Conversation
(cherry picked from commit ffcb72f)
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
[maas-code-reviewer review]
LLM-generated review from https://github.com/canonical/maas-code-reviewer.
Intended to assist a human reviewer, not replace one — suggestions may be
incorrect, please verify before acting.
This PR successfully splits the user update requests into Self and Admin variants and correctly moves password validation into a separate check before updating. However, there are two important issues to address:
- Unintentional Overwrite of
is_staff/is_active: Hardcoding these fields toFalseandTruein theto_builder()methods causes any profile update to overwrite them. This means staff users will accidentally demote themselves when updating their names. - Event Loop Blocking: Password hashing and verification are CPU-bound operations. Running them synchronously blocks the asyncio event loop and introduces a Denial-of-Service vulnerability.
|
(For future reference): This is, in part, a followup to #623. |
Wrap the `PBKDF2PasswordHasher` method calls in `asyncio.to_thread` to avoid blocking the event loop. (cherry picked from commit a72c0ea)
|
@AloizioMacedo I've also included here the commit for running password hashing in a thread. Let me know if that works for you or if we want to have them split. |
It works, but let's wait on #662. Theoretically, it seems there are not many conflicts (if any), but both touch things related to password (FIPS adds some validation). |
2 participants
(cherry picked from commit ffcb72f)
(cherry picked from commit a72c0ea)