Pierre-Olivier Mercier
57775bbf89
- Replace SHA512-based deterministic token with 32-byte crypto/rand token - Store tokens server-side with 1-hour expiry and single-use semantics - Remove genToken (previously broken due to time.Add immutability bug) - Add CSRF double-submit cookie protection to change/lost/reset forms - Remove token from form action URL (use hidden fields only, POST body) - Add MailFrom field and SMTP_FROM env var for configurable sender address - Add SMTP_PASSWORD_FILE env var for secure SMTP password loading - Add PUBLIC_URL env var and --public-url flag for configurable reset link domain - Use generic error messages in handlers to avoid information disclosure Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
83 lines
2.4 KiB
Go
83 lines
2.4 KiB
Go
package main
|
|
|
|
import (
|
|
"log"
|
|
"net/http"
|
|
)
|
|
|
|
func resetPassword(w http.ResponseWriter, r *http.Request) {
|
|
if len(r.URL.Query().Get("l")) == 0 || len(r.URL.Query().Get("t")) == 0 {
|
|
http.Redirect(w, r, "lost", http.StatusFound)
|
|
return
|
|
}
|
|
|
|
base := map[string]interface{}{
|
|
"login": r.URL.Query().Get("l"),
|
|
"token": r.URL.Query().Get("t"),
|
|
}
|
|
|
|
if r.Method != "POST" {
|
|
csrfToken, err := setCSRFToken(w)
|
|
if err != nil {
|
|
http.Error(w, "Internal server error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
base["csrf_token"] = csrfToken
|
|
displayTmpl(w, "reset.html", base)
|
|
return
|
|
}
|
|
|
|
renderError := func(status int, msg string) {
|
|
csrfToken, _ := setCSRFToken(w)
|
|
base["error"] = msg
|
|
base["csrf_token"] = csrfToken
|
|
displayTmplError(w, status, "reset.html", base)
|
|
}
|
|
|
|
if !validateCSRF(r) {
|
|
renderError(http.StatusForbidden, "Invalid or missing CSRF token. Please try again.")
|
|
return
|
|
}
|
|
|
|
// Check the two new passwords are identical
|
|
if r.PostFormValue("newpassword") != r.PostFormValue("new2password") {
|
|
renderError(http.StatusNotAcceptable, "New passwords are not identical. Please retry.")
|
|
return
|
|
} else if err := checkPasswdConstraint(r.PostFormValue("newpassword")); err != nil {
|
|
renderError(http.StatusNotAcceptable, "The password you chose doesn't respect all constraints: "+err.Error())
|
|
return
|
|
}
|
|
|
|
// Validate and consume the token (single-use, server-side)
|
|
token := r.PostFormValue("token")
|
|
dn, ok := consumeResetToken(token)
|
|
if !ok {
|
|
renderError(http.StatusNotAcceptable, "Token invalid or expired, please retry the lost password procedure. Tokens expire after 1 hour.")
|
|
return
|
|
}
|
|
|
|
// Connect to the LDAP server
|
|
conn, err := myLDAP.Connect()
|
|
if err != nil || conn == nil {
|
|
log.Println(err)
|
|
renderError(http.StatusInternalServerError, "Unable to process your request. Please try again later.")
|
|
return
|
|
}
|
|
|
|
// Bind as service to perform the password change
|
|
err = conn.ServiceBind()
|
|
if err != nil {
|
|
log.Println(err)
|
|
renderError(http.StatusInternalServerError, "Unable to process your request. Please try again later.")
|
|
return
|
|
}
|
|
|
|
// Replace the password by the new given
|
|
if err := conn.ChangePassword(dn, r.PostFormValue("newpassword")); err != nil {
|
|
log.Println(err)
|
|
renderError(http.StatusInternalServerError, "Unable to process your request. Please try again later.")
|
|
return
|
|
}
|
|
|
|
displayMsg(w, "Password successfully changed!", http.StatusOK)
|
|
}
|