#1943 mod_password_reset: Adding delete and list commands to adhoc interface
Reporter
eerielili
Owner
Nobody
Created
Updated
Stars
★ (1)
Tags
Priority-Medium
Status-New
Type-Enhancement
eerielili
on
Description of feature:
This patch has been sent to the prosody-dev mailing list (can be alternatively looked at https://git.les-miquelots.net/prosody-patches/tree/mod_password_reset-add-list-delete-tokens.patch) and would add the feature to list or delete password reset tokens through the adhoc interface.
You can delete one token by specifying it's ID, or all tokens with "*"
Listing the tokens will give you 3 pipe-separated fields detailing the user, token ID and expiration date for each token. There's also a separate list of http link for each generated token.
Motivation: (Why?)
Deleting password reset tokens adhoc command:
By default tokens do not auto-delete after expiration is reached and I wanted a way to cleanup tokens without having to SSH and sudo into my server.
It might also help a bit in case of a rogue or compromised admin abusing it's mod_password_reset powers, preventing resets consumption if actions are taken swiftly.
Listing password reset tokens adhoc command:
The listing token adhoc command is great to have an idea of :
- how many reset tokens there are
- for who and when they expire
Then you also can use the list of http links to copy and resend a password reset link that you generated but forgot or couldn't copy for various reasons (client crash, browser crash, internet outage, etc...).
Kinds regards,
eerielili
Description of feature: This patch has been sent to the prosody-dev mailing list (can be alternatively looked at https://git.les-miquelots.net/prosody-patches/tree/mod_password_reset-add-list-delete-tokens.patch) and would add the feature to list or delete password reset tokens through the adhoc interface. You can delete one token by specifying it's ID, or all tokens with "*" Listing the tokens will give you 3 pipe-separated fields detailing the user, token ID and expiration date for each token. There's also a separate list of http link for each generated token. Motivation: (Why?) Deleting password reset tokens adhoc command: By default tokens do not auto-delete after expiration is reached and I wanted a way to cleanup tokens without having to SSH and sudo into my server. It might also help a bit in case of a rogue or compromised admin abusing it's mod_password_reset powers, preventing resets consumption if actions are taken swiftly. Listing password reset tokens adhoc command: The listing token adhoc command is great to have an idea of : - how many reset tokens there are - for who and when they expire Then you also can use the list of http links to copy and resend a password reset link that you generated but forgot or couldn't copy for various reasons (client crash, browser crash, internet outage, etc...). Kinds regards, eerielili