hostsharing/hs.customers.ldapadmin
17
0
Fork 0
Code Pull Requests Activity

invalidate password reset token

Browse Source
This commit is contained in:
Peter Hormanns 2021-12-03 20:36:13 +01:00
parent 55cce4532f
commit 7a973041e5
5 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/java/de/jalin/ldapadmin/ldap/PasswordValidator.java
View File

@ -8,7 +8,7 @@ import org.apache.commons.codec.binary.Base64;
public class PasswordValidator {
private static final int MIN_PASSWORD_LEN = 6;
private static final int MIN_PASSWORD_LEN = 8;
private static final Base64 BASE64 = new Base64();
private static final String LABEL = "{SSHA512}";
private static final String SALT_CHARACTERS =

16
src/main/java/de/jalin/ldapadmin/web/ResetPasswordServlet.java
View File

@ -8,6 +8,10 @@ import java.io.PrintStream;
import java.io.PrintWriter;
import java.io.Writer;
import java.net.InetAddress;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.nio.file.attribute.BasicFileAttributes;
import java.nio.file.attribute.FileTime;
import java.security.NoSuchAlgorithmException;
import java.util.Collection;
import java.util.SortedMap;
@ -53,7 +57,17 @@ public class ResetPasswordServlet extends AbstractLDAPServlet {
cleanSession(httpSession);
final String token = req.getParameter("token");
if (token != null && !token.isEmpty()) {
final File passwdResetFile = new File(tempDir + "/passwd" + token + ".tmp");
final String pathToTempFile = tempDir + "/passwd" + token + ".tmp";
final File passwdResetFile = new File(pathToTempFile);
final BasicFileAttributes fileAttributes = Files.readAttributes(Paths.get(pathToTempFile), BasicFileAttributes.class);
final FileTime creationTime = fileAttributes.creationTime();
final long threeHoursDifference = 10800000L;
if (creationTime.compareTo(FileTime.fromMillis(System.currentTimeMillis() - threeHoursDifference)) < 0) {
LOG.warning("password reset token has expired");
httpSession.setAttribute("errormessage", new Messages(req.getLocale()).getString("ResetPasswordServlet.passwordreset_tokenexpired"));
req.getRequestDispatcher("/reset-password.jsp").forward(req, resp);
return;
}
if (passwdResetFile.exists() && passwdResetFile.canRead()) {
try (final BufferedReader reader = new BufferedReader(new FileReader(passwdResetFile))) {
final String[] uidAndEMail = reader.readLine().split(":");

1
src/main/resources/de/jalin/ldapadmin/web/messages.properties
View File

@ -14,6 +14,7 @@ ResetPasswordServlet.error_sending_email_server=Could not reach email service
ResetPasswordServlet.error_sending_password_reset=Error sending email
ResetPasswordServlet.invalid_password_reuse=Invalid reuse of a password known from history. A new password is required.
ResetPasswordServlet.no_valid_passwordreset_request=Could not find a valid password request.
ResetPasswordServlet.passwordreset_tokenexpired=The password reset token has expired
ResetPasswordServlet.password_changed=Password changed
ResetPasswordServlet.passwords_donot_match=Passwords do not match
ResetPasswordServlet.simple_password=Your password is too simple. It should contain at least one lowercase and uppercase letter and a digit / secial character and a minimum length of 12 characters

1
src/main/resources/de/jalin/ldapadmin/web/messages_de.properties
View File

@ -14,6 +14,7 @@ ResetPasswordServlet.error_sending_email_server=Konnte Mail Server nicht erreich
ResetPasswordServlet.error_sending_password_reset=Fehler beim Versand der E-Mail f\u00fcr das Setzen eines neuen Passworts.
ResetPasswordServlet.invalid_password_reuse=Das Passwort wurde bereits verwendet. Die Passwort-Richtlinie verlangt die Definition eines neuen Passworts.
ResetPasswordServlet.no_valid_passwordreset_request=Es konnte keine g\u00fcltige Anforderung f\u00fcr ein neues Passwort zugeordnet werden.
ResetPasswordServlet.passwordreset_tokenexpired=Das Token zum Passwort-Zur\u00fcchsetzen ist abgelaufen.
ResetPasswordServlet.password_changed=Ihr neues Passwort ist gespeichert.
ResetPasswordServlet.passwords_donot_match=Die beiden Passwort-Eingaben stimmen nicht \u00fcberein.
ResetPasswordServlet.simple_password=Ihr Passwort ist zu einfach. Es sollte mindestens einen Klein- und Gro\u00dfbuchstaben und eine Ziffer oder Sonderzeichen enthalten sowie eine Mindestl\u00e4nge von 12 Zeichen aufweisen

1
src/main/resources/de/jalin/ldapadmin/web/messages_en.properties
View File

@ -14,6 +14,7 @@ ResetPasswordServlet.error_sending_email_server=Could not reach email service
ResetPasswordServlet.error_sending_password_reset=Error sending email
ResetPasswordServlet.invalid_password_reuse=Invalid reuse of a password known from history. A new password is required.
ResetPasswordServlet.no_valid_passwordreset_request=Could not find a valid password request.
ResetPasswordServlet.passwordreset_tokenexpired=The password reset token has expired
ResetPasswordServlet.password_changed=Password changed
ResetPasswordServlet.passwords_donot_match=Passwords do not match
ResetPasswordServlet.simple_password=Your password is too simple. It should contain at least one lowercase and uppercase letter and a digit / secial character and a minimum length of 12 characters