finn/forgejo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[SECURITY] Notify users about account security changes

Browse source 
- Currently if the password, primary mail, TOTP or security keys are
changed, no notification is made of that and makes compromising an
account a bit easier as it's essentially undetectable until the original
person tries to log in. Although other changes should be made as
well (re-authing before allowing a password change), this should go a
long way of improving the account security in Forgejo.
- Adds a mail notification for password and primary mail changes. For
the primary mail change, a mail notification is sent to the old primary
mail.
- Add a mail notification when TOTP or a security keys is removed, if no
other 2FA method is configured the mail will also contain that 2FA is
no longer needed to log into their account.
- `MakeEmailAddressPrimary` is refactored to the user service package,
as it now involves calling the mailer service.
- Unit tests added.
- Integration tests added.
This commit is contained in:
Gusted 2024-07-23 00:17:06 +02:00
parent ded237ee77
commit 4383da91bd
No known key found for this signature in database
GPG key ID: FD821B732837125F
24 changed files with 543 additions and 116 deletions
Download patch file Download diff file Expand all files Collapse all files

19
options/locale/locale_en-US.ini
View file

@ -498,7 +498,24 @@ register_notify.text_2 = You can sign into your account using your username: %s
register_notify.text_3 = If someone else made this account for you, you will need to <a href="%s">set your password</a> first.
reset_password = Recover your account
reset_password.text = If this was you, please click the following link to recover your account within <b>%s</b>:
reset_password.text_1 = The password for your account was just changed.
password_change.subject = Your password has been changed
password_change.text_1 = The password for your account was just changed.
primary_mail_change.subject = Your primary mail has been changed
primary_mail_change.text_1 = The primary mail of your account was just changed to %[1]s. This means that this e-mail address will no longer receive e-mail notifications for your account.
totp_disabled.subject = TOTP has been disabled
totp_disabled.text_1 = Time-based one-time password (TOTP) on your account was just disabled.
totp_disabled.no_2fa = There are no other 2FA methods configured anymore, meaning it is no longer necessary to log into your account with 2FA.
removed_security_key.subject = A security key has been removed
removed_security_key.text_1 = Security key "%[1]s" has just been removed from your account.
removed_security_key.no_2fa = There are no other 2FA methods configured anymore, meaning it is no longer necessary to log into your account with 2FA.
account_security_caution.text_1 = If this was you, then you can safely ignore this mail.
account_security_caution.text_2 = If this wasn't you, your account is compromised. Please contact the admins of this site.
register_success = Registration successful