Self Service Password Versions Save

Web interface to change and reset password in an LDAP directory

v1.6.0

1 month ago

:information_source: Self Service Password

LDAP Tool Box Self Service Password is a web application for end users. It allows them to change or reset their password if they lost it.

It works with any LDAP directory, including Active Directory.

:page_facing_up: What's Changed

Update tr.inc.php by @berkaycagir in https://github.com/ltb-project/self-service-password/pull/775
Audit log by @coudot in https://github.com/ltb-project/self-service-password/pull/781
Use login_hint to prefill user login by @coudot in https://github.com/ltb-project/self-service-password/pull/795
Update phpunit by @coudot in https://github.com/ltb-project/self-service-password/pull/799
translated the line $messages['tokensent_ifexists'] into german by @piang0 in https://github.com/ltb-project/self-service-password/pull/804
First implementation of a page to set mail and phone attributes by @coudot in https://github.com/ltb-project/self-service-password/pull/808
Use LTB LDAP common PHP lib by @coudot in https://github.com/ltb-project/self-service-password/pull/797
Update tr.inc.php by @berkaycagir in https://github.com/ltb-project/self-service-password/pull/812
Complete and fix pt-BR translation by @natanjunges in https://github.com/ltb-project/self-service-password/pull/815
Filter allowed languages by @coudot in https://github.com/ltb-project/self-service-password/pull/829
Error handling when using the signal-cli api for sms by @armfem in https://github.com/ltb-project/self-service-password/pull/833
Update it.inc.php by @iotaka in https://github.com/ltb-project/self-service-password/pull/839
Upgrade Bootstrap to 5.3 by @coudot in https://github.com/ltb-project/self-service-password/pull/837
Fix pt-BR translation for pwned password policy by @campolargo in https://github.com/ltb-project/self-service-password/pull/841
prevent multiple form submits (#844) by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/845
830 entropy by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/843
remove useless show_policy function, now rendered by smarty template by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/842
Remove criteria depending on old password when unavailable (#855) by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/856
add docker image labels (#778) + update base image to php:8.2 + smarty to v4.4.1 by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/866
update bundled dependencies + mv them as composer managed dep (#849) by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/859
Spec cleanup (#846) by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/847
deb cleanup (#852) by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/858
Avoid host header poisoning by @coudot in https://github.com/ltb-project/self-service-password/pull/857
Use a dedicated CSS class for ppolicy div by @coudot in https://github.com/ltb-project/self-service-password/pull/873
Test crypt_tokens parameter if SMS feature is enabled by @coudot in https://github.com/ltb-project/self-service-password/pull/874
Securisation of reset by SMS token feature by @armfem in https://github.com/ltb-project/self-service-password/pull/851
use new ltb-ldap v0.2 and adapt method signatures (#878) by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/879
878 use ltb ldap functions by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/882
Use POST instead of GET in check entropy module (#884) by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/885
compute pwd_diff_last_min_chars the same way than at backend side (#868) by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/869
reinject default configuration file into conf directory (#831) by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/870
fix warnings for uninitialized variables (#887) by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/888
ability to change custom password fields, developped by @markus-96 (#864) by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/865
Correction of max number of attempts for token sent by sms bug by @armfem in https://github.com/ltb-project/self-service-password/pull/890
remove global variables in sendsms.php (#889) by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/891
Corrected error introduced when adding obscure notifications by @armfem in https://github.com/ltb-project/self-service-password/pull/892
674 notify by mail code factorization by @davidcoutadeur in https://github.com/ltb-project/self-service-password/pull/893
Remove obscure_failure_messages option by @coudot in https://github.com/ltb-project/self-service-password/pull/899

Full Changelog: https://github.com/ltb-project/self-service-password/compare/v1.5.4...v1.6.0

:busts_in_silhouette: Main Team

@coudot (@worteks)
@davidcoutadeur (@worteks)

:handshake: New Contributors

@piang0 made their first contribution in https://github.com/ltb-project/self-service-password/pull/804
@natanjunges made their first contribution in https://github.com/ltb-project/self-service-password/pull/815
@armfem made their first contribution in https://github.com/ltb-project/self-service-password/pull/833
@iotaka made their first contribution in https://github.com/ltb-project/self-service-password/pull/839
@campolargo made their first contribution in https://github.com/ltb-project/self-service-password/pull/841

:arrow_down: Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

You can also use our Docker image: https://hub.docker.com/r/ltbproject/self-service-password

v1.5.4

6 months ago

:information_source: Self Service Password

LDAP Tool Box Self Service Password is a web application for end users. It allows them to change or reset their password if they lost it.

It works with any LDAP directory, including Active Directory.

:page_facing_up: What's Changed

:warning: A vulnerability was found by @piuppi (see #816), so upgrade is highly recommended!

Typo in config_tokens.rst by @maxxer in https://github.com/ltb-project/self-service-password/pull/777
Updated italian localization by @xBounceIT in https://github.com/ltb-project/self-service-password/pull/793
Dockerfile fails to build #813 by @pljeff in https://github.com/ltb-project/self-service-password/pull/814
Do not trust SMS number from crypted token, search it again in LDAP Directory by @coudot in https://github.com/ltb-project/self-service-password/pull/818
Announce that the smarty3 package needs to be installed manually by @paulignari in https://github.com/ltb-project/self-service-password/pull/774

Full Changelog: https://github.com/ltb-project/self-service-password/compare/v1.5.3...v1.5.4

:busts_in_silhouette: Main Team

@coudot (@worteks)

:handshake: New Contributors

@xBounceIT made their first contribution in https://github.com/ltb-project/self-service-password/pull/793
@pljeff made their first contribution in https://github.com/ltb-project/self-service-password/pull/814
@paulignari made their first contribution in https://github.com/ltb-project/self-service-password/pull/774

:arrow_down: Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

You can also use our Docker image: https://hub.docker.com/r/ltbproject/self-service-password

v1.5.3

1 year ago

:information_source: Self Service Password

LDAP Tool Box Self Service Password is a web application for end users. It allows them to change or reset their password if they lost it.

It works with any LDAP directory, including Active Directory.

:page_facing_up: What's Changed

Update gpg install command by @wwuck in https://github.com/ltb-project/self-service-password/pull/723
Add support for Arabic locale by @bondif in https://github.com/ltb-project/self-service-password/pull/741
Update Dutch lang file by @zidesm in https://github.com/ltb-project/self-service-password/pull/744
Added comment/note over $custom_css by @stevleibelt in https://github.com/ltb-project/self-service-password/pull/754
Bump guzzlehttp/psr7 from 2.4.0 to 2.5.0 in /lib by @dependabot in https://github.com/ltb-project/self-service-password/pull/767
Restrict languages to php files by @coudot in https://github.com/ltb-project/self-service-password/pull/771
Prevent account disclosure in password reset by mail token page by @coudot in https://github.com/ltb-project/self-service-password/pull/749

Full Changelog: https://github.com/ltb-project/self-service-password/compare/v1.5.2...v1.5.3

:busts_in_silhouette: Main Team

@coudot (@worteks)
@artlog (@worteks)

:handshake: New Contributors

@wwuck made their first contribution in https://github.com/ltb-project/self-service-password/pull/723
@zidesm made their first contribution in https://github.com/ltb-project/self-service-password/pull/744
@stevleibelt made their first contribution in https://github.com/ltb-project/self-service-password/pull/754

:arrow_down: Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

You can also use our Docker image: https://hub.docker.com/r/ltbproject/self-service-password

v1.5.2

1 year ago

:information_source: Self Service Password

LDAP Tool Box Self Service Password is a web application for end users. It allows them to change or reset their password if they lost it.

It works with any LDAP directory, including Active Directory.

:page_facing_up: What's Changed

Update config_nginx.rst by @souhaib22 in https://github.com/ltb-project/self-service-password/pull/717
Update config_apache.rst by @souhaib22 in https://github.com/ltb-project/self-service-password/pull/718
Use gpg instead of apt-key during for deb install by @ZephOne in https://github.com/ltb-project/self-service-password/pull/722
captcha in sendsms check when needed only by @artlog in https://github.com/ltb-project/self-service-password/pull/721

Full Changelog: https://github.com/ltb-project/self-service-password/compare/v1.5.1...v1.5.2

:busts_in_silhouette: Main Team

@coudot (@worteks)
@artlog (@worteks)

:handshake: New Contributors

@souhaib22 made their first contribution in https://github.com/ltb-project/self-service-password/pull/717
@ZephOne made their first contribution in https://github.com/ltb-project/self-service-password/pull/722

:arrow_down: Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

You can also use our Docker image: https://hub.docker.com/r/ltbproject/self-service-password

v1.5.1

1 year ago

:information_source: Self Service Password

LDAP Tool Box Self Service Password is a web application for end users. It allows them to change or reset their password if they lost it.

It works with any LDAP directory, including Active Directory.

:page_facing_up: What's Changed

Catch user not found error by @coudot in https://github.com/ltb-project/self-service-password/pull/712
Explicit libldap-common dependency for docker by @VeselaHouba in https://github.com/ltb-project/self-service-password/pull/715

:handshake: New Contributors

@VeselaHouba made their first contribution in https://github.com/ltb-project/self-service-password/pull/715

Full Changelog: https://github.com/ltb-project/self-service-password/compare/v1.5.0...v1.5.1

:arrow_down: Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

You can also use our Docker image: https://hub.docker.com/r/ltbproject/self-service-password

v1.5.0

1 year ago

:information_source: Self Service Password

LDAP Tool Box Self Service Password is a web application for end users. It allows them to change or reset their password if they lost it.

It works with any LDAP directory, including Active Directory.

:page_facing_up: What's Changed

feat(ssh): public key check ( #509 ) by @faust64 in https://github.com/ltb-project/self-service-password/pull/510
docs(sshkey) by @faust64 in https://github.com/ltb-project/self-service-password/pull/512
fix(mail): add sendmail to Docker image by @faust64 in https://github.com/ltb-project/self-service-password/pull/517
docs(multi-tenancy): adds samples setting multi-tenancy header by @faust64 in https://github.com/ltb-project/self-service-password/pull/515
If token was provided by SMS, check initial SMS code before changing password by @coudot in https://github.com/ltb-project/self-service-password/pull/521
[Security:low] Dismiss captcha once it is used by @coudot in https://github.com/ltb-project/self-service-password/pull/522
Merge 1.4 branch by @coudot in https://github.com/ltb-project/self-service-password/pull/523
Typo in resetbytoken resulting in mails not being sent by @faust64 in https://github.com/ltb-project/self-service-password/pull/529
adding Kerberos authentication support by @jazzl0ver in https://github.com/ltb-project/self-service-password/pull/536
Change expired password as manager by @coudot in https://github.com/ltb-project/self-service-password/pull/530
fix(version): mismatch between htdocs/index.php and rest/v1/include.php by @faust64 in https://github.com/ltb-project/self-service-password/pull/539
core(update): apache 2.4.46 by @faust64 in https://github.com/ltb-project/self-service-password/pull/541
Refactor pwned passwords by @faust64 in https://github.com/ltb-project/self-service-password/pull/540
fix(notify): don't send notification if modification failed by @faust64 in https://github.com/ltb-project/self-service-password/pull/542
docs(ratelimit): typo by @faust64 in https://github.com/ltb-project/self-service-password/pull/545
feat(mails): using several mail attributes by @faust64 in https://github.com/ltb-project/self-service-password/pull/546
fix(sshkeys): don't send mail notification when entry was not changed by @faust64 in https://github.com/ltb-project/self-service-password/pull/513
Update de.inc.php by @usrflo in https://github.com/ltb-project/self-service-password/pull/547
fix(docs): invalid nginx root serving ssp by @faust64 in https://github.com/ltb-project/self-service-password/pull/551
Added sms api for signal-cli by @mfulz in https://github.com/ltb-project/self-service-password/pull/549
fix(docs): ratelimit check interval should be 1h, not 1min by @faust64 in https://github.com/ltb-project/self-service-password/pull/558
Document $allowed_lang var by @maxxer in https://github.com/ltb-project/self-service-password/pull/562
Updated IT translation by @maxxer in https://github.com/ltb-project/self-service-password/pull/564
Fix Error 500 when user is not found in ldap for sms reset by @mfulz in https://github.com/ltb-project/self-service-password/pull/571
fix(api): phpmailer needs to be included (#573) by @faust64 in https://github.com/ltb-project/self-service-password/pull/576
fix: captcha misaligned in the mobile version by @bondif in https://github.com/ltb-project/self-service-password/pull/588
Update simplified Chinese translation by @tweea in https://github.com/ltb-project/self-service-password/pull/594
fix(docs) - see ltb-project/self-service-password#590 by @faust64 in https://github.com/ltb-project/self-service-password/pull/598
Update fr translation by @vboucard in https://github.com/ltb-project/self-service-password/pull/606
chore(deps): bump phpmailer/phpmailer from 6.4.1 to 6.5.0 in /lib by @dependabot in https://github.com/ltb-project/self-service-password/pull/559
Fix some undefined warnings by @liedekef in https://github.com/ltb-project/self-service-password/pull/609
fix apache / bullseye by @faust64 in https://github.com/ltb-project/self-service-password/pull/612
Issue 608 by @doc-slice in https://github.com/ltb-project/self-service-password/pull/619
Implement Argon2 hashing by @tleuxner in https://github.com/ltb-project/self-service-password/pull/628
Add some cosmetic css properties to sshkey textarea by @spike77453 in https://github.com/ltb-project/self-service-password/pull/642
Fix translation by @tvdijen in https://github.com/ltb-project/self-service-password/pull/646
chore(deps): bump guzzlehttp/psr7 from 2.1.0 to 2.2.1 in /lib by @dependabot in https://github.com/ltb-project/self-service-password/pull/647
chore(deps): bump guzzlehttp/guzzle from 7.4.0 to 7.4.4 in /lib by @dependabot in https://github.com/ltb-project/self-service-password/pull/659
Update bootstrap to v3.4.1 by @bohze in https://github.com/ltb-project/self-service-password/pull/661
chore(deps): bump guzzlehttp/guzzle from 7.4.4 to 7.4.5 in /lib by @dependabot in https://github.com/ltb-project/self-service-password/pull/664
feat(sms): Allow more than one mobile attribute #658 by @artlog in https://github.com/ltb-project/self-service-password/pull/673
Feat mail factorize attributes by @artlog in https://github.com/ltb-project/self-service-password/pull/675
Update TR translation by @berkaycagir in https://github.com/ltb-project/self-service-password/pull/669
fix(sshkey): should add one sshPublicKey per key by @faust64 in https://github.com/ltb-project/self-service-password/pull/514
Remove warning "Decoding error" by @coudot in https://github.com/ltb-project/self-service-password/pull/676
Fix 563 by @faust64 in https://github.com/ltb-project/self-service-password/pull/592
Use correct message identifiers by @coudot in https://github.com/ltb-project/self-service-password/pull/677
hide failure by default for mailnomatch issue #610 by @artlog in https://github.com/ltb-project/self-service-password/pull/685
fix check password toward ldap attribute for token based methods by @artlog in https://github.com/ltb-project/self-service-password/pull/686
captcha use dedicated session cookie fix #602 by @artlog in https://github.com/ltb-project/self-service-password/pull/680
Rate limit optional support per ip (ratelimit_filter_by_ip) by @artlog in https://github.com/ltb-project/self-service-password/pull/683
Add rate limit checking for any password change request include fix #654 by @artlog in https://github.com/ltb-project/self-service-password/pull/684
Improve documentation, parse php code by @coudot in https://github.com/ltb-project/self-service-password/pull/696
Fix password check ldap by @artlog in https://github.com/ltb-project/self-service-password/pull/688
Use require_once for file inclusion by @coudot in https://github.com/ltb-project/self-service-password/pull/702
Fix reset by questions display after password change by @coudot in https://github.com/ltb-project/self-service-password/pull/703
Check parameters before calling hash_equals by @coudot in https://github.com/ltb-project/self-service-password/pull/699
Get entry in checkpassword REST service by @coudot in https://github.com/ltb-project/self-service-password/pull/708

:handshake: New Contributors

@jazzl0ver made their first contribution in https://github.com/ltb-project/self-service-password/pull/536
@usrflo made their first contribution in https://github.com/ltb-project/self-service-password/pull/547
@mfulz made their first contribution in https://github.com/ltb-project/self-service-password/pull/549
@maxxer made their first contribution in https://github.com/ltb-project/self-service-password/pull/562
@bondif made their first contribution in https://github.com/ltb-project/self-service-password/pull/588
@vboucard made their first contribution in https://github.com/ltb-project/self-service-password/pull/606
@liedekef made their first contribution in https://github.com/ltb-project/self-service-password/pull/609
@doc-slice made their first contribution in https://github.com/ltb-project/self-service-password/pull/619
@tleuxner made their first contribution in https://github.com/ltb-project/self-service-password/pull/628
@tvdijen made their first contribution in https://github.com/ltb-project/self-service-password/pull/646
@artlog made their first contribution in https://github.com/ltb-project/self-service-password/pull/673

Full Changelog: https://github.com/ltb-project/self-service-password/compare/v1.4.5...v1.5.0

:arrow_down: Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

You can also use our Docker image: https://hub.docker.com/r/ltbproject/self-service-password

v1.4.5

1 year ago

What's Changed

Latest version of 1.4.4 not working by @Max7641 in #670

Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

v1.4.4

1 year ago

What's Changed

Update bootstrap to v3.4.1 by @bohze in https://github.com/ltb-project/self-service-password/pull/663
Separate Smarty debug and debug by @coudot in https://github.com/ltb-project/self-service-password/pull/666
Typo in resetbytoken resulting in mails not being sent by @faust64 in https://github.com/ltb-project/self-service-password/pull/529
Don't send notification if modification failed by @faust64 in https://github.com/ltb-project/self-service-password/pull/542
PHP Fatal error: Uncaught TypeError: ldap_get_dn() in https://github.com/ltb-project/self-service-password/issues/648
REST files are not shipped in packages in https://github.com/ltb-project/self-service-password/issues/660

Full changelog: https://github.com/ltb-project/self-service-password/issues?q=is%3Aclosed+milestone%3A1.4.4

Download

Get tarball and packages on https://ltb-project.org/download.html

Use our apt and yum repositories to ease the installation:

v1.4.3

3 years ago

Some bug fixes for version 1.4:

#516: Docker image does not have sendmail in it
#517: fix(mail): add sendmail to Docker image
#520: [Security:high] Reset by SMS can be used to change any account password
#521: If token was provided by SMS, check initial SMS code before changing password
#522: [Security:low] Dismiss captcha once it is used

:warning: Some fixes concern security issues, please upgrade as soon as possible

Please read release notes from https://github.com/ltb-project/self-service-password/releases/tag/v1.4

v1.4.2

3 years ago

Some bug fixes for version 1.4:

#504: Cannot use docker get gregwar/captcha----use docker
#505: fix(captcha): missing gd library
#506: I have a little problem - I can't use SMS for the next step
#507: fix(reset)
#508: fix(undefined)
#511: Bump phpmailer/phpmailer from 6.3.0 to 6.4.1 in /lib

Please read release notes from https://github.com/ltb-project/self-service-password/releases/tag/v1.4