2 commits

Author	SHA1	Message	Date
Earl Warren	0944a4442c	[GITEA] silently ignore obsolete sudo scope ... Fixes: https://codeberg.org/forgejo/forgejo/issues/820 (cherry picked from commit 6a7022ebbb) (cherry picked from commit 764eac47b5) (cherry picked from commit 1141eb7b6f) (cherry picked from commit 826b6509b6) (cherry picked from commit 9990d932b8) (cherry picked from commit 7eca570743) (cherry picked from commit 66e1d3f082) (cherry picked from commit 188226a8e6) (cherry picked from commit 4cd1bff25c) (cherry picked from commit fad6b6d2c4) (cherry picked from commit 5b25c3d851) (cherry picked from commit 4746ece4dd) (cherry picked from commit 2a6f85afb3) (cherry picked from commit c027d724ee) (cherry picked from commit be2f1eeaeb) (cherry picked from commit 3058a54fe9) (cherry picked from commit 53936d38a0) (cherry picked from commit 311983cc97) (cherry picked from commit 1651ae757b) (cherry picked from commit d3dd8ea24d) (cherry picked from commit 9a80326ff3) (cherry picked from commit 66eb33235e) (cherry picked from commit 769e24d5a8) (cherry picked from commit 436cc21217) (cherry picked from commit 817faca7f0) (cherry picked from commit 80ee08aef1) (cherry picked from commit 15f8885d0c)	2023-12-18 16:32:02 +01:00
KN4CK3R	c6c829fe3f	Enhanced auth token / remember me (#27606) ... Closes #27455 > The mechanism responsible for long-term authentication (the 'remember me' cookie) uses a weak construction technique. It will hash the user's hashed password and the rands value; it will then call the secure cookie code, which will encrypt the user's name with the computed hash. If one were able to dump the database, they could extract those two values to rebuild that cookie and impersonate a user. That vulnerability exists from the date the dump was obtained until a user changed their password. > > To fix this security issue, the cookie could be created and verified using a different technique such as the one explained at https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies. The PR removes the now obsolete setting `COOKIE_USERNAME`.	2023-10-14 00:56:41 +00:00

Renamed from models/auth/token_scope_test.go (Browse further)