j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-10 12:16:49 +00:00
Code Issues Projects Releases Wiki Activity

fix(admin): setting a user's password deletes the user's API tokens

Browse source 
An administrator resets a password to close an account someone else
took over, but the API tokens stayed valid: a stolen token kept working
with the new password, for as long as it was made to last. Setting a
password on the user's Password page now deletes that user's tokens,
and the page says so. A user who changes their own password keeps their
tokens (scripts keep working); they can delete them on their profile.
This commit is contained in:
catborise 2026-11-06 19:54:20 +03:00
parent 4f7bca9754
commit c5d0672c68
8 changed files with 39 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

2
admin/templates/admin/user_password_form.html
View file

@ -16,7 +16,7 @@
<div class="row g-3">
<div class="col-lg-3">
<h2 class="h6 fw-semibold mb-1 text-break">{{ edited_user.username }}</h2>
<p class="small text-body-secondary mb-0">{% trans "How the user signs in." %}</p>
<p class="small text-body-secondary mb-0">{% trans "How the user signs in." %} {% trans "Changing it deletes the user's API tokens." %}</p>
</div>
<div class="col-lg-9 form-section-fields">
{% trans "Signs in with the password set here." as with_help %}