shantanukhond commented on code in PR #39469:
URL: https://github.com/apache/superset/pull/39469#discussion_r3602473973
##########
superset/views/users/api.py:
##########
@@ -161,6 +309,135 @@ def update_me(self) -> Response:
except ValidationError as error:
return self.response_400(message=error.messages)
+ @expose("/password", methods=["PUT"])
+ @protect()
+ @permission_name("write")
+ @safe
+ @statsd_metrics
+ @requires_json
+ @_rate_limit_me_password_change
+ def update_my_password(self) -> Response:
+ """Update the current user's password (AUTH_DB only)
+ ---
+ put:
+ summary: Update the current user's password
+ description: >-
+ Changes the authenticated user's password when ``AUTH_TYPE`` is
``AUTH_DB``.
+ Requires the current password and a new password that satisfies
+ ``AUTH_DB_CONFIG`` policy.
+ requestBody:
+ required: true
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/CurrentUserPasswordPutSchema'
+ responses:
+ 200:
+ description: Password updated successfully
+ content:
+ application/json:
+ schema:
+ type: object
+ properties:
+ result:
+ $ref: '#/components/schemas/UserResponseSchema'
+ 400:
+ $ref: '#/components/responses/400'
+ 401:
+ $ref: '#/components/responses/401'
+ 429:
+ $ref: '#/components/responses/400'
+ 500:
+ $ref: '#/components/responses/500'
+ """
+ if app.config.get("AUTH_TYPE") != AUTH_DB:
+ return self.response_400(
+ message=(
+ "Password change is only available when AUTH_TYPE is
AUTH_DB."
+ ),
+ )
+
+ try:
+ body = _load_password_change_body(
+ self.current_user_password_put_schema,
+ request.json,
+ )
+ user_db = db.session.get(User, g.user.id)
+ if user_db is None:
+ return self.response_404()
+
+ old_hash = user_db.password
+ if not verify_auth_db_password(old_hash, body["current_password"]):
+ return self.response_400(message="Incorrect current password.")
+
+ new_hash = hash_auth_db_password(body["new_password"])
+ except ValidationError as error:
+ return self.response_400(message=error.messages)
+
+ try:
+ user_after, new_stamp = _commit_user_password_change(
+ self,
+ g.user.id,
+ old_hash,
+ new_hash,
+ )
+ except PasswordChangeConflictError:
+ return self.response_400(
+ message=(
+ "Unable to update password. Your password may have been "
+ "changed elsewhere; please try again."
+ ),
+ )
+ except SQLAlchemyError:
+ db.session.rollback() # pylint: disable=consider-using-transaction
+ logger.exception("Failed to commit password change")
+ return self.response_500(
+ message="Unable to update password. Please try again.",
+ )
+
+ cache_user_session_auth_stamp(g.user.id, new_stamp)
+ _reestablish_login_session(user_after)
+ _log_audit_event("UserPasswordChanged", {"user_id": g.user.id})
Review Comment:
Adding initiated_by and source_ip. Anything else you can suggest?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
