self-service-password | PHP Ecosystem Directory

self-service-password - Version 1.5.4 Latest Release

Published by coudot 11 months ago

ℹ️ Self Service Password

LDAP Tool Box Self Service Password is a web application for end users. It allows them to change or reset their password if they lost it.

It works with any LDAP directory, including Active Directory.

📄 What's Changed

⚠️ A vulnerability was found by @piuppi (see #816), so upgrade is highly recommended!

Typo in config_tokens.rst by @maxxer in https://github.com/ltb-project/self-service-password/pull/777
Updated italian localization by @xBounceIT in https://github.com/ltb-project/self-service-password/pull/793
Dockerfile fails to build #813 by @pljeff in https://github.com/ltb-project/self-service-password/pull/814
Do not trust SMS number from crypted token, search it again in LDAP Directory by @coudot in https://github.com/ltb-project/self-service-password/pull/818
Announce that the smarty3 package needs to be installed manually by @paulignari in https://github.com/ltb-project/self-service-password/pull/774

Full Changelog: https://github.com/ltb-project/self-service-password/compare/v1.5.3...v1.5.4

👥 Main Team

@coudot (@worteks)

🤝 New Contributors

@xBounceIT made their first contribution in https://github.com/ltb-project/self-service-password/pull/793
@pljeff made their first contribution in https://github.com/ltb-project/self-service-password/pull/814
@paulignari made their first contribution in https://github.com/ltb-project/self-service-password/pull/774

⬇️ Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

You can also use our Docker image: https://hub.docker.com/r/ltbproject/self-service-password

self-service-password - Version 1.5.3

Published by coudot over 1 year ago

ℹ️ Self Service Password

LDAP Tool Box Self Service Password is a web application for end users. It allows them to change or reset their password if they lost it.

It works with any LDAP directory, including Active Directory.

📄 What's Changed

Update gpg install command by @wwuck in https://github.com/ltb-project/self-service-password/pull/723
Add support for Arabic locale by @bondif in https://github.com/ltb-project/self-service-password/pull/741
Update Dutch lang file by @zidesm in https://github.com/ltb-project/self-service-password/pull/744
Added comment/note over $custom_css by @stevleibelt in https://github.com/ltb-project/self-service-password/pull/754
Bump guzzlehttp/psr7 from 2.4.0 to 2.5.0 in /lib by @dependabot in https://github.com/ltb-project/self-service-password/pull/767
Restrict languages to php files by @coudot in https://github.com/ltb-project/self-service-password/pull/771
Prevent account disclosure in password reset by mail token page by @coudot in https://github.com/ltb-project/self-service-password/pull/749

Full Changelog: https://github.com/ltb-project/self-service-password/compare/v1.5.2...v1.5.3

👥 Main Team

@coudot (@worteks)
@artlog (@worteks)

🤝 New Contributors

@wwuck made their first contribution in https://github.com/ltb-project/self-service-password/pull/723
@zidesm made their first contribution in https://github.com/ltb-project/self-service-password/pull/744
@stevleibelt made their first contribution in https://github.com/ltb-project/self-service-password/pull/754

⬇️ Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

You can also use our Docker image: https://hub.docker.com/r/ltbproject/self-service-password

self-service-password - Version 1.5.2

Published by coudot about 2 years ago

ℹ️ Self Service Password

LDAP Tool Box Self Service Password is a web application for end users. It allows them to change or reset their password if they lost it.

It works with any LDAP directory, including Active Directory.

📄 What's Changed

Update config_nginx.rst by @souhaib22 in https://github.com/ltb-project/self-service-password/pull/717
Update config_apache.rst by @souhaib22 in https://github.com/ltb-project/self-service-password/pull/718
Use gpg instead of apt-key during for deb install by @ZephOne in https://github.com/ltb-project/self-service-password/pull/722
captcha in sendsms check when needed only by @artlog in https://github.com/ltb-project/self-service-password/pull/721

Full Changelog: https://github.com/ltb-project/self-service-password/compare/v1.5.1...v1.5.2

👥 Main Team

@coudot (@worteks)
@artlog (@worteks)

🤝 New Contributors

@souhaib22 made their first contribution in https://github.com/ltb-project/self-service-password/pull/717
@ZephOne made their first contribution in https://github.com/ltb-project/self-service-password/pull/722

⬇️ Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

You can also use our Docker image: https://hub.docker.com/r/ltbproject/self-service-password

self-service-password - Version 1.5.1

Published by coudot about 2 years ago

ℹ️ Self Service Password

LDAP Tool Box Self Service Password is a web application for end users. It allows them to change or reset their password if they lost it.

It works with any LDAP directory, including Active Directory.

📄 What's Changed

Catch user not found error by @coudot in https://github.com/ltb-project/self-service-password/pull/712
Explicit libldap-common dependency for docker by @VeselaHouba in https://github.com/ltb-project/self-service-password/pull/715

🤝 New Contributors

@VeselaHouba made their first contribution in https://github.com/ltb-project/self-service-password/pull/715

Full Changelog: https://github.com/ltb-project/self-service-password/compare/v1.5.0...v1.5.1

⬇️ Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

You can also use our Docker image: https://hub.docker.com/r/ltbproject/self-service-password

self-service-password - Version 1.5.0

Published by coudot about 2 years ago

ℹ️ Self Service Password

LDAP Tool Box Self Service Password is a web application for end users. It allows them to change or reset their password if they lost it.

It works with any LDAP directory, including Active Directory.

📄 What's Changed

feat(ssh): public key check ( #509 ) by @faust64 in https://github.com/ltb-project/self-service-password/pull/510
docs(sshkey) by @faust64 in https://github.com/ltb-project/self-service-password/pull/512
fix(mail): add sendmail to Docker image by @faust64 in https://github.com/ltb-project/self-service-password/pull/517
docs(multi-tenancy): adds samples setting multi-tenancy header by @faust64 in https://github.com/ltb-project/self-service-password/pull/515
If token was provided by SMS, check initial SMS code before changing password by @coudot in https://github.com/ltb-project/self-service-password/pull/521
[Security:low] Dismiss captcha once it is used by @coudot in https://github.com/ltb-project/self-service-password/pull/522
Merge 1.4 branch by @coudot in https://github.com/ltb-project/self-service-password/pull/523
Typo in resetbytoken resulting in mails not being sent by @faust64 in https://github.com/ltb-project/self-service-password/pull/529
adding Kerberos authentication support by @jazzl0ver in https://github.com/ltb-project/self-service-password/pull/536
Change expired password as manager by @coudot in https://github.com/ltb-project/self-service-password/pull/530
fix(version): mismatch between htdocs/index.php and rest/v1/include.php by @faust64 in https://github.com/ltb-project/self-service-password/pull/539
core(update): apache 2.4.46 by @faust64 in https://github.com/ltb-project/self-service-password/pull/541
Refactor pwned passwords by @faust64 in https://github.com/ltb-project/self-service-password/pull/540
fix(notify): don't send notification if modification failed by @faust64 in https://github.com/ltb-project/self-service-password/pull/542
docs(ratelimit): typo by @faust64 in https://github.com/ltb-project/self-service-password/pull/545
feat(mails): using several mail attributes by @faust64 in https://github.com/ltb-project/self-service-password/pull/546
fix(sshkeys): don't send mail notification when entry was not changed by @faust64 in https://github.com/ltb-project/self-service-password/pull/513
Update de.inc.php by @usrflo in https://github.com/ltb-project/self-service-password/pull/547
fix(docs): invalid nginx root serving ssp by @faust64 in https://github.com/ltb-project/self-service-password/pull/551
Added sms api for signal-cli by @mfulz in https://github.com/ltb-project/self-service-password/pull/549
fix(docs): ratelimit check interval should be 1h, not 1min by @faust64 in https://github.com/ltb-project/self-service-password/pull/558
Document $allowed_lang var by @maxxer in https://github.com/ltb-project/self-service-password/pull/562
Updated IT translation by @maxxer in https://github.com/ltb-project/self-service-password/pull/564
Fix Error 500 when user is not found in ldap for sms reset by @mfulz in https://github.com/ltb-project/self-service-password/pull/571
fix(api): phpmailer needs to be included (#573) by @faust64 in https://github.com/ltb-project/self-service-password/pull/576
fix: captcha misaligned in the mobile version by @bondif in https://github.com/ltb-project/self-service-password/pull/588
Update simplified Chinese translation by @tweea in https://github.com/ltb-project/self-service-password/pull/594
fix(docs) - see ltb-project/self-service-password#590 by @faust64 in https://github.com/ltb-project/self-service-password/pull/598
Update fr translation by @vboucard in https://github.com/ltb-project/self-service-password/pull/606
chore(deps): bump phpmailer/phpmailer from 6.4.1 to 6.5.0 in /lib by @dependabot in https://github.com/ltb-project/self-service-password/pull/559
Fix some undefined warnings by @liedekef in https://github.com/ltb-project/self-service-password/pull/609
fix apache / bullseye by @faust64 in https://github.com/ltb-project/self-service-password/pull/612
Issue 608 by @doc-slice in https://github.com/ltb-project/self-service-password/pull/619
Implement Argon2 hashing by @tleuxner in https://github.com/ltb-project/self-service-password/pull/628
Add some cosmetic css properties to sshkey textarea by @spike77453 in https://github.com/ltb-project/self-service-password/pull/642
Fix translation by @tvdijen in https://github.com/ltb-project/self-service-password/pull/646
chore(deps): bump guzzlehttp/psr7 from 2.1.0 to 2.2.1 in /lib by @dependabot in https://github.com/ltb-project/self-service-password/pull/647
chore(deps): bump guzzlehttp/guzzle from 7.4.0 to 7.4.4 in /lib by @dependabot in https://github.com/ltb-project/self-service-password/pull/659
Update bootstrap to v3.4.1 by @bohze in https://github.com/ltb-project/self-service-password/pull/661
chore(deps): bump guzzlehttp/guzzle from 7.4.4 to 7.4.5 in /lib by @dependabot in https://github.com/ltb-project/self-service-password/pull/664
feat(sms): Allow more than one mobile attribute #658 by @artlog in https://github.com/ltb-project/self-service-password/pull/673
Feat mail factorize attributes by @artlog in https://github.com/ltb-project/self-service-password/pull/675
Update TR translation by @berkaycagir in https://github.com/ltb-project/self-service-password/pull/669
fix(sshkey): should add one sshPublicKey per key by @faust64 in https://github.com/ltb-project/self-service-password/pull/514
Remove warning "Decoding error" by @coudot in https://github.com/ltb-project/self-service-password/pull/676
Fix 563 by @faust64 in https://github.com/ltb-project/self-service-password/pull/592
Use correct message identifiers by @coudot in https://github.com/ltb-project/self-service-password/pull/677
hide failure by default for mailnomatch issue #610 by @artlog in https://github.com/ltb-project/self-service-password/pull/685
fix check password toward ldap attribute for token based methods by @artlog in https://github.com/ltb-project/self-service-password/pull/686
captcha use dedicated session cookie fix #602 by @artlog in https://github.com/ltb-project/self-service-password/pull/680
Rate limit optional support per ip (ratelimit_filter_by_ip) by @artlog in https://github.com/ltb-project/self-service-password/pull/683
Add rate limit checking for any password change request include fix #654 by @artlog in https://github.com/ltb-project/self-service-password/pull/684
Improve documentation, parse php code by @coudot in https://github.com/ltb-project/self-service-password/pull/696
Fix password check ldap by @artlog in https://github.com/ltb-project/self-service-password/pull/688
Use require_once for file inclusion by @coudot in https://github.com/ltb-project/self-service-password/pull/702
Fix reset by questions display after password change by @coudot in https://github.com/ltb-project/self-service-password/pull/703
Check parameters before calling hash_equals by @coudot in https://github.com/ltb-project/self-service-password/pull/699
Get entry in checkpassword REST service by @coudot in https://github.com/ltb-project/self-service-password/pull/708

🤝 New Contributors

@jazzl0ver made their first contribution in https://github.com/ltb-project/self-service-password/pull/536
@usrflo made their first contribution in https://github.com/ltb-project/self-service-password/pull/547
@mfulz made their first contribution in https://github.com/ltb-project/self-service-password/pull/549
@maxxer made their first contribution in https://github.com/ltb-project/self-service-password/pull/562
@bondif made their first contribution in https://github.com/ltb-project/self-service-password/pull/588
@vboucard made their first contribution in https://github.com/ltb-project/self-service-password/pull/606
@liedekef made their first contribution in https://github.com/ltb-project/self-service-password/pull/609
@doc-slice made their first contribution in https://github.com/ltb-project/self-service-password/pull/619
@tleuxner made their first contribution in https://github.com/ltb-project/self-service-password/pull/628
@tvdijen made their first contribution in https://github.com/ltb-project/self-service-password/pull/646
@artlog made their first contribution in https://github.com/ltb-project/self-service-password/pull/673

Full Changelog: https://github.com/ltb-project/self-service-password/compare/v1.4.5...v1.5.0

⬇️ Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

You can also use our Docker image: https://hub.docker.com/r/ltbproject/self-service-password

self-service-password - Version 1.4.5

Published by coudot over 2 years ago

What's Changed

Latest version of 1.4.4 not working by @Max7641 in #670

Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

self-service-password - Version 1.4.4

Published by coudot over 2 years ago

What's Changed

Update bootstrap to v3.4.1 by @bohze in https://github.com/ltb-project/self-service-password/pull/663
Separate Smarty debug and debug by @coudot in https://github.com/ltb-project/self-service-password/pull/666
Typo in resetbytoken resulting in mails not being sent by @faust64 in https://github.com/ltb-project/self-service-password/pull/529
Don't send notification if modification failed by @faust64 in https://github.com/ltb-project/self-service-password/pull/542
PHP Fatal error: Uncaught TypeError: ldap_get_dn() in https://github.com/ltb-project/self-service-password/issues/648
REST files are not shipped in packages in https://github.com/ltb-project/self-service-password/issues/660

Full changelog: https://github.com/ltb-project/self-service-password/issues?q=is%3Aclosed+milestone%3A1.4.4

Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

self-service-password - Version 1.4.3

Published by coudot over 3 years ago

Some bug fixes for version 1.4:

#516: Docker image does not have sendmail in it
#517: fix(mail): add sendmail to Docker image
#520: [Security:high] Reset by SMS can be used to change any account password
#521: If token was provided by SMS, check initial SMS code before changing password
#522: [Security:low] Dismiss captcha once it is used

⚠️ Some fixes concern security issues, please upgrade as soon as possible

Please read release notes from https://github.com/ltb-project/self-service-password/releases/tag/v1.4

self-service-password - Version 1.4.2

Published by coudot over 3 years ago

Some bug fixes for version 1.4:

#504: Cannot use docker get gregwar/captcha----use docker
#505: fix(captcha): missing gd library
#506: I have a little problem - I can't use SMS for the next step
#507: fix(reset)
#508: fix(undefined)
#511: Bump phpmailer/phpmailer from 6.3.0 to 6.4.1 in /lib

Please read release notes from https://github.com/ltb-project/self-service-password/releases/tag/v1.4

self-service-password - Version 1.4.1

Published by coudot over 3 years ago

Some bug fixes for version 1.4:

#501: Remove extra semicolon from setquestions template
#502: Remove alt text so empty logo doesn't show 'msg_title' twice

Please read release notes from https://github.com/ltb-project/self-service-password/releases/tag/v1.4

self-service-password - Version 1.4

Published by coudot over 3 years ago

✨ Self Service Password 1.4 ✨

This version introduces many important changes, including:

Usage of Smarty framework
Prehook
REST API
New password policy checks: forbidden words, forbidden LDAP fields
Multiple question/answers
Advanced LDAP features: password modify extended operation, password policy control
Official Docker image
Multi tenancy

Full changelog available here: https://github.com/ltb-project/self-service-password/milestone/7?closed=1

⬆️ Upgrade

Compatibility

Version 1.4 requires PHP 7. Advanced LDAP features require PHP 7.4.

Packages are only available for Debian stable, CentOS 7 and CentOS 8.

Webserver configuration

The document root is now in htdocs/ and this should be changed in the virtual host configuration.

Configuration needs also to be updated if you want to use REST API.

Captcha

Google reCaptcha was removed. A new built-in captcha is provided, enable it with:

$use_captcha = true;

⬇️ Download

Follow installation instructions to use APT/YUM repositories: https://self-service-password.readthedocs.io/en/latest/installation.html

Packages can also be downloaded from LDAP Tool Box site: https://ltb-project.org/download#self_service_password

🤝 Contributors

Thanks a lot to all contributors: https://github.com/ltb-project/self-service-password/graphs/contributors

self-service-password - v1.3

Published by coudot over 6 years ago

Changelog:

#182: Message incorrect when resetting using email but not supplying email (minor)
#187: Security assessment issues
#191: Minor changes to Spanish translation
#196: reduce info released in error messages
#197: Please wrap mail debug ouput in pre tags.
#198: Create ee.inc.php
#201: Added some translations
#202: include config.inc.local.php + warning
#204: Index includes .swp files and crashes sites with error 500
#206: Encrypt answers in directory
#209: Check ldap_bind return code instead of relying on ldap_errno
#210: SSH key change should not be permitted for expired or must change passwords
#211: Force string conversion of input values
#215: added support for pwned-passwords api v2
#217: take into account post-hook exit status

Download: https://ltb-project.org/download#self_service_password

Migration notes: https://ltb-project.org/documentation/self-service-password/1.3/migration

Thanks to community:

@BShadeWork
@trapangle
@lonoak
@r2evans
@danielewood
@tuudik
@tekvsakdan
@nqb
@bananitadolca
@413j0
@paulignari
@davidcoutadeur
@Abdoulsore

Core team:

@plewin
@coudot (@Worteks)

self-service-password - v1.2

Published by coudot almost 7 years ago

Changelog:

#149: Remove obsolete stripslashes_if_gpc_magic_quotes
#154: Translated the hungarian keys left in english.
#162: Resolve send token web page issue when E-Mail To: set from LDAP
#166: Opportunistic TLS problem
#174: Improved nl.lang.php
#175: reCAPTCHA not working on master
#176: Dutch translation update by AlbertPluton
#177: Fix "SSH Key required" message wrong color when ssh key is not submitted
#178: Fix pattern matching in reset by questions
#179: Revert Twig because of multiple regressions, work still needed, and lack of testing