mixandClaude Opus 5.5
a37aba6594
Security audit 2026-10-17, finding A2 (high), stage 0; the mockup is
2c27275. A stolen global session could set its own password on the user
form - no current password asked, the session kept - and then pass the
backup's reauth with it, or add a second global user with a known
password. Now the user form calls reauth (the backup's check: bcrypt
against the signed-in user's own hash, under auth.AllowPasswordChange) when
it adds a user and when a save sets a password, changes the e-mail (reset
links go there) or changes the role, the own account included; deleting a
user asks too, refused on its own confirmation page (renderUserDelete, a
Flash on UserDelete). Name and reach alone are not asked. Missing or wrong:
401 on the same page, "Your account password is incorrect.", nothing saved.
Tests: TestUserFormAsksForTheAccountPassword (create, each of password,
e-mail, role, own password, reach alone, delete); the user-form tests send
the field (withAccountPassword gives root a real hash and h an auth
module). go vet, go test ./internal/web/... on Windows.
Docs: security.md § Backup and domain export, guide § Users, help word for
word with the mockup; CHANGELOG [Unreleased] Security; plan line ticked.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
27 lines
1.1 KiB
HTML
27 lines
1.1 KiB
HTML
{{/* Delete a panel user (mockup user-delete.html): what goes with the user, the
|
|
one button that does it, and the way back to the user's form. */}}
|
|
{{define "content"}}
|
|
{{template "page_head" .Head}}
|
|
{{if .Flash}}{{template "flash" .Flash}}{{end}}
|
|
|
|
<div class="columns">
|
|
<div class="column is-7">
|
|
{{template "box_open" .Danger}}
|
|
{{template "body_open"}}
|
|
<p class="mb-3">{{template "inline" .Intro}}</p>
|
|
{{template "confirm_list" .Consequences}}
|
|
<p class="sp-muted mb-4">{{template "inline" .Note}}</p>
|
|
<form method="post" action="{{.Action}}">
|
|
<div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
|
|
<p class="help">The one you sign in with: a session left open must not be enough to remove an administrator.</p></div>
|
|
<div class="buttons">
|
|
<button type="submit" class="button is-danger"><i class="ti ti-trash"></i>{{.Confirm}}</button>
|
|
<a class="button is-text" href="{{.KeepHref}}">Keep it</a>
|
|
</div>
|
|
</form>
|
|
{{template "body_close"}}
|
|
{{template "box_close"}}
|
|
</div>
|
|
</div>
|
|
{{end}}
|