stop storing guest passwords, mint sessions server side
The old flow encrypted the guest password on disk next to its own key, then sent it to the guest in the bootstrap HTML anyway. Now redemption mints the session with ISessionManager.AuthenticateDirect and the page only ever carries the session token. The guest account still gets a random password nobody knows, so blank login stays impossible, but no password is stored or sent anywhere anymore. Cleanup now defaults to every 30 minutes instead of daily at 4am so expired guests die fast.
Cette révision appartient à :
@@ -56,9 +56,6 @@ public sealed class ShareLinkRecord
|
||||
/// <summary>Gets or sets a value indicating whether the link may be used once only.</summary>
|
||||
public bool OneUse { get; set; } = true;
|
||||
|
||||
/// <summary>Gets or sets the encrypted guest password, if one has been generated.</summary>
|
||||
public string? GuestPasswordEncrypted { get; set; }
|
||||
|
||||
/// <summary>Gets or sets a value indicating whether metadata was touched during cleanup.</summary>
|
||||
public bool MetadataTouched { get; set; }
|
||||
|
||||
|
||||
Référencer dans un nouveau ticket
Bloquer un utilisateur