Files
@ f629e9a0c376
Branch filter:
Location: kallithea/docs/usage/vcs_support.rst - annotation
f629e9a0c376
2.2 KiB
text/prs.fallenstein.rst
auth: secure password reset implementation
This is a better implementation of password reset function, which
doesn't involve sending a new password to the user's email address
in clear text, and at the same time is stateless.
The old implementation generated a new password and sent it
in clear text to whatever email assigned to the user currently,
so that any user, possibly unauthenticated, could request a reset
for any username or email. Apart from potential insecurity, this
made it possible for anyone to disrupt users' workflow by repeatedly
resetting their passwords.
The idea behind this implementation is to generate
an authentication token which is dependent on the user state
at the time before the password change takes place, so the token
is one-time and can't be reused, and also to bind the token to
the browser session.
The token is calculated as SHA1 hash of the following:
* user's identifier (number, not a name)
* timestamp
* hashed user's password
* session identifier
* per-application secret
We use numeric user's identifier, as it's fixed and doesn't change,
so renaming users doesn't affect the mechanism. Timestamp is added
to make it possible to limit the token's validness (currently hard
coded to 24h), and we don't want users to be able to fake that field
easily. Hashed user's password is needed to prevent using the token
again once the password has been changed. Session identifier is
an additional security measure to ensure someone else stealing the
token can't use it. Finally, per-application secret is just another
way to make it harder for an attacker to guess all values in an
attempt to generate a valid token.
When the token is generated, an anonymous user is directed to a
confirmation page where the timestamp and the usernames are already
preloaded, so the user needs to specify the token. User can either
click the link in the email if it's really them reading it, or to type
the token manually.
Using the right token in the same session as it was requested directs
the user to a password change form, where the user is supposed to
specify a new password (twice, of course). Upon completing the form
(which is POSTed) the password change happens and a notification
mail is sent.
The test is updated to test the basic functionality with a bad and
a good token, but it doesn't (yet) cover all code paths.
The original work from Andrew has been thorougly reviewed and heavily
modified by Søren Løvborg.
This is a better implementation of password reset function, which
doesn't involve sending a new password to the user's email address
in clear text, and at the same time is stateless.
The old implementation generated a new password and sent it
in clear text to whatever email assigned to the user currently,
so that any user, possibly unauthenticated, could request a reset
for any username or email. Apart from potential insecurity, this
made it possible for anyone to disrupt users' workflow by repeatedly
resetting their passwords.
The idea behind this implementation is to generate
an authentication token which is dependent on the user state
at the time before the password change takes place, so the token
is one-time and can't be reused, and also to bind the token to
the browser session.
The token is calculated as SHA1 hash of the following:
* user's identifier (number, not a name)
* timestamp
* hashed user's password
* session identifier
* per-application secret
We use numeric user's identifier, as it's fixed and doesn't change,
so renaming users doesn't affect the mechanism. Timestamp is added
to make it possible to limit the token's validness (currently hard
coded to 24h), and we don't want users to be able to fake that field
easily. Hashed user's password is needed to prevent using the token
again once the password has been changed. Session identifier is
an additional security measure to ensure someone else stealing the
token can't use it. Finally, per-application secret is just another
way to make it harder for an attacker to guess all values in an
attempt to generate a valid token.
When the token is generated, an anonymous user is directed to a
confirmation page where the timestamp and the usernames are already
preloaded, so the user needs to specify the token. User can either
click the link in the email if it's really them reading it, or to type
the token manually.
Using the right token in the same session as it was requested directs
the user to a password change form, where the user is supposed to
specify a new password (twice, of course). Upon completing the form
(which is POSTed) the password change happens and a notification
mail is sent.
The test is updated to test the basic functionality with a bad and
a good token, but it doesn't (yet) cover all code paths.
The original work from Andrew has been thorougly reviewed and heavily
modified by Søren Løvborg.
601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 fbbe80e3322b 601282d36c06 601282d36c06 601282d36c06 fbbe80e3322b 601282d36c06 601282d36c06 fbbe80e3322b 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 36a35394b3cb 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 601282d36c06 9cef5a168b88 9cef5a168b88 9cef5a168b88 fbbe80e3322b 9cef5a168b88 9cef5a168b88 fbbe80e3322b b52a1ccee927 b52a1ccee927 b52a1ccee927 9cef5a168b88 9cef5a168b88 b52a1ccee927 b52a1ccee927 b52a1ccee927 b52a1ccee927 b52a1ccee927 9cef5a168b88 b52a1ccee927 9cef5a168b88 9cef5a168b88 b52a1ccee927 9cef5a168b88 9cef5a168b88 9cef5a168b88 9cef5a168b88 b52a1ccee927 b52a1ccee927 b52a1ccee927 9cef5a168b88 b52a1ccee927 9cef5a168b88 b52a1ccee927 b52a1ccee927 601282d36c06 fbbe80e3322b 601282d36c06 601282d36c06 b52a1ccee927 | .. _vcs_support:
===============================
Version control systems support
===============================
Kallithea supports Git and Mercurial repositories out-of-the-box.
For Git, you do need the ``git`` command line client installed on the server.
You can always disable Git or Mercurial support by editing the
file ``kallithea/__init__.py`` and commenting out the backend.
.. code-block:: python
BACKENDS = {
'hg': 'Mercurial repository',
#'git': 'Git repository',
}
Git support
-----------
Web server with chunked encoding
````````````````````````````````
Large Git pushes require an HTTP server with support for
chunked encoding for POST. The Python web servers waitress_ and
gunicorn_ (Linux only) can be used. By default, Kallithea uses
waitress_ for `paster serve` instead of the built-in `paste` WSGI
server.
The paster server is controlled in the .ini file::
use = egg:waitress#main
or::
use = egg:gunicorn#main
Also make sure to comment out the following options::
threadpool_workers =
threadpool_max_requests =
use_threadpool =
Mercurial support
-----------------
Working with Mercurial subrepositories
``````````````````````````````````````
This section explains how to use Mercurial subrepositories_ in Kallithea.
Example usage::
## init a simple repo
hg init mainrepo
cd mainrepo
echo "file" > file
hg add file
hg ci --message "initial file"
# clone subrepo we want to add from Kallithea
hg clone http://kallithea.local/subrepo
## specify URL to existing repo in Kallithea as subrepository path
echo "subrepo = http://kallithea.local/subrepo" > .hgsub
hg add .hgsub
hg ci --message "added remote subrepo"
In the file list of a clone of ``mainrepo`` you will see a connected
subrepository at the revision it was cloned with. Clicking on the
subrepository link sends you to the proper repository in Kallithea.
Cloning ``mainrepo`` will also clone the attached subrepository.
Next we can edit the subrepository data, and push back to Kallithea. This will
update both repositories.
.. _waitress: http://pypi.python.org/pypi/waitress
.. _gunicorn: http://pypi.python.org/pypi/gunicorn
.. _subrepositories: http://mercurial.aragost.com/kick-start/en/subrepositories/
|