mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
da63e570e5
/accounts/email_otp/ mails a user their OTP QR code and needs no login. Measured with the default settings (OTP disabled): - It was reachable although OTP was off, and created OTP devices. - Every request sent a mail: 20 requests for one address, 20 mails, so anyone who knew an address could fill that mailbox. - An address shared by two users, or a mail server that could not be reached, ended in an error page (500). - Inactive users were mailed too. The page now exists only while OTP_ENABLED is set. It mails a single active user whose address matches (case-insensitively), at most once every 5 minutes per user (Django's cache: with several workers the bound is per worker), and logs a failed delivery. The answer is the same in every case, so it does not reveal whether an address belongs to a user. The QR codes come from django-qr-code (segno); both the mail and the account page render them without the qrcode package removed earlier. The new tests fail on the previous code. |
||
|---|---|---|
| .. | ||
| migrations | ||
| templates | ||
| templatetags | ||
| __init__.py | ||
| apps.py | ||
| checks.py | ||
| forms.py | ||
| middleware.py | ||
| models.py | ||
| test_admin_email_otp.py | ||
| test_admin_password.py | ||
| test_change_password_permission.py | ||
| test_checks.py | ||
| test_email_otp.py | ||
| test_first_login_password.py | ||
| test_security_fixes.py | ||
| test_utils.py | ||
| tests.py | ||
| urls.py | ||
| utils.py | ||
| views.py | ||