RocketChat / RocketChat/Rocket.Chat

Allow factional (decimal) values for Accounts_LoginExpiration

Open
#17,568 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

I originally reported this as a security vulnerability since we aren't able to set RC's login token expiration to less than 24 hours, and for us, that violates our security protocols.

I had not reported this as a bug because I didn't think it was a bug because the property is simply a pass-through to Meteor. However, It appears that Meteor supports fractional values for this property, thereby allowing for configuring the login token expiration to be less than one day.

We'd like to be able to set this property to, e.g. .5 -- but the RC UI does not accept decimal places for this property.

Steps to reproduce:
  1. Admin > Accounts
  2. locate the "Login Expiration in Days" field
  3. attempt to set the field to a fractional / decimal value e.g. .5
Expected behavior:

The value .5 (and other fractional values) would be accepted.

Actual behavior:

The value is rejected and the decimal point is removed or does not appear to begin with.

Server Setup Information:
  • Version of Rocket.Chat Server: 3.1.1
  • Operating System: RHEL 7
  • Deployment Method: Docker
  • Number of Running Instances: 1
  • DB Replicaset Oplog: enabled
  • NodeJS Version: 12.16.1
  • MongoDB Version: 4.0.9
Client Setup Information
  • Desktop App or Browser Version: Chrome 81.0.4044.129 64bit
  • Operating System: Manjaro Linux
Additional context

Appreciate the support here, it's important for us to be able to uphold our security protocols, and we love RC!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at Admin > Accounts and trace the "Login Expiration in Days" field's input validation and persistence. Verify how decimal values are handled, then test that values such as .5 can be entered and saved without losing the decimal point.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.