With [#8278] previous_login_details
started getting stored and backfilled after successful logins. With [#8279] to check for strong enough passwords during login, it relies on checking previous_login_details
to know what kind of password reset to do, but previous_login_details
might not be populated yet. So we should have a script to backfil that field for everyone so we can rely on it.
I think, I didn't get it, yet. Will I need to run this script at the next
Allura upgrade?
Yes, although its only really necessary if you want to enable the
auth.hibp_failure_force_pwd_change
setting. That new setting checks partial password hashes against https://haveibeenpwned.com/Passwords and forces affected users to change their password.(And the "NEEDS SCRIPT" in the ticket title will help us remember to include specific instructions when we make a release changelog).
db/8287
paste script path/to/your.ini allura/scripts/backfill_previous_login_details.py
Or run with task managerallura.scripts.backfill_previous_login_details.BackfillPreviousLoginDetails