Commit graph

58 commits

Author SHA1 Message Date
Akhil Narang
c5bf0d3f59
fix: prevent user from setting same password on forced reset (#37652)
Co-authored-by: UmakanthKaspa <kaspaumakanth1999@gmail.com>
2026-03-11 18:06:15 +05:30
Raffael Meyer
4983c3fc34
fix: prevent logout due to empty "Password" field (#29158)
* fix: prevent logout due to empty "Password" field

* fix: validate_api_key_secret

- We don't want get decrypted password to raise a ValidationError
- If api_key, api_secret or doc_secret are empty, we want an AuthenticationError
2025-07-28 10:04:10 +05:30
Akhil Narang
26fb2f0db0
fix(password): add sqlite compat
Signed-off-by: Akhil Narang <me@akhilnarang.dev>
2025-04-15 13:59:16 +05:30
Akhil Narang
7af83f6d37
Merge remote-tracking branch 'upstream/develop' into invalid-encr-key-message
* upstream/develop: (1373 commits)
  perf: cache dynamic links map in Redis (#28878)
  fix: Never query `flag_print_sql` in `developer_mode=0` (#28884)
  fix(restore): remove MariaDB view security definers
  fix: sanitize user input during setup wizard
  feat(sanitize_column): improve check
  refactor: make optimizations.py private entirely (#28872)
  fix(site_cache): site cache thread safety (#28870)
  chore(printview): change error message
  perf: speedup `frappe.call` by ~8x (#28866)
  test: reduce noise in test output (#28862)
  chore: spelling_invalid_values (#28858)
  fix: Remove misleading os.O_NONBLOCK flag (#28859)
  fix: string replacement in error logger
  perf(gthread): Pin web workers to a single core (#28854)
  fix: MariaDBDatabase.get_tables() should not query the entire database schema (#28846)
  fix: add strings and fields to translation
  fix: typo in test controller boilerplate
  perf: faster add_to_date (#28843)
  perf(version): Make get_versions fast for autoincrement doctypes (#28847)
  refactor: log in monitor as well
  ...
2024-12-24 12:36:33 +05:30
Akhil Narang
6b9960ca5c
chore: update message
Signed-off-by: Akhil Narang <me@akhilnarang.dev>
2024-12-24 12:35:19 +05:30
barredterra
21060acddc fix: handle missing encryption key 2024-11-07 19:05:34 +01:00
Faris Ansari
92403db32a fix: better error message 2024-11-06 16:35:02 +05:30
Akhil Narang
c2001919a5
chore(decrypt): mention the key in error if specificed
This would allow the user to know which key is failing, and just update that if required

Signed-off-by: Akhil Narang <me@akhilnarang.dev>
2024-09-16 12:51:49 +05:30
Akhil Narang
1032d9b4da
chore: include a link to FC docs regarding what to do with encryption key for restored sites
Signed-off-by: Akhil Narang <me@akhilnarang.dev>
2024-03-07 12:12:05 +05:30
Akhil Narang
762290db9a
chore: don't delete keys that aren't used
Signed-off-by: Akhil Narang <me@akhilnarang.dev>
2024-02-19 14:28:35 +05:30
Ankush Menat
a25e68a763
fix: make rate_limiter respect multitenancy (#24634)
* fix: make rate_limiter respect multitenancy

* fix: lower rate limit window for password reset

* refactor: Use redis_wrapper
2024-01-31 09:16:27 +00:00
barredterra
b553ed98d8 refactor: inline immediately returned variable
Inline a variable to a return in the case when the
variable being declared is immediately returned
2023-08-08 18:09:49 +02:00
Ankush Menat
fb11b5a1b0 fix(UX): better error message for Encryption key 2023-06-23 12:40:42 +05:30
Ankush Menat
bd60c60d4e refactor!: remove legacy password hashing
It's been 5+ years, no need to add this compatibility layer anymore.
2023-06-13 16:00:43 +05:30
Ankush Menat
fa6dc03cc8
refactor: frappe.cache() usage to frappe.cache (#21282) 2023-06-08 11:47:17 +05:30
Richard Case
0e6e2609b5 fix: unhelpful error message (#19666) 2023-01-23 14:48:27 +05:30
aissa-berrachiche
bfaadfd32d
fix: passwords are updated on every login (#19594)
Co-authored-by: aberrachiche <aberrachiche@aas.com.sa>
2023-01-16 11:06:05 +05:30
Ankush Menat
81b37cb7d2
refactor: clean up code to py310 supported features (#17367)
refactor: clean up code to py39+ supported syntax

- f-strings instead of format
- latest typing support instead of pre 3.9 TitleCase
- remove UTF-8 declarations.
- many more changes

Powered by https://github.com/asottile/pyupgrade/ + manual cleanups
2022-07-01 11:51:05 +05:30
Gavin D'souza
7e346933c7 fix: Cleaner error message on invalid encryption_key 2022-06-09 16:45:23 +05:30
Suraj Shetty
c0c5b2ebdd
style: format all python files using black (#16453)
Co-authored-by: Frappe Bot <developers@frappe.io>
2022-04-12 10:59:25 +05:30
Gavin D'souza
fb42d9f68c refactor: Query Builder over Raw SQL
Converted 3 (1 multisql + 2 simple updates) raw queries in frappe.utils.password
2021-09-14 18:37:13 +05:30
Gavin D'souza
713eaf6ac9 chore: Raise NotImplementedError in base Database class
Methods that have to be overridden should throw NoteImplementedError.
Helps during development :')
2021-09-14 18:36:01 +05:30
Gavin D'souza
f1c29a16eb fix: Invalid translation string 2021-09-14 14:52:05 +05:30
Gavin D'souza
53f92e5b5c refactor: Use Query Builder instead of raw queries 2021-09-14 14:50:26 +05:30
Gavin D'souza
1545ad65d1 fix: Don't need postgres to use Frappe
* Made code DRY-er by using obscure frappe.db.is_data_too_long
* Python would run psycopg import line which would check if postgres is
  installed. Sites just wanting to chill w MariaDB would also need
  Postgres to be installed to get Frappe running. Fixes https://github.com/frappe/frappe/issues/14193
2021-09-14 13:06:59 +05:30
Gavin D'souza
3446026555 chore: Update header: license.txt => LICENSE
The license.txt file has been replaced with LICENSE for quite a while
now. INAL but it didn't seem accurate to say "hey, checkout license.txt
although there's no such file". Apart from this, there were
inconsistencies in the headers altogether...this change brings
consistency.
2021-09-03 12:02:59 +05:30
Aradhya-Tripathi
84ff1d0af9 style: removed frappe.db.sql comments 2021-07-28 13:48:01 +05:30
Aradhya-Tripathi
538ef2168b fix: removed wrong queries 2021-07-24 22:58:12 +05:30
Aradhya-Tripathi
2f3371d873 refactor: Moved raw queries to frappe orm 2021-07-23 23:14:24 +05:30
Aradhya-Tripathi
1204ae8ce4 fix: fixed spacing and ui tests 2021-07-23 10:45:54 +05:30
Aradhya-Tripathi
8887836820 refactor: Moved util queries to
frappe orm
2021-07-21 23:31:15 +05:30
Gavin D'souza
2ad9d202cb Merge branch 'develop' of github.com:frappe/frappe into drop-py2-code 2021-06-03 11:21:55 +05:30
Abhishek Balam
464e93a405
fix: Allow only use of Fernet generated key for using custom encryption_key (#13399)
* fix: only allow keys generated by fernet in encrypt()/decrypt()

* fix: sider and semgrep fixes
2021-06-01 21:32:32 +05:30
Abhishek Balam
f15edd21d1 feat: enable use of custom encryption_key in encrypt()/decrypt() 2021-06-01 19:41:18 +05:30
Gavin D'souza
e2ee75e3cb fix: Translate strings passed in frappe.throw
* Remove trailing whitespaces in translatable strings
* Sort imports appropriately
2021-05-27 13:47:21 +05:30
Gavin D'souza
e407b78506 chore: Drop dead and deprecated code
* Remove six for PY2 compatability since our dependencies are not, PY2
  is legacy.
* Removed usages of utils from future/past libraries since they are
  deprecated. This includes 'from __future__ ...' and 'from past...'
  statements.
* Removed compatibility imports for PY2, switched from six imports to
  standard library imports.
* Removed utils code blocks that handle operations depending on PY2/3
  versions.
* Removed 'from __future__ ...' lines from templates/code generators
* Used PY3 syntaxes in place of PY2 compatible blocks. eg: metaclass
2021-05-26 15:31:29 +05:30
Suraj Shetty
efba586054
Merge branch 'develop' into remove-password 2021-04-02 09:46:57 +05:30
Faris Ansari
bcb01f6491 fix: Remove encrypted password when it is unset 2021-04-01 17:48:20 +05:30
leela
1f6f02fd5a fix: Track 2FA OTP attempts using login tracker 2021-03-31 12:49:31 +05:30
leela
de210260a7 refactor: allow callable limit arg for ratelimit deco
As we make all configurations editable through dashboard(ex: password_reset_limit), it makes sense
to provide limit as a callable so that it can be accessed dynamically.
2021-03-09 13:59:49 +05:30
Saurabh
ae31f08f42
feat(user): Add hourly limit for password reset requests (#11371)
Co-authored-by: Chinmay D. Pai <chinmaydpai@gmail.com>
Co-authored-by: Suraj Shetty <13928957+surajshetty3416@users.noreply.github.com>
2020-09-14 12:19:06 +05:30
Raffael Meyer
0bfba240cf
feat: allow long passwords (#11065)
Co-authored-by: Chinmay Pai <chinmaydpai@gmail.com>
2020-08-12 16:09:59 +05:30
Mangesh-Khairnar
feba8878d9 fix: increase the length of the password to maximum possible under current structure 2020-04-16 14:26:55 +05:30
Rushabh Mehta
2e6a202652 Postgres support for Frappe (#5919)
* [start] postgres

* [wip] started refactoring db_schema

* Add psycopg2 to requirements.txt

* Add support for Postgres SQL

- Separate frameworkSQL, database, schema, setup_db file for
mariaDB and postgres
- WIP

* Remove quotes from sql to make it compatible with postgres as well

* Moved some code from db_schema to database.py

* Move code from db_schema to schema.py

Add other required refactoring

* Add schema chages

* Remove redundant code in file

* Add invalid column name exception class to exceptions.py

* Add back tick in query wherever needed and replace ifnull with coalesce

* Update get_column_description code in database.py file

* Remove a print statement

* Add keys to get on_duplicate query

* Add bactick wherever necessary

- Remove db_schema.py file

* Remove DATE_SUB as it is incompatible with postgres

- Fix prepare_filter_condition

* Add backtick and quotes wherever necessary
- Move get_database_size to frappe.db namespace
- fix some left out bugs and errors

* Add code to create key and unique index
- added mysql and posgres in their respective database.py

* Add more bacticks in queries and fix some errors
- Pass keys to on_duplicate_update method
- Replace MONTH with EXTRACT function
- Remove DATEDIFF and CURDATE usage

* Cast state value to int in toggle_two_factor_auth
- since two_factor_auth has the datatype of Int

* Refactor
- Replace Timediff with normal arithmetic operator
- Add MAX_COLUMN_LENGTH
- Remove Redundant code
- Add regexp character constant
- Move create_help_table to database.py
- Add get_full_text_search_condition method
- Inherit MariaDBTable from DBTable

* Replace Database instance with get_db method

* Move db_manager to separate file

* Refactor
- Remove some unwanted code
- Separate alter table code for postgres and mysql
- Replace data_type with column_type in database.py

* Make fulltext search changes in global_search.py

* Add empty string check

* Add root_password to site config

* Create cli command for postgres console

* Move setup of help database to setup_db.py

* Add get_database_list method

* Fix exception handling
- Replace bad_field handler with missing_column handler

* Fix tests and sql queries

* Fix import error

* Fix typo db -> database

* Fix error with make_table in help.py

* Try test for postgres

* Remove pyhton 2.7 version to try postgres travis test

* Add test fixes

* Add db_type to the config of test_site_postgres

* Enable query debug to check the reason for travis fail

* Add backticks to check if the test passes

* Update travis.yml
- Add postgres addon

* Try appending 'd_' to hash for db_name
- since postgres does not support dbname starting with a number

* Try adding db_type for global help to make travis work

* Add print statements to debug travis failure

* Enable transaction and remove debug flag

* Fix help table creation query (postgres)

* Fix import issue

* Add some checks to prevent errors
- Some doctypes used to get called even before they are created

* Try fixes

* Update travis config

* Fix create index for help table

* Remove unused code

* Fix queries and update travis config

* Fix ifnull replace logic (regex)

* Add query fixes and code cleanup

* Fix typo
- get_column_description -> get_table_columns_description

* Fix tests
- Replace double quotes in query with single quote

* Replace psycopg2 with psycopg2-binary to avoid warnings
- http://initd.org/psycopg/docs/install.html#binary-install-from-pypi

* Add multisql api

* Add few multisql queries

* Remove print statements

* Remove get_fulltext_search_condition method and replace with multi query

* Remove text slicing in create user

* Set default for 'values' argument in multisql

* Fix incorrect queries and remove few debug flags
- Fix multisql bug

* Force delete user to fix test
- Fix Import error
- Fix incorrect query

* Fix query builder bug

* Fix bad query

* Fix query (minor)

* Convert boolean text to int since is_private has datatype of int
- Some query changes like removed double quotes
and replace with interpolated string to pass multiple
value pass in one of the query

* Extend database class from an object to support python 2

* Fix query
- Add quotes around value passed to the query for variable comparision

* Try setting host_name for each test site
- To avoid "RemoteDisconnected" error while testing data migration test
- Update travis.yml to add hosts
- Remove unwanted commit in setup_help_database

* Set site hostname to data migration connector (in test file)
- To connect the same site host

* Fix duplicate entry issue
- the problem is in naming series file.
In previous commits I unknowingly changed a part of a series query
due to which series were not getting reset

* Replace few sql queries with orm methods

* Fix codacy

* Fix 'Doctype Sessions not found' issue

* Fix bugs induced during codacy fixes

* Fix Notification Test

- Use ORM instead of raw sql

* Set Date fallback value to 0001-01-01

- 0000-00-00 is invalid date in Postgres
- 0001-01-01 works in both

* Fix date filter method

* Replace double quotes with single quote for literal value

* Remove print statement

* Replace double quotes with single

* Fix tests

- Replace few raw sql with ORM

* Separate query for postgres

- update_fields_to_fetch_query

* Fix tests

- replace locate with strpos for postgres

* Fix tests

- Skip test for datediff
- convert bytes to str in escape method

* Remove TestBot

* Skip fieldname extraction

* Replace docshare raw sql with ORM

* Fix typo

* Fix ancestor query test

* Fix test data migration

* Remove hardcoded hostname

* Add default option and option list for db_type

* Remove frappe.async module

* Remove a debug flag from test

* Fix codacy

* fix import issue

* Convert classmethod to static method

* Convert few instance methods to static methods

* Remove some unused imports

* Fix codacy

- Add exception type
- Replace few instance methods with static methods
- Remove unsued import

* Fix codacy

* Remove unused code

* Remove some unused codes

- Convert some instance methods to static function

* Fix a issue with query modification

* Fix add_index query

* Fix query

* Fix update_auth patch

* Fix a issue with exception handling

* Add try catch to a reload_doc

* Add try-catch to file_manager_hook patch

* import update_gravatar to set_user_gravatar patch

* Undo all the wrong patch fixes

* Fix db_setup code 😪
- previously it was not restoring db from source SQL
which is why few old patched were breaking
(because they were getting different schema structure)

* Fix typo !

* Fix exception(is_missing_column) handling

* Add deleted code
- This code is only used in a erpnext patch.
Can be moved to that patch file

* Fix codacy

* Replace a mariadb specific function in a query used in validate_series

* Remove a debug flag

* Revert changes (rename_parent_and_child)

* Fix validate_one_root method

* Fix date format issue

* Fix codacy
- Disable a pylint for variable argument warning
- Convert an instance method to static method

* Add bandit.yml

The Codacy seems to use Bandit which generates
warning for every subprocess import and its usage during pytest
Since we have carefully used subprocess (avoided user input),
warnings needs to be avoided.
This can be removed if we have any alternative for subprocess usage.

* Skip start_process_with_partial_path check

* Fix typo

* Add python 2.7 test

* Move python versions in travis.yml

* Add python versions to jobs

* Overwrite python version inheritance for postgres in travis.yml

* Add quotes around python version in .travis.yml

* Add quotes around the name of the job

* Try a travis fix

* Try .travis.yml fix

* Import missing subprocess

* Refactor travis.yml

* Refactor travis.yml
- move install and tests commands to separate files
- Use matrix to build combination of python version and db type

* Make install.sh and run-tests.sh executable

* Add sudo required to travis.yml to allow sudo cmmands in shell files

* Load nvm

* Remove verbose flag from scripts

* Remove command-trace-print flag

* Change to build dir in before script

* Add absolute path for scripts

* Fix tests

* Fix typo

* Fix codacy
- fixes - "echo won't expand escape sequences." warning

* Append (_) underscore instead of 'd' for db_name

* Remove printf and use mysql execute flag
2018-09-21 10:20:48 +05:30
Saurabh
176f3b6a15 Resolved merge conflicts 2018-07-18 16:20:06 +05:30
rohitwaghchaure
6f84e922f8 [Fix] Brute force security (#5785)
* [Fix] Brute force security

* Added patch and change the error message

* Added test case
2018-07-11 11:14:05 +05:30
Ameya Shenoy
dc8af84563 Login fix for python3 (#5529)
decode bytes to string
2018-05-04 18:36:27 +05:30
Rushabh Mehta
b42e8f1210
Update password.py 2018-04-16 15:00:21 +05:30
Tom Price
cf6fcce961 Fix PR issues from #5200.
Fix issue with with rebase messing up patches.txt.

Change auth parameter back to user.
2018-04-11 09:01:57 +01:00
Tom Price
e641ae70bd Migrate password hashing away from mysql password()
This is deprecated and needs to be replaced. 
Use passlib to hash, store, verify and upgrade as necessary.
Includes patch to migrate existing passwords in a non-breaking way.

Fixes #5195
2018-04-09 12:26:48 +01:00