Completed the implementation of the aforementioned environment setting into the OAuth workflows.
Documented the aforementioned setting in the Environment-variables.md wiki document.
The dashboard.domains_custom route was hardcoded to either return all
the domains, or at most 100, regardless of default_domain_table_size
setting.
Make this limit be dependent on default_domain_table_size instead.
The API will now limit to 100 or default_domain_table_size, whichever
one is higher. This is done to not break any seconday use-cases that
might depend on the hardcoded setting.
Previous behavior required the specification of all three group security groups before the
"Save Settings" button would be enabled.
This adds a check into users.py which checks that the group is set before searching and
removes the javascript preventing the specification of any combination of groups.
Tested:
- Tested all combinations on AD after MR 1238
- Tested all combinations on OpenLDAP
- Tested enabling the Group Security with no groups set which correctly prevents login
Resolves#1462
It seems when logging in and logging out, then logging back in, setting
the session timeout to 5 minutes, then waiting for expiry can cause
a situation when using SQLA-based sessions which results in a NULL field
in the database and causes a persistent 500 Internal Server Error.
As per issue 1439 here is a fix found by @raunz.
Resolves#1439.
Tested for about 8 hours and tons and tons of expired sessions, could not
reproduce with the fix applied.
Currently passing an invalid Basic auth header (random string base64 encoded) would result in an exception being raised due to a username, password = auth_header.split().
Similary passing a `Digest` authentication type would result in an exception as there is no :.
Thirdly passing invalid base64 encoded UTF-8 code sequences would result in exceptions as this issue (#1424).
I added code to check explicitly that we are doing basic authentication then by checking the number of entries returned by the split.
I also added exception handling for invalid UTF-8 code sequence exceptions.
Tested with a fuzzer.
Tested with valid and invalid credentials.
This fixes#1424.
Currently passing an invalid Basic auth header (random string base64 encoded) would result in an
exception being raised due to a `username, password = auth_header.split()`.
I refactored the code in this decorator by checking explicitly that we are doing basic authentication
then by checking the number of entries returned by the split.
I also added exception handling for invalid UTF-8 code sequences.
Tested with a fuzzer.
Tested with valid and invalid credentials.
This fixes#1447.
