google-labs-jules[bot]
d22175310a
🚨 Severity: HIGH 💡 Vulnerability: User-provided IMAP `host` in `_test_imap_connection` and `pull_inbox` was not validated against private IPs, creating an SSRF risk. 🎯 Impact: Attackers could abuse the endpoints to port-scan or interact with internal/private network services. 🔧 Fix: Integrated `is_private_ip` from `app.utils.network` to block connections resolving to private, loopback, link-local, or reserved IPs. ✅ Verification: Ran `test_imap_tasks.py` and `test_api_imap_accounts.py` successfully. Checked `ruff` output and diffs. Removed all scratch files from the commit. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
132 lines
6.6 KiB
HTML
132 lines
6.6 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>DocuElevate - Reset Password</title>
|
|
<link href="https://cdn.jsdelivr.net/npm/tailwindcss@2.2.19/dist/tailwind.min.css" rel="stylesheet">
|
|
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.1/css/all.min.css"
|
|
integrity="sha512-DTOQO9RWCH3ppGqcWaEA1BIZOC6xxalwEsw9c2QQeAIftl+Vegovlnee1c9QX4TctnWMn13TZye+giMm8e2LwA=="
|
|
crossorigin="anonymous" referrerpolicy="no-referrer" />
|
|
<script defer src="https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js"></script>
|
|
</head>
|
|
<body class="bg-gray-100 min-h-screen flex items-center justify-center py-8">
|
|
<main class="bg-white rounded-lg shadow-lg p-8 max-w-md w-full" role="main">
|
|
<div class="flex justify-center mb-6">
|
|
<img src="/static/images/logo_writing.svg" alt="DocuElevate Logo" class="h-16">
|
|
</div>
|
|
|
|
<h1 class="text-2xl font-bold text-center text-gray-800 mb-2">Set a new password</h1>
|
|
<p class="text-center text-gray-500 text-sm mb-6">Enter your new password below.</p>
|
|
|
|
<div
|
|
x-data="{
|
|
token: '{{ token | default('', true) }}',
|
|
new_password: '',
|
|
new_password_confirm: '',
|
|
loading: false,
|
|
error: '',
|
|
success: false,
|
|
async submit() {
|
|
this.error = '';
|
|
if (this.new_password !== this.new_password_confirm) {
|
|
this.error = 'Passwords do not match.';
|
|
return;
|
|
}
|
|
this.loading = true;
|
|
try {
|
|
const resp = await fetch('/api/auth/reset-password', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': '{{ csrf_token }}' },
|
|
body: JSON.stringify({
|
|
token: this.token,
|
|
new_password: this.new_password,
|
|
new_password_confirm: this.new_password_confirm
|
|
})
|
|
});
|
|
if (resp.ok) {
|
|
this.success = true;
|
|
} else {
|
|
const data = await resp.json();
|
|
this.error = data.detail || 'Password reset failed. Please try again.';
|
|
}
|
|
} catch(e) {
|
|
this.error = 'Network error. Please try again.';
|
|
} finally {
|
|
this.loading = false;
|
|
}
|
|
}
|
|
}"
|
|
>
|
|
<div x-show="success" x-cloak class="text-center py-4">
|
|
<div class="flex justify-center mb-4">
|
|
<div class="bg-green-100 rounded-full p-4">
|
|
<i class="fas fa-check-circle text-green-600 text-4xl" aria-hidden="true"></i>
|
|
</div>
|
|
</div>
|
|
<p class="text-green-700 font-semibold mb-4">Password updated successfully!</p>
|
|
<a href="/login"
|
|
class="inline-block py-2 px-6 rounded-md bg-indigo-600 text-white text-sm font-medium hover:bg-indigo-700 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500"
|
|
style="min-height:44px;display:flex;align-items:center;justify-content:center;"
|
|
>Sign in</a>
|
|
</div>
|
|
|
|
<form x-show="!success" @submit.prevent="submit" class="space-y-4" novalidate>
|
|
<div x-show="error" x-cloak
|
|
class="bg-red-100 border-l-4 border-red-500 text-red-700 p-4 rounded"
|
|
role="alert" aria-live="polite">
|
|
<p x-text="error"></p>
|
|
</div>
|
|
|
|
<div>
|
|
<label for="new_password" class="block text-sm font-medium text-gray-700">New password <span aria-hidden="true" class="text-red-500">*</span></label>
|
|
<input
|
|
type="password" id="new_password" name="new_password" required
|
|
x-model="new_password"
|
|
autocomplete="new-password"
|
|
minlength="8" maxlength="128"
|
|
class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring focus:ring-indigo-500 focus:ring-opacity-50"
|
|
aria-required="true"
|
|
aria-describedby="pw-hint"
|
|
>
|
|
<p id="pw-hint" class="mt-1 text-xs text-gray-500">Minimum 8 characters.</p>
|
|
</div>
|
|
|
|
<div>
|
|
<label for="new_password_confirm" class="block text-sm font-medium text-gray-700">Confirm new password <span aria-hidden="true" class="text-red-500">*</span></label>
|
|
<input
|
|
type="password" id="new_password_confirm" name="new_password_confirm" required
|
|
x-model="new_password_confirm"
|
|
autocomplete="new-password"
|
|
minlength="8" maxlength="128"
|
|
class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring focus:ring-indigo-500 focus:ring-opacity-50"
|
|
aria-required="true"
|
|
>
|
|
</div>
|
|
|
|
<button
|
|
type="submit"
|
|
:disabled="loading"
|
|
class="w-full flex justify-center py-2 px-4 border border-transparent rounded-md shadow-sm text-sm font-medium text-white bg-indigo-600 hover:bg-indigo-700 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500 disabled:opacity-50"
|
|
style="min-height:44px;"
|
|
>
|
|
<span x-show="!loading">Update password</span>
|
|
<span x-show="loading" x-cloak>
|
|
<i class="fas fa-spinner fa-spin mr-2" aria-hidden="true"></i>Updating…
|
|
</span>
|
|
</button>
|
|
</form>
|
|
</div>
|
|
|
|
<div class="mt-6 text-center">
|
|
<a href="/login" class="text-sm font-medium text-blue-600 hover:text-blue-500">
|
|
Back to sign in
|
|
</a>
|
|
</div>
|
|
</main>
|
|
<div class="fixed bottom-4 text-center w-full text-xs text-gray-500">
|
|
DocuElevate {{ app_version|default('', true) }}
|
|
</div>
|
|
</body>
|
|
</html>
|