forced password reset

[jywarren]

@btbonval sez:

It'd be nice to have a feature for admins which allows them to forcibly change a user's password to some kind of internally generated nonsense, which is emailed to the user. The admin need never see the generated password.
If an account is compromised, this would be a simple fix so long as the user's email address is a trusted out of band communication channel.

This should actually be fairly simple to implement. While trying to reset a password by hand, I found that a user's hashed password and salt may be changed using the password attribute. The reset_key attribute allows the user to reset his or her password by typing in the generated key; this should probably be done using the pre-existing functions.

For a quick preview, it might look like this:

if current_user && current_user.role != 'moderator' && current_user.role != 'admin':
  flash[:error] = 'YOU SHALL NOT PASS!'
else:
  user = User.find_by_whatever(something distinct)
  user.password = random_generator()
  user.reset_key = key_generator()
  user.save!
  email_key_to_user()

I can't test this personally due to #166

It turns out no accounts were (as yet) compromised. This ticket is still useful should an account be compromised at a later date, but there is less urgency.

[btbonval]

Not sure if I meant this originally, but I see this as being a pretty simple process

1. change the user's password to random gibberish using JS or Ruby and don't report that password to anyone. Effectively the user account is disabled from logins until the password is changed.
2. Issue a password reset key using the conventional mechanism. The only difference is that the user didn't request it by clicking a button on the UI, otherwise the same internal mechanisms should work.

[jywarren]

I'd like to break this up into smaller pieces:

• random pwd and key generating functions (we actually have one here: https://github.com/publiclab/plots2/blob/master/app/models/user.rb#L90-L98)
• a method contained in user.rb: https://github.com/publiclab/plots2/blob/master/app/models/user.rb called def force_reset_key or something
• a unit test

Marking it break-me-up so we can give people next steps and get this done.

[Kevin-Kawai]

@jywarren Hi I've been looking around issues trying to find something I can take part in. Is this issue still live? I think I generally understand the task and what to do. If it's still something that needs to get done I'd be super excited to give it a go!

[jywarren]

Yes, this would be great -- thank you, we'd love your help! Take a look at the admin_controller to see the functions we have now. I think this is a remix of password reset key and password gibberish-izing as should be reflected in that controller -- thanks!!!

…

On Thu, Dec 7, 2017 at 9:14 AM, KevinKawai ***@***.***> wrote: @jywarren <https://github.com/jywarren> Hi I've been looking around issues trying to find something I can take part in. Is this issue still live? I think I generally understand the task and what to do. If it's still something that needs to get done I'd be super excited to give it a go! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#232 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABfJ0gdScGlGDnfqgvkihOOSVqOypKLks5s9_LcgaJpZM4DjpZT> .

[Kevin-Kawai]

@jywarren alrighty sounds great! I'll take a crack at it over the weekend and let you know if I run into any trouble.

[jywarren]

Super. Thanks!

…

On Dec 7, 2017 7:55 PM, "KevinKawai" ***@***.***> wrote: @jywarren <https://github.com/jywarren> alrighty sounds great! I'll take a crack at it over the weekend and let you know if I run into any trouble. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#232 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABfJ92McLuBzoDAh23xMLSFs1ZfKeFYks5s-IjxgaJpZM4DjpZT> .

[Kevin-Kawai]

@jywarren Hey I was able to get some time to work on this issue and created a PR #1834. It's incomplete and still a work in progress. I had a bit of trouble with routes not working on my local machine so I had to change them but they are probably correct the way they are so I will change them back.

If you have the chance to look through this and tell me if I'm on the right track that would be great. Thanks in advance!

[jywarren]

Oh oops, this is now done!