Thanks Andrew! FYI, I have in my Extensible.pm: *(pre this update; line numbers will be slightly out also, due to some debug code)* @@ -211,7 +213,7 @@ # plugin_hooks 'before_authenticate_user', 'after_authenticate_user', - 'before_create_user', 'after_create_user', + 'before_create_user', 'after_create_user', 'after_reset_code_success', 'login_required', 'permission_denied', 'after_login_success'; @@ -1216,7 +1229,17 @@ if ($code) { no strict 'refs'; my $randompw = &{ $plugin->password_generator }; - if ( $plugin->user_password( code => $code, new_password => $randompw ) ) { + + if (my $username = $plugin->user_password( code => $code, new_password => $randompw ) ) { + # Support a custom 'Change password' page or other app-based intervention after a successful reset code has been applied + foreach my $realm_check (@{ $plugin->realm_names }) { # $params->{realm} isn't defined at this point... + my $provider = $plugin->auth_provider($realm_check); + $params->{realm} = $realm_check if $provider->get_user_details($username); + } + + $plugin->execute_plugin_hook( 'after_reset_code_success', + { username => $username, password => $randompw, realm => $params->{realm} } ); + This allows a user to do a password change in the app. (How else do people use reset codes?) -N PS: I also have: @@ -1034,9 +1045,11 @@ $message{from} = $plugin->mail_from; $message{plain} = <<__EMAIL; A request has been received to reset your password for $appname. If -you would like to do so, please follow the link below: +you would like to do so, please click on the link below: $site/login/$options{code} + +(If you are unable to click on the link, please copy and paste it into your browser). because our users appear to need this extra help. On Wed, 19 Dec 2018 at 19:18, Andrew Beverley <andy@andybev.com> wrote:
Dear all,
I have just released a new version of Dancer2::Plugin::Auth::Extensible.
This contains a number of changes to the return_url functionality (forwarding to a URL after login). In particular:
- It fixes a medium-level security vulnerability, whereby return_url could be used for Open URL Redirection attacks[1] with links such as /login?return_url=http://news.bbc.co.uk/
- It fixes a problem with apps mounted on paths where the path was included twice (GH 82 & 74)
I've tested fairly thoroughly and I don't think I've broken anything, but let me know if you experience any problems.
Regards,
Andy
[1] https://portswigger.net/kb/issues/00500100_open-redirection-reflected _______________________________________________ dancer-users mailing list dancer-users@dancer.pm http://lists.preshweb.co.uk/mailman/listinfo/dancer-users