- Update to 3.4.5
* Security Vulnerability Fix. Two CSRF vulnerabilities were
reported: qrcode and login. This release fixes the more severe
of the 2 - the /login vulnerability. The QRcode issue has a
much smaller risk profile since a) it is only for two-factor
authentication using an authenticator app b) the qrcode is only
available during the time the user is first setting up their
authentication app. The QRcode issue has been fixed in 4.0.
* Fixed
- GET on /login and /change could return the callers
authentication_token. This is a security concern since GETs
don't have CSRF protection. This bug was introduced in 3.3.0.
* Backwards Compatibility Concerns. Fix CSRF vulnerability on
/login and /change that could return the callers authentication
token. Now, callers can only get the authentication token on
successful POST calls.
- Update to 3.4.4
* Fix 3 regressions and a couple other bugs
* Fixed
- Basic Auth broken. When the unauthenticated handler was
changed to provide a more uniform/consistent response - it
broke using Basic Auth from a browser, since it always
redirected rather than returning 401. Now, if the response
headers contain WWW-Authenticate (which is set if basic
@auth_required method is used), a 401 is returned. See below
for backwards compatibility concerns.
- As part of figuring out issue 359 - a redirect loop was
found. In release 3.3.0 code was put in to redirect to
:py:data:`SECURITY_POST_LOGIN_VIEW` when GET or POST was
called and the caller was already authenticated. The method
OBS-URL: https://build.opensuse.org/request/show/900215
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=12
- Update to 3.4.2:
* The flask-security repo was moved to a github organization
Flask-Middleware.
- Update to 3.4.1:
* Fix a bunch of bugs in new unified sign in along with a couple
other major issues.
* (:issue:`298`) Alternative ID feature ran afoul of
postgres/psycopg2 finickiness.
* (:issue:`300`) JSON 401 responses had WWW-Authenticate Header
attached - that caused browsers to pop up their own login/password
form. Not what applications want.
* (:issue:`280`) Allow admin/api to setup TFA (and unified sign in)
out of band. Please see :meth:`.UserDatastore.tf_set`,
:meth:`.UserDatastore.tf_reset`, :meth:`.UserDatastore.us_set`,
:meth:`.UserDatastore.us_reset` and
:meth:`.UserDatastore.reset_user_access`.
* (:pr:`305`) We used form._errors which wasn't very pythonic,
and it was removed in WTForms 2.3.0.
* (:pr:`310`) WTForms 2.3.0 made email_validator optional,
we need it.
- Added Requires python-bcrypt and python-email_validator,
Recommends python-PyQRCode, python-SQLAlchemy, python-zxcvbn
and Suggests python-argon2_cffi and python-phonenumbers
* (:pr:`257`) Support a unified sign in feature.
Please see :ref:`unified-sign-in`.
* (:pr:`265`) Add phone number validation class. This is used in
both unified sign in as well as two-factor when using sms.
* (:pr:`274`) Add support for 'freshness' of caller's authentication.
This permits endpoints to be additionally protected by ensuring a
OBS-URL: https://build.opensuse.org/request/show/801217
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=5
* (:pr:`257`) Support a unified sign in feature. Please see :ref:`unified-sign-in`.
* (:pr:`265`) Add phone number validation class. This is used in both unified sign in as well as two-factor when using sms.
* (:pr:`274`) Add support for 'freshness' of caller's authentication. This permits endpoints to be additionally protected by ensuring a recent authentication.
* (:issue:`99`, :issue:`195`) Support pluggable password validators. Provide a default validator that offers complexity and breached support.
* (:issue:`266`) Provide interface to two-factor send_token so that applications can provide error mitigation. Defaults to returning errors if can't send the verification code.
* (:pr:`247`) Updated all-inclusive data models (fsqlaV2). Add fields necessary for the new unified sign in feature and changed 'username' to be unique (but not required).
* (:pr:`245`) Use fs_uniquifier as the default Flask-Login 'alternative token'. Basically this means that changing the fs_uniquifier will cause outstanding auth tokens, session and remember me cookies to be invalidated. So if an account gets compromised, an admin can easily stop access. Prior to this cookies were storing the 'id' which is the user's primary key - difficult to change! (kishi85)
- Enable the testing
- Add patch to not require mongodb during testing:
* no-mongodb.patch
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:flask/python-Flask-Security-Too?expand=0&rev=3
