[checkmk-commits] [tribe29/checkmk] 80e794: 11499 SEC Improve login session security

Branch: refs/heads/test_weblate2 Home: https://github.com/tribe29/checkmk Commit: 80e794a392285b5244eb2ffa732583c808f559dd https://github.com/tribe29/checkmk/commit/80e794a392285b5244eb2ffa732583c80… Author: Lars Michelsen &lt;lm(a)tribe29.com&gt; Date: 2020-10-02 (Fri, 02 Oct 2020) Changed paths: A .werks/11499 Log Message: ----------- 11499 SEC Improve login session security In previous Checkmk versions the login sessions were not tracked on the Checkmk server side. This means that a logout in the GUI was a pure client action destroying the authentication cookie. When the cookie was stored and reused later, the user was able to access the GUI again with that old login session which was logged out. This change extends the authentication cookie with a session ID which has to be known on the Checkmk server to result in a successful login. Once a login session is logging out from the GUI, the session is invalidated on the Checkmk server. If a client tries to access the GUI with an invalidated authentication cookie, the login will be rejected from now. Please note that we have added some limitations with this change: <ul> <li>Per user we can now have up to 20 parallel login sessions. Once a user account reaches the 21st sessions, the session with the longest inactivity will be invalidated.</li> <li>Existing sessions with an inactivity of more than 7 days will be invalidated.</li> </ul> The change of the authentication cookie requires all users to login again to the GUI after updating to Checkmk 2.0, because the cookie format is now incompatible with the authentication cookies issued by previous Checkmk versions. We use the incompatibility to switch the authentication cookie hashing algorithm from to sha256. The previous md5 at this point was not a security problem, but it can be considered bad practice. Change-Id: I434058cf28ea783c5e7a5f2abc5f09bb3eb03277 Commit: 9f10b8eedd379bae8fed2677556f9442e47ca6f0 https://github.com/tribe29/checkmk/commit/9f10b8eedd379bae8fed2677556f9442e… Author: Kenneth Okoh &lt;kenneth.okoh(a)tribe29.com&gt; Date: 2020-10-02 (Fri, 02 Oct 2020) Changed paths: M cmk/gui/htmllib.py M cmk/gui/plugins/sidebar/main_menu.py M web/htdocs/themes/facelift/scss/_mega_menu.scss M web/htdocs/themes/facelift/scss/_more.scss M web/htdocs/themes/facelift/scss/_page_menu.scss M web/htdocs/themes/facelift/scss/_pages.scss M web/htdocs/themes/facelift/scss/_variables.scss M web/htdocs/themes/modern-dark/scss/_variables.scss Log Message: ----------- UX Mega Menu: Show more/less buttons with text (CMK-5558) * Moved more/less image from an img tag to a div::after * Introduced a navigation bar for each mega menu Change-Id: I7961153853934bf69fb6139ae5917e53fa3b9c34 Commit: 92267731c647d6b5a3dc07b20f681a56f41cdb69 https://github.com/tribe29/checkmk/commit/92267731c647d6b5a3dc07b20f681a56f… Author: Joerg Herbel &lt;joerg.herbel(a)tribe29.com&gt; Date: 2020-10-02 (Fri, 02 Oct 2020) Changed paths: M locale/Makefile Log Message: ----------- Worked on locale/Makefile Change-Id: Ib0c72726097a66936110deb0a0b4380317b24a3b Commit: b25c6312c4372a29ec5cb289941288a5dedf4657 https://github.com/tribe29/checkmk/commit/b25c6312c4372a29ec5cb289941288a5d… Author: Joerg Herbel &lt;joerg.herbel(a)tribe29.com&gt; Date: 2020-10-02 (Fri, 02 Oct 2020) Changed paths: A .werks/11499 M cmk/gui/htmllib.py M cmk/gui/plugins/sidebar/main_menu.py M web/htdocs/themes/facelift/scss/_mega_menu.scss M web/htdocs/themes/facelift/scss/_more.scss M web/htdocs/themes/facelift/scss/_page_menu.scss M web/htdocs/themes/facelift/scss/_pages.scss M web/htdocs/themes/facelift/scss/_variables.scss M web/htdocs/themes/modern-dark/scss/_variables.scss Log Message: ----------- Merge branch 'master' into test_weblate2 Change-Id: I29d6410396244dbdd3d7b75ffed76bed05279c01 Compare: https://github.com/tribe29/checkmk/compare/f5ab401a7ecb...b25c6312c437