femsci/forgejo
femsci/forgejo
1
0
Fork 0
forked from NYANDEV/forgejo
Code Pull requests Activity
forgejo/modules
History
6543 3e5c844a77
fix pam authorization (#19040) (#19047) 
Backport #19040 

The PAM module has previously only checked the results of the authentication module.

However, in normal PAM practice most users will expect account module authorization to also be checked. Without doing this check in almost every configuration expired accounts and accounts with expired passwords will still be able to login.

This is likely to represent a significant gotcha in most configurations and cause most users configurations to be potentially insecure. Therefore we should add in the account authorization check.

## ⚠️ **BREAKING** ⚠️ 

Users of the PAM module who rely on account modules not being checked will need to change their PAM configuration.

However, as it is likely that the vast majority of users of PAM will be expecting account authorization to be checked in addition to authentication we should make this breaking change to make the default behaviour correct for the majority.

---

I suggest we backport this despite the BREAKING nature because of the surprising nature of this.

Thanks to @ysf for bringing this to our attention.


Co-authored-by: zeripath <art27@cantab.net>
Co-authored-by: ysf <34326+ysf@users.noreply.github.com>
2022-03-10 08:15:35 +00:00
..
activitypub Create pub/priv keypair for federation (#17071) 2021-09-28 15:19:22 -04:00
analyze Use git attributes to determine generated and vendored status for language stats and diffs (#16773) 2021-09-09 21:13:36 +01:00
appstate Decouple unit test code from business code (#17623) 2021-11-12 22:36:47 +08:00
auth fix pam authorization (#19040) (#19047) 2022-03-10 08:15:35 +00:00
avatar Fix various typos (#18219) 2022-01-10 17:32:37 +08:00
base Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
cache Test cache during init (#17852) 2021-12-06 00:24:57 +08:00
charset Don't treat BOM escape sequence as hidden character. (#18909) (#18910) 2022-02-26 23:15:04 +01:00
context Refactor admin user filter query parameters (#18965) (#18975) 2022-03-02 19:57:18 +01:00
convert Add MirrorUpdated field to Repository API type (#18267) 2022-01-18 13:18:30 +00:00
csv Fix various typos (#18219) 2022-01-10 17:32:37 +08:00
doctor Fix various typos (#18219) 2022-01-10 17:32:37 +08:00
emoji Run processors on whole of text (#16155) 2021-06-17 11:35:05 +01:00
eventsource Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
generate Support webauthn (#17957) 2022-01-14 16:03:31 +01:00
git Don't show context cancelled errors in attribute reader (#19006) (#19027) 2022-03-08 19:20:37 +08:00
gitgraph Collaborator trust model should trust collaborators (#18539) (#18557) 2022-02-03 11:20:37 -05:00
graceful Immediately Hammer if second kill is sent (#18823) (#18826) 2022-02-20 01:37:52 +08:00
hcaptcha hCaptcha Support (#12594) 2020-10-02 23:37:53 -04:00
highlight Add .gitattribute assisted language detection to blame, diff and render (#17590) 2021-11-17 20:37:00 +00:00
hostmatcher Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
httpcache Use a variable but a function for IsProd because of a slight performance increment (#17368) 2021-10-20 16:37:19 +02:00
httplib refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
indexer Upgrade bleve from v2.0.6 to v2.3.0 (#18132) 2022-01-01 16:26:27 +08:00
json Move repository model into models/repo (#17933) 2021-12-10 09:27:50 +08:00
lfs Fix source typos (#18227) 2022-01-10 23:46:26 +08:00
log Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
markup Correctly link URLs to users/repos with dashes, dots or underscores (#18890) (#18908) 2022-02-26 06:45:09 +01:00
metrics Refactor auth package (#17962) 2022-01-02 21:12:35 +08:00
migration Fix various typos (#18219) 2022-01-10 17:32:37 +08:00
nosql Adjust error for already locked db and prevent level db lock on malformed connstr (#18923) (#18938) 2022-02-28 15:45:38 +00:00
notification Fix problem when self-assign notification (#18797) (#18976) 2022-03-02 20:11:55 +00:00
options Remove golang vendored directory (#18277) 2022-01-14 18:16:05 -05:00
password Fixed assert statements. (#16089) 2021-06-07 07:27:09 +02:00
pprof refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
private Move keys to models/asymkey (#17917) 2021-12-10 16:14:24 +08:00
process Fix various typos (#18219) 2022-01-10 17:32:37 +08:00
proxy Return nil proxy function if proxy not enabled (#16742) 2021-08-19 16:41:20 -04:00
public Fix mime-type detection for HTTP server (#18371) 2022-01-23 21:17:20 +08:00
queue In disk_channel queues synchronously push to disk on shutdown (#18415) (#18788) 2022-02-22 20:08:35 +08:00
recaptcha refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
references Add API to get issue/pull comments and events (timeline) (#17403) 2022-01-01 22:12:25 +08:00
repository Add GetUserTeams (#18499) (#18531) 2022-02-02 08:40:04 +00:00
secret Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
session Refactor auth package (#17962) 2022-01-02 21:12:35 +08:00
setting Prevent security failure due to bad APP_ID (#18678) (#18682) 2022-02-10 16:17:44 +01:00
ssh Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
storage refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
structs Add MirrorUpdated field to Repository API type (#18267) 2022-01-18 13:18:30 +00:00
svg refactor: move from io/ioutil to io and os package (#17109) 2021-09-22 13:38:34 +08:00
sync Fix missing unlock in uniquequeue (#9790) 2020-01-15 23:58:33 +02:00
templates Remove golang vendored directory (#18277) 2022-01-14 18:16:05 -05:00
test Unify and simplify TrN for i18n (#18141) 2022-01-02 04:33:57 +01:00
timeutil Don't store assets modified time into generated files (#18193) 2022-01-06 21:33:17 -05:00
translation Sort locales according to their names (#18211) 2022-01-08 12:18:39 +00:00
typesniffer Read expected buffer size (#17409) 2021-10-24 22:12:43 +01:00
updatechecker Fix various typos (#18219) 2022-01-10 17:32:37 +08:00
upload Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00
uri Prevent NPE if gitea uploader fails to open url (#18080) 2021-12-23 16:27:33 +00:00
user Add gitea-vet (#10948) 2020-04-05 07:20:50 +01:00
util Increase Salt randomness (#18179) 2022-01-04 15:13:52 +00:00
validation Upgrade chi to v5 (#17298) 2021-10-13 22:50:23 -04:00
web Simplify parameter types (#18006) 2021-12-20 04:41:31 +00:00