feat: Reset password email and 'Forgot password' solution #1566

runoutnow · 2021-02-10T06:08:07Z

Description

The new function (at the moment only for Mysql!) can be turned on and off in config.py: EMAIL_PROT = True|False. Default is False so people who don't got an Email protocol available can keep changing their passwords.

Reset password-button
When EMAIL_PROT is turned on the "reset password-button" won't forward to the "change-password-form", instead it will create an unique hash and send an Email to the known Email-address with an unique url. After confirmation of this email the user has got 15 minutes to change the password. In those 15 minutes it is not possible to send another email with a link. After changing the password or when the 15 minutes have been passed the user is unable to visit the "change password-form".
The process can be restarted by clicking the "reset password-button" again. :-)

This way the user must have access to the known Emailaddress in order to change a password. So if a password has been stolen it can not be changed by the attacker... unless the emailaddress has also been hacked.

N.B.
If you have build the possibility to let a user change his/her Emailaddress, then the only way to make the new code effective is to send an Email with an “ack-change”-link to the new Emailaddress AND the old Emailaddress. So the attacker is not able to change the Emailaddress (and indirectly is still able to change the password then).

Forgot password
When EMAIL_PROT = True there will also appear a "Forgot my password" url in the login_db.html.
The user can then fill in the emailaddress which will receive a link to reset the password.
The "change password-form" can only be visited for 15 minutes and requires the unique hash in the url.

ADDITIONAL INFORMATION

Has associated issue:
Is CRUD MVC related.
Is Auth, RBAC security related.
Changes the security db schema.
[x ] Introduces new feature
Removes existing feature

The f-string was wrong

…st where multiple processes/workers are available Problem: '2013. Lost connection to MySQL server during query' error when there are two processes (workers) available. The problem is automatically solved by SQLAlchemy, but when you visit a view which got the @has_access decorator flask_appbuilder.security.manager.load_user is used which uses flask_appbuilder.security.sqla.manager. def get_user_by_id and that transaction can not be rolled back. This raises the OperationalError 2013, 'Lost connection to MySQL server during query': Can be reproduced by: resetting the webserver... the 2nd or 3th time you refresh the browser the error will raise

Problem: '2013. Lost connection to MySQL server during query' error when there are multiple processes (workers) available. The problem is automatically solved by SQLAlchemy, but when you visit a view which got the @has_access decorator flask_appbuilder.security.manager.load_user is used which uses flask_appbuilder.security.sqla.manager. def get_user_by_id and that transaction can not be rolled back. This raises the OperationalError 2013, 'Lost connection to MySQL server during query': Can be reproduced by: resetting the webserver... the 2nd or 3th time you refresh the browser the error will raise

fix: [multiple workers] causing a fatal error

Extended with UserResetPassword for sending a unique hash to the Email of the user

Extended with ForgotMyPasswordForm for sending an unique hash to the Email of the user

Template for sending the Email with the reset_hash to the user

dpgaspar · 2021-03-01T11:44:01Z

@runoutnow

Left a couple of tips here: https://github.com/dpgaspar/Flask-AppBuilder/pull/1579/files

see if it works for you.

Also black is complaining

would reformat /home/runner/work/Flask-AppBuilder/Flask-AppBuilder/flask_appbuilder/const.py
would reformat /home/runner/work/Flask-AppBuilder/Flask-AppBuilder/flask_appbuilder/security/views.py
would reformat /home/runner/work/Flask-AppBuilder/Flask-AppBuilder/flask_appbuilder/tests/test_mvc.py
All done! 💥 💔 💥
3 files would be reformatted, 80 files would be left unchanged.

runoutnow · 2021-03-02T08:21:38Z

@runoutnow

Left a couple of tips here: https://github.com/dpgaspar/Flask-AppBuilder/pull/1579/files

see if it works for you.

Also black is complaining

would reformat /home/runner/work/Flask-AppBuilder/Flask-AppBuilder/flask_appbuilder/const.py
would reformat /home/runner/work/Flask-AppBuilder/Flask-AppBuilder/flask_appbuilder/security/views.py
would reformat /home/runner/work/Flask-AppBuilder/Flask-AppBuilder/flask_appbuilder/tests/test_mvc.py
All done! 💥 💔 💥
3 files would be reformatted, 80 files would be left unchanged.

Thanks I will try that later.
I was trying to fix the flake8 errors, but it seems like your configuration is custom... I have installed flake8

Locally I don't got "wrong order" errors, which I do have when I run the test on github.
Also Locally I have got the "E501 line too long (83 > 79 characters)" errors, and those errors won't appear on github

Can you share the settings of flake8? Thanks

dpgaspar · 2021-03-02T08:49:43Z

@runoutnow
Left a couple of tips here: https://github.com/dpgaspar/Flask-AppBuilder/pull/1579/files
see if it works for you.
Also black is complaining
would reformat /home/runner/work/Flask-AppBuilder/Flask-AppBuilder/flask_appbuilder/const.py
would reformat /home/runner/work/Flask-AppBuilder/Flask-AppBuilder/flask_appbuilder/security/views.py
would reformat /home/runner/work/Flask-AppBuilder/Flask-AppBuilder/flask_appbuilder/tests/test_mvc.py
All done! 💥 💔 💥
3 files would be reformatted, 80 files would be left unchanged.
Thanks I will try that later.
I was trying to fix the flake8 errors, but it seems like your configuration is custom... I have installed flake8

Locally I don't got "wrong order" errors, which I do have when I run the test on github.

Also Locally I have got the "E501 line too long (83 > 79 characters)" errors, and those errors won't appear on github

Can you share the settings of flake8? Thanks

Take a look at:
https://github.com/dpgaspar/Flask-AppBuilder/blob/master/.github/workflows/ci.yml#L33
and:
https://github.com/dpgaspar/Flask-AppBuilder/blob/master/.flake8

So it should just work running flake8 flask_appbuilder, are your requirements from requirements.txt and requirements-dev.txt? Maybe it's time to get all this on pre-commit

runoutnow · 2021-03-02T09:00:05Z

Take a look at:
https://github.com/dpgaspar/Flask-AppBuilder/blob/master/.github/workflows/ci.yml#L33
and:
https://github.com/dpgaspar/Flask-AppBuilder/blob/master/.flake8

So it should just work running flake8 flask_appbuilder, are your requirements from requirements.txt and requirements-dev.txt? Maybe it's time to get all this on pre-commit

I had installed black and flake8 manually... Then I saw the requirements*.txt and installed those... but that didn't make a difference. I am sure it will work when I have flake8 configured with https://github.com/dpgaspar/Flask-AppBuilder/blob/master/.flake8 is what I needed...

haha I would love to have a pre-commit option... I am going to search for it... If I need to change 3 files, it's going to start the tests 3 times and ofcourse 3 lovely emails 😄

RosterIn · 2021-04-05T10:23:07Z

hi, any updates on the progress ?

runoutnow · 2021-04-07T20:33:39Z

hi, any updates on the progress ?

Hello,
Unfortunately not, it is on my todo list, but I don't got time for it at the moment.
It's not something I can do in between as I am complete new into Github and writing tests.

I need to setup and find the right commando's to collect py files and commit them to a certain pull request.
I have been able to add files to the git map, but haven't been able to do a commit (as a test) from bash to github.
About writing the tests... I haven't looked into that yet as I was setting up Github first.

I guess it will easily take a few months before I am able to start looking into this, sorry.
But the code works.... just copy it into your flaskappbuilder python files and you can start using it if you want.

fixed "forbidden_msg"

MaximSlagter · 2022-01-18T17:32:50Z

@runoutnow, are there any updates for this issue? :)

runoutnow · 2022-01-20T09:22:01Z

@runoutnow, are there any updates for this issue? :)

Unfortunately not as I haven’t looked into it anymore. The code is working, I am using it for a year already.
But there are no working tests written.

Today I’ve looked into it again, but the standard tests which I didn’t write are failing already.
Somehow it tries to add the same users multiple times which causes an integrity error, also when I remove app.db

For me it’s also annoying that I am stuck with this feature as I now am no longer able to update flask_appbuilder normally anymore. In order to keep the “forgot password” feature I have to manually replace the files in the flask_appbuilder directory.

Perhaps someone can assist me with writing the tests?
Another option (for me) is to get the code for this feature out of fab so I can easily update fab again while I still can use the features of this pull request. However it has always been my intention to give something back to the people who has contributed to fab.

test fail.pdf

runoutnow · 2022-01-20T10:01:27Z

Removed the db and started with
nosetests -v flask_appbuilder.tests.test_0_fixture

Resulted into way less errors for
nosetests -v flask_appbuilder.tests.test_mvc
Ran 50 tests in 40.548s
FAILED (errors=1, failures=4)

What is the right order to make the tests succesful? =]

stale · 2022-04-27T23:40:48Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Feel free to reopen it if it's still relevant to you. Thank you

runoutnow added 30 commits November 11, 2020 11:31

Update baseviews.py

c579619

The f-string was wrong

Update baseviews.py

235bf9c

Update baseviews.py

99dc254

Merge pull request #1 from runoutnow/fix-connection-multiple-workers

6dc0c48

fix: [multiple workers] causing a fatal error

Delete manager.py

875e3db

If thought I was deleting manager.py from the commit.. 😬

a18088e

Update manager.py

6b63fdd

Merge branch 'master' into master

af7e0c1

Merge branch 'master' into master

a4b5b4d

Merge branch 'master' into master

89c7dc2

Update manager.py

1a8e416

Update manager.py

314bd09

Update models.py

18a50d9

Extended with UserResetPassword for sending a unique hash to the Email of the user

Update security/forms.py

8d3e6be

Extended with ForgotMyPasswordForm for sending an unique hash to the Email of the user

Update manager.py

1c0c452

Update models.py

0bf12dc

Update manager.py

2c9fa51

Update views.py

5ada741

Update const.py

f17d651

Update login_db.html

7b9ae10

Create resetpw_mail.html

09302f6

Template for sending the Email with the reset_hash to the user

[feature] add functions for password reset_hash

35b0734

[feature] add model for password reset_hash function

0648516

[feature] updated for password reset_hash function

d0b6e8d

[feature] updated for password reset_hash function

083cf48

[feature] updated for password reset_hash function

abe7425

Update manager.py

30796d9

Update manager.py

cc45130

Update test_mvc.py

9e4c7e9

runoutnow added 7 commits March 2, 2021 08:37

black style

b6fb2f4

black style

7e2ce26

black style

5d23ef7

flake8 update views.py

a9e9257

flake8 fix sqla/manager.py

fa64d38

flake 8 security/views.py

1d77de3

flake8 sqla/manager.py

8c2d622

Merge branch 'master' into runoutnow-resetpassword_sendemail

e4b7e6b

runoutnow added 4 commits April 8, 2021 08:35

Merge branch 'master' into runoutnow-resetpassword_sendemail

d565cdf

Update views.py

109b6a4

fixed "forbidden_msg"

Merge branch 'master' into runoutnow-resetpassword_sendemail

31b3ecd

Merge branch 'master' into runoutnow-resetpassword_sendemail

8e2d4b0

runoutnow added 2 commits January 20, 2022 19:54

Enhanced fault handling

262bc3a

Merge branch 'master' into runoutnow-resetpassword_sendemail

653b4be

stale bot added the stale label Apr 27, 2022

Merge branch 'master' into runoutnow-resetpassword_sendemail

19c0540

stale bot removed the stale label Apr 15, 2023

runoutnow marked this pull request as ready for review April 15, 2023 15:00

runoutnow marked this pull request as draft April 15, 2023 15:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Reset password email and 'Forgot password' solution #1566

feat: Reset password email and 'Forgot password' solution #1566

runoutnow commented Feb 10, 2021 •

edited

Loading

dpgaspar commented Mar 1, 2021

runoutnow commented Mar 2, 2021

dpgaspar commented Mar 2, 2021 •

edited

Loading

runoutnow commented Mar 2, 2021

RosterIn commented Apr 5, 2021

runoutnow commented Apr 7, 2021

MaximSlagter commented Jan 18, 2022 •

edited

Loading

runoutnow commented Jan 20, 2022

runoutnow commented Jan 20, 2022 •

edited

Loading

stale bot commented Apr 27, 2022

feat: Reset password email and 'Forgot password' solution #1566

Are you sure you want to change the base?

feat: Reset password email and 'Forgot password' solution #1566

Conversation

runoutnow commented Feb 10, 2021 • edited Loading

Description

ADDITIONAL INFORMATION

dpgaspar commented Mar 1, 2021

runoutnow commented Mar 2, 2021

dpgaspar commented Mar 2, 2021 • edited Loading

runoutnow commented Mar 2, 2021

RosterIn commented Apr 5, 2021

runoutnow commented Apr 7, 2021

MaximSlagter commented Jan 18, 2022 • edited Loading

runoutnow commented Jan 20, 2022

runoutnow commented Jan 20, 2022 • edited Loading

stale bot commented Apr 27, 2022

runoutnow commented Feb 10, 2021 •

edited

Loading

dpgaspar commented Mar 2, 2021 •

edited

Loading

MaximSlagter commented Jan 18, 2022 •

edited

Loading

runoutnow commented Jan 20, 2022 •

edited

Loading