperä <eero.lahdenpera@mainiotech.fi> Co-authored-by: Antti Hukkanen <antti.hukkanen@mainiotech.fi> Co-authored-by: Andrés Pereira de Lucena <andreslucena@users.noreply.github.com>
This was referenced Mar 9, 2023
armandfardeau
added a commit
to OpenSourcePolitics/decidim-module-friendly_signup
that referenced
this pull request
Aug 30, 2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎩 What? Why?
Adds configurable option to require strong passwords for admins. When option is set to true admins are asked to update their passwords to strong passwords after they log in.
NOTE: If you are using seeds admin's default password has changed to
decidim123456789📌 Related Issues
Fixes #9178
Testing
Decidim::User.find(1).update(password_updated_at: nil)📷 Screenshots