Sibi Prabakaran
08f994103a
Add documentation for JSON endpoints for Yesod.Auth.Email module
2016-12-08 14:25:08 +05:30
Michael Snoyman
98854b4de3
Version bump for #1317
2016-12-07 09:23:53 -05:00
Sibi Prabakaran
60f66b4c3a
Add relevant changelog
2016-12-07 14:09:01 +05:30
Sibi Prabakaran
8f8c99db88
Do parseJsonBody only when form data is not found
2016-12-07 14:08:37 +05:30
Sibi Prabakaran
0255f93c22
Export croatianMessage
2016-12-06 18:44:46 +05:30
Sibi Prabakaran
47b2877c79
More Haddock fixes
2016-12-06 18:44:38 +05:30
Sibi Prabakaran
75df4e0468
Use @since for proper haddock rendering
2016-12-06 18:21:36 +05:30
Sibi Prabakaran
83575e92a0
Fix typo: /s/interoprate/interoperate
2016-12-06 18:20:18 +05:30
Sibi Prabakaran
85bd15d109
Add json support for postPasswordR
2016-12-06 18:17:19 +05:30
Sibi Prabakaran
b6cd72f49f
Implement Login via JSON endpoint
...
Add additional handling of JSON endpoint in addition to the HTML form
method.
2016-12-06 15:20:51 +05:30
Sibi Prabakaran
19840cdc89
Add json support for postRegisterR
2016-12-05 19:32:23 +05:30
Michael Snoyman
2c4e19e0b6
Version bump for #1309
2016-11-29 13:48:42 +02:00
Filip Gralinski
a3929aa9bb
remove invalid Google OpenID link
2016-11-26 19:39:24 +01:00
Sibi Prabakaran
696faa3fd0
req is not needed.
2016-11-20 13:43:01 +05:30
Sibi Prabakaran
10850f5cee
Use checkCsrfHeaderOrParam instead of manual check
2016-11-20 13:32:15 +05:30
Sibi Prabakaran
7f17d829b3
Fix CSRF security vulnerability in registerHelper function
...
Return a 403 status code if the csrf tokens are matched. This currently
affects two endpoints: During registration and during password reset
forms.
This curl request demonstrates how this can be exploited to register new
email:
curl -i --header "Accept: application/json" --request POST -F
"email=sibi@psibi.in" http://localhost:3005/auth/page/email/register
With the patch applied, it will respond with this:
{"message":"Permission Denied. A valid CSRF token wasn't present in HTTP
headers or POST parameters. Because the request could have been forged,
it's been rejected altogether. Check the Yesod.Core.Handler docs of the
yesod-core package for details on CSRF protection."}
2016-11-20 03:59:32 +05:30
Bryan Richter
add9d4393a
Comment on unsafePerformIO, close #1245
2016-10-03 09:08:22 -07:00
Michael Snoyman
a04d2b25ba
Version bump
2016-09-02 12:39:01 +03:00
kevin147147
e27cebb8a5
Translation bug in german message
...
missing space
2016-09-01 11:55:44 +02:00
Michael Snoyman
d2482bf178
Version bump
2016-08-14 15:44:53 +03:00
Michael Snoyman
25cb163e11
Relax upper bounds for persistent 2.6
2016-08-14 15:41:17 +03:00
Felix Paulusma
76726063e4
Updated some Dutch translations.
2016-07-12 17:19:09 +02:00
Michael Snoyman
6595a707d0
Version bump
2016-06-27 10:46:19 +03:00
Bryan Richter
5342f891f3
Add key reuse warning ( #1222 ) ( #1233 )
2016-05-14 15:40:07 -07:00
Michael Snoyman
bd1ea59cbd
Version bump
2016-04-25 18:17:13 +03:00
Erik de Castro Lopo
34e0c8b638
yesod-auth: Fixes for persistent 2.5
2016-04-19 15:18:46 +10:00
Eric Easley
d99de61554
Use CPP to maintain backward compat
2016-04-18 10:03:39 -07:00
Eric Easley
8e71f766b5
Use PersistRecordBackend constraint synonym
2016-04-15 21:25:40 -07:00
Eric Easley
bf3a9c9dd4
Switch to released persistent-2.5
2016-04-14 15:14:56 -07:00
Eric Easley
f7494260b0
Merge remote-tracking branch 'upstream/master'
2016-04-11 09:16:06 -07:00
Christopher League
85a62ab074
Bump yesod-auth version for CSRF support ( #1205 )
2016-04-03 12:43:15 -04:00
Christopher League
fd870c95f9
Provide CSRF token in Dummy login form
2016-04-02 23:04:58 -04:00
Eric Easley
02dcb99cad
Merge remote-tracking branch 'upstream/master'
2016-03-31 13:03:47 -07:00
Arthur Fayzrakhmanov (Артур Файзрахманов)
ecdee7f51a
Tidy up imports
2016-03-29 19:14:40 +05:00
Arthur Fayzrakhmanov (Артур Файзрахманов)
5febecf812
Improve Russian translation for ConfirmPass message
2016-03-29 19:14:27 +05:00
Michael Snoyman
aa6714e4b0
Undo minor bump that was not needed
2016-03-29 09:16:33 +03:00
Michael Snoyman
31d07481f1
Version bump
2016-03-29 09:15:57 +03:00
Sebastien Canart
36bc175f50
Add French translation for CurrentPassword
2016-03-23 08:26:44 +01:00
Adam Sjøgren
04a7c12b65
Add translation to Danish.
2016-03-20 21:16:14 +01:00
Murray
a15070709d
allow more than one session message and add statuses
2016-03-16 18:14:40 +00:00
Michael Snoyman
27a9faa91f
Merge pull request #1183 from lethjakman/auth_forgot_password_csrf
...
Fixed forgot password CSRF with form helper
2016-03-13 08:11:16 +02:00
Alex Kardos
d76aa1a16e
Converted runFormPosts to generateFormPost
...
This is a cleaner way to generate forms without ignoring one of the
variables.
2016-03-12 18:29:05 -07:00
Alex Kardos
9fb3f61ac8
Moved settings to functions to clean up the form
2016-03-12 18:29:05 -07:00
Alex Kardos
2f0a7fbcc5
Wrapped email login form with an id
2016-03-12 18:29:05 -07:00
Alex Kardos
0c0cb12a10
Used form helper for forgot password form
...
* Removed unused idents
* Isolated form logic
* Added an id around forgot password for styling purposes
2016-03-12 18:28:49 -07:00
Michael Snoyman
8df56ecaa1
Merge pull request #1176 from lethjakman/auth_set_password_csrf
...
Auth password handler CSRF
2016-03-10 10:55:17 +02:00
Alex Kardos
dee130ac9f
Made spacing consistent with the rest of the file
2016-03-09 19:47:52 -07:00
Alex Kardos
7faecc8952
Added translations and dummy data for current password
...
German and Spanish provided by Erin Eichenberger.
2016-03-09 19:22:36 -07:00
Michael Snoyman
936fe84cdd
Deprecate BrowserId #1173
2016-03-08 16:27:21 +02:00
Alex Kardos
e3aa310c84
Used monadic form helper for password handler
...
This needed to happen in order to automatically get CSRF protection
Several changes happened while switching over:
* Relied on built in names for inputs
* Cleaned up naming
* Created password helpers for each field
* Added a translation for current password
2016-03-07 16:44:05 -07:00
