pi-hole / FTL

The Pi-hole FTL engine
https://pi-hole.net
Other
1.34k stars 187 forks source link

Check if the newly set password is the same as the old one #1994

Closed DL6ER closed 2 weeks ago

DL6ER commented 2 weeks ago

What does this implement/fix?

This is especially worth adding in the context of forced passwords (via env var) as the password is always "set" on each config change. This PR effectively prevents FTL from wiping all sessions and forcing the user to re-login when changing even settings which are 100% unrelated to the API.


Related issue or feature (if applicable): N/A

Pull request in docs with documentation (if applicable): N/A


By submitting this pull request, I confirm the following:

  1. I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
  2. I have commented my proposed changes within the code.
  3. I am willing to help maintain this change if there are issues with it later.
  4. It is compatible with the EUPL 1.2 license
  5. I have squashed any insignificant commits. (git rebase)

Checklist:

rdwebdesign commented 2 weeks ago

Do we still need this check?

https://github.com/pi-hole/FTL/blob/2406e1a70ee9ef83b98ed672df2705d02b016da2/src/api/config.c#L289-L294

DL6ER commented 2 weeks ago

Do we still need this check?

https://github.com/pi-hole/FTL/blob/2406e1a70ee9ef83b98ed672df2705d02b016da2/src/api/config.c#L289-L294

Yes, this check serves a totally different purpose: The web interface sets the password field value to PASSWORD_VALUE and when the web interface sends back exactly this string, we assume the password is not to be changed. However. nobody will do this intentionally (outside the web interface) so it isn't concerned with all the changes discussed here.