cms-dev / cms-dev/cms

Merge users and admins

Open
#710 7 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

cws data_model db feature_request
Dominant language
Python
Stars
1k
Forks
412
Avg merge
6d 10h
Merged PRs (30d)
3

Description

This means:

  • add another column in the database for each user specifying the algorithm used to hashing (or empty for clear text). Example: MD5, SHA512, SHA256
  • based on the above field, the password field will be either the clear text password or the hashed password
  • in the CWS, at login, compare the passwords based on the algorithm specified in the database
  • don't show passwords for users that use a hash function in the AWS but display a message showing the algorithm used. the admin can still change the password
  • add option to specify hash in cmsAddUser

Pros:

  • different types of users (users for a local contest with clear text password and users for remote contests in the same database)
  • in the future, this will work well with an option for users to change their password only if allowed by the admins
  • better security overall
  • users can use password that are easier to remember for them and I can guarantee my users that I can't see their passwords

Cons:

  • additional column in the database - bigger database
  • with password hash, the admins can't recover a password, only change it

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by mapping the database schema and the CWS login, AWS user display, and cmsAddUser entry points named in the issue. Define how clear-text and hashed passwords are represented, compared, displayed, and changed, including migration and security implications. Done means the merged user/admin flow supports the requested hash selection without exposing hashed passwords.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, backend, databases
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.