j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-10 12:16:49 +00:00
Code Issues Projects Releases Wiki Activity

fix(admin): setting a user's password deletes the user's API tokens

Browse source 
An administrator resets a password to close an account someone else
took over, but the API tokens stayed valid: a stolen token kept working
with the new password, for as long as it was made to last. Setting a
password on the user's Password page now deletes that user's tokens,
and the page says so. A user who changes their own password keeps their
tokens (scripts keep working); they can delete them on their profile.
This commit is contained in:
catborise 2026-11-06 19:54:20 +03:00
parent 4f7bca9754
commit c5d0672c68
8 changed files with 39 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -810,7 +810,7 @@ The REST API (Django REST Framework, documented with `drf-spectacular`) takes th
* **Swagger UI:** `http://<server>/swagger/`
* **ReDoc UI:** `http://<server>/redoc/`
* **OpenAPI 3.0 schema:** `http://<server>/api/schema/` (JSON or YAML)
* **API tokens**, for scripts and tools: **Profile → API Tokens**. A token acts as its user and is shown once; send it as a header:
* **API tokens**, for scripts and tools: **Profile → API Tokens**. A token acts as its user and is shown once; an administrator who sets the user's password deletes them. Send it as a header:
```bash
curl -H "Authorization: Token wvc_..." https://<server>/api/v1/instances/