search

pi-hole / web

Pi-hole Dashboard for stats and more
https://pi-hole.net
Other
2.05k stars 559 forks source link

Change password dont lose login #2534

Open rube200 opened 1 year ago

rube200 commented 1 year ago

Versions

Platform

Expected behavior

So i was messing with password and tryied to change it using the command pihole -a -p test and went back to the pihole and still had login.

Actual behavior / bug

After change password login should be lost to avoid security issues.

dschaper commented 1 year ago

I don't know of too many other systems that invalidate existing sessions on password change. In fact most systems ask if you want to log out existing sessions specifically and separately from password changes.

dschaper commented 1 year ago

But this is a Feature Request and not a bug report so:

Because of the number of requests and the very limited resources we have as a free open-source project run by volunteers, we ask that you open all Feature Requests at our Discourse Forum.

Thank you for your understanding.

rube200 commented 1 year ago

I mean systems like google and discord does that. For example if some reason the password gets compromise it will be a gate after changing the password until it expires.

yubiuser commented 1 year ago

Fixed in v6

https://github.com/pi-hole/FTL/commit/5e436312f71ea73ea7f47dbbab0d489301b0147f

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 30 days with no activity. Please comment or update this issue or it will be closed in 5 days.

SodaWithoutSparkles commented 1 year ago

Should issues that are WIP be considered complete/stale?

yubiuser commented 1 year ago

They probably should not be marked as stale...

https://github.com/pi-hole/AdminLTE/blob/d7f1842825e33abe098a9383672b63d6d56dfd0f/.github/workflows/stale.yml#L23

SodaWithoutSparkles commented 1 year ago

@yubiuser WIP is not in that list however. Should that be a PR?

Edit: Also, perhaps that CRON job should run more frequently. It is confusing to see that label don't get removed in a few minites after a comment.

Should the discussion about that github action be on a separate bug report? Just to move unrelated discussion off this issue and not tagging unrelated people.

yubiuser commented 1 year ago

Should that be a PR?

No, just a hint which labels are exempt. But I'm planing to change that anyway ... we agreed to unify the lables used across all repos.

Also, perhaps that CRON job should run more frequently. It is confusing to see that label don't get removed in a few minites after a comment

You're right. The workflow only triggers once a day at 08:00. A good value might be something between every 15 and 60 minutes. Do you want to PR this?

yubiuser commented 1 year ago

A good value might be something between every 15 and 60 minutes.

Or even better: keep the run at 08:00 and add https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#issue_comment

SodaWithoutSparkles commented 1 year ago

Nah, I am not near a computer. You start a PR?

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 30 days with no activity. Please comment or update this issue or it will be closed in 5 days.

SodaWithoutSparkles commented 1 year ago

@yubiuser It seems that WIP issues still get marked as stale

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 30 days with no activity. Please comment or update this issue or it will be closed in 5 days.

SodaWithoutSparkles commented 1 year ago

Nope

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 30 days with no activity. Please comment or update this issue or it will be closed in 5 days.

yubiuser commented 1 year ago

The issue should be finally completely fixed by https://github.com/pi-hole/FTL/pull/1630 in FTL v6