revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2025-03-08 10:24:48 +01:00
Code Issues Releases Wiki Activity
No description
8021 commits 3 branches 7 tags 154 MiB
PHP 93.5%
JavaScript 4.1%
CSS 2.4%
Find a file
epriestley e56dc8f299 Invalidate outstanding password reset links when users adjust email addresses 
Summary:
Fixes T5506. Depends on D10133. When users remove an email address or change their primary email address, invalidate any outstanding password reset links.

This is a very small security risk, but the current behavior is somewhat surprising, and an attacker could sit on a reset link for up to 24 hours and then use it to re-compromise an account.

Test Plan:
  - Changed primary address and removed addreses.
  - Verified these actions invalidated outstanding one-time login temporary tokens.
  - Tried to use revoked reset links.
  - Revoked normally from new UI panel.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T5506

Differential Revision: https://secure.phabricator.com/D10134
2014-08-04 12:04:23 -07:00
bin Add a bin/hunks script to manage migrations of hunk data 2014-06-03 18:01:23 -07:00
conf Remove @group annotations 2014-07-10 08:12:48 +10:00
externals Update Stripe PHP API 2014-07-13 09:19:07 -07:00
resources Give files uploaded to objects a very restrictive view policy 2014-08-02 14:46:13 -07:00
scripts Allow worker tasks to have priorities 2014-07-12 03:02:06 +10:00
src Invalidate outstanding password reset links when users adjust email addresses 2014-08-04 12:04:23 -07:00
support Return a HTTP 500 instead of a HTTP 400 if an internal error occurs in the Aphlict server 2014-07-18 09:20:00 +10:00
webroot Give files uploaded to objects a very restrictive view policy 2014-08-02 14:46:13 -07:00
.arcconfig Update .arclint in Phabricator for phutil-library lint 2014-05-12 06:01:30 -07:00
.arclint Rename Conduit classes 2014-07-25 10:54:15 +10:00
.editorconfig Specify config for text editors 2012-11-03 22:34:44 -07:00
.gitignore Update .gitignore. 2014-06-14 11:44:19 -07:00
LICENSE Delete license headers from files 2012-11-05 11:16:51 -08:00
NOTICE Update Phabricator NOTICE file to reflect modern legal circumstances 2014-06-25 13:42:13 -07:00
README Reformat README as Remarkup 2014-07-16 22:10:36 +10:00

README 

Phabricator is an open source collection of web applications which help
software companies build better software.

Phabricator includes applications for:

  - reviewing and auditing source code;
  - hosting and browsing repositories;
  - assembling a party to venture forth;
  - tracking bugs;
  - hiding stuff from coworkers; and
  - also some other things.

You can learn more about the project (and find links to documentation and
resources) [[http://phabricator.org/ | here]].

Phabricator is developed and maintained by [[http://phacility.com/ |
Phacility]]. The first version of Phabricator was originally built at Facebook.

= LICENSE =
Phabricator is released under the Apache 2.0 license except as otherwise noted.