tea/browsertrix
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fixes token lifetime bug / improve security (#2490)

Browse Source 
- fix jwt_token_lifetime being in hours, not minutes, remove extra * 60
- don't return userids in user list for org admins, instead just key
users by email, which is already unique
This commit is contained in:
Ilya Kreymer 2025-03-19 10:07:09 -07:00 committed by GitHub
parent eb300815a7
commit 6be1f6674c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
backend/btrixcloud/auth.py
View File

@ -28,7 +28,7 @@ from .utils import dt_now
# ============================================================================ # ============================================================================
PASSWORD_SECRET = os.environ.get("PASSWORD_SECRET", uuid4().hex) PASSWORD_SECRET = os.environ.get("PASSWORD_SECRET", uuid4().hex)
JWT_TOKEN_LIFETIME = int(os.environ.get("JWT_TOKEN_LIFETIME_MINUTES", 60)) * 60 JWT_TOKEN_LIFETIME = int(os.environ.get("JWT_TOKEN_LIFETIME_MINUTES", 60))
BTRIX_SUBS_APP_API_KEY = os.environ.get("BTRIX_SUBS_APP_API_KEY", "") BTRIX_SUBS_APP_API_KEY = os.environ.get("BTRIX_SUBS_APP_API_KEY", "")

8
backend/btrixcloud/models.py
View File

@ -2063,10 +2063,14 @@ class Organization(BaseMongoModel):
if not role: if not role:
continue continue
result["users"][id_] = { email = org_user.get("email")
if not email:
continue
result["users"][email] = {
"role": role, "role": role,
"name": org_user.get("name", ""), "name": org_user.get("name", ""),
"email": org_user.get("email", ""), "email": email,
} }
return OrgOut.from_dict(result) return OrgOut.from_dict(result)

2
backend/test/test_api.py
View File

@ -40,7 +40,7 @@ def test_api_settings():
assert data == { assert data == {
"registrationEnabled": False, "registrationEnabled": False,
"jwtTokenLifetime": 86400, "jwtTokenLifetime": 1440,
"defaultBehaviorTimeSeconds": 300, "defaultBehaviorTimeSeconds": 300,
"maxPagesPerCrawl": 4, "maxPagesPerCrawl": 4,
"numBrowsers": 2, "numBrowsers": 2,