Skip to content

Temporary passwords for public non-anonymous protected shares (ie: files shared with an email recipient). #31220

Merged
PVince81 merged 1 commit into
masterfrom
enhancement/31005/temporary-passwords
Apr 12, 2022
Merged

Temporary passwords for public non-anonymous protected shares (ie: files shared with an email recipient). #31220
PVince81 merged 1 commit into
masterfrom
enhancement/31005/temporary-passwords

Conversation

@StCyr

@StCyr StCyr commented Feb 16, 2022

Copy link
Copy Markdown
Contributor

This PR implements #31005

With this change, passwords protecting public non-anonymous shares become temporary: They have an expiration time and a background job changes them to some random undisclosed value when their expiration time is passed.

To request a new temporary password, recipients use a new "request password" button that is added to protected public non-anonymous shares' authentication page. This button serves the same functionality as the "request password" button implemented by Talk (ie: To identify the person requesting the password), except that, here, the person identifies herself by proving she knows the email address with which the file is shared with (ie: she types her email address, and if it matches the email address with which the file is shared the person is considered "identified" and a new temporary password is sent to that email address). Of course, identification via a Talk session takes precedence when the share has its "video verification" attribute checked.

I'm waiting for your reviews and welcome your comments which I hope will be constructive

Cyrille

===============================
UPDATE 20220217:

  1. The existing protected public non-anonymous shares are not impacted by this change (they don't have a password_expiration_time, so the expiration background job doesn't consider them)
  2. The temporary passwords are valid for 1 day.

===============================
UPDATE 20220223:
I've created a new branch: https://github.com/nextcloud/server/tree/enhancement/31005/temporary-passwords-v2

Compared to this branch, this new branch brings the following:

  1. password_expiration_time is now checked during password check. This also makes the expiration background job not necessary anymore;
  2. Temporary passwords validity period is now configurable via a system value

Loading
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants