mirror of
https://github.com/mail-in-a-box/mailinabox.git
synced 2026-03-12 17:07:23 +01:00
Use persistent_login plugin's "Auth Token" support for Roundcube. The old way was very insecure and is subject to dictionary attack of the unsalted encrypted password stored in a browser cookie.
This commit is contained in:
14
conf/persistent_login-sqlite.sql
Normal file
14
conf/persistent_login-sqlite.sql
Normal file
@@ -0,0 +1,14 @@
|
||||
PRAGMA foreign_keys = ON;
|
||||
|
||||
CREATE TABLE IF NOT EXISTS `auth_tokens` (
|
||||
`token` TEXT NOT NULL,
|
||||
`expires` TEXT NOT NULL,
|
||||
`user_id` INTEGER NOT NULL,
|
||||
`user_name` TEXT NOT NULL,
|
||||
`user_pass` TEXT NOT NULL,
|
||||
`host` TEXT NOT NULL,
|
||||
PRIMARY KEY(`token`),
|
||||
FOREIGN KEY(`user_id`) REFERENCES `users`(`user_id`) ON DELETE CASCADE
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS `user_id_fk_auth_tokens` ON `auth_tokens`(`user_id`);
|
||||
Reference in New Issue
Block a user