{"action":"created","issue":{"url":"https://api.github.com/repos/owncloud/core/issues/22276","repository_url":"https://api.github.com/repos/owncloud/core","labels_url":"https://api.github.com/repos/owncloud/core/issues/22276/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/core/issues/22276/comments","events_url":"https://api.github.com/repos/owncloud/core/issues/22276/events","html_url":"https://github.com/owncloud/core/pull/22276","id":132705597,"number":22276,"title":"Harden updater authentication","user":{"login":"LukasReschke","id":878997,"avatar_url":"https://avatars.githubusercontent.com/u/878997?v=3","gravatar_id":"","url":"https://api.github.com/users/LukasReschke","html_url":"https://github.com/LukasReschke","followers_url":"https://api.github.com/users/LukasReschke/followers","following_url":"https://api.github.com/users/LukasReschke/following{/other_user}","gists_url":"https://api.github.com/users/LukasReschke/gists{/gist_id}","starred_url":"https://api.github.com/users/LukasReschke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LukasReschke/subscriptions","organizations_url":"https://api.github.com/users/LukasReschke/orgs","repos_url":"https://api.github.com/users/LukasReschke/repos","events_url":"https://api.github.com/users/LukasReschke/events{/privacy}","received_events_url":"https://api.github.com/users/LukasReschke/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/owncloud/core/labels/3%20-%20To%20Review","name":"3 - To Review","color":"ededed"},{"url":"https://api.github.com/repos/owncloud/core/labels/enhancement","name":"enhancement","color":"02e10c"},{"url":"https://api.github.com/repos/owncloud/core/labels/in%20progress","name":"in progress","color":"ededed"},{"url":"https://api.github.com/repos/owncloud/core/labels/security","name":"security","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/owncloud/core/milestones/48","html_url":"https://github.com/owncloud/core/milestones/9.0-current","labels_url":"https://api.github.com/repos/owncloud/core/milestones/48/labels","id":1196845,"number":48,"title":"9.0-current","description":"","creator":{"login":"cmonteroluque","id":879976,"avatar_url":"https://avatars.githubusercontent.com/u/879976?v=3","gravatar_id":"","url":"https://api.github.com/users/cmonteroluque","html_url":"https://github.com/cmonteroluque","followers_url":"https://api.github.com/users/cmonteroluque/followers","following_url":"https://api.github.com/users/cmonteroluque/following{/other_user}","gists_url":"https://api.github.com/users/cmonteroluque/gists{/gist_id}","starred_url":"https://api.github.com/users/cmonteroluque/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmonteroluque/subscriptions","organizations_url":"https://api.github.com/users/cmonteroluque/orgs","repos_url":"https://api.github.com/users/cmonteroluque/repos","events_url":"https://api.github.com/users/cmonteroluque/events{/privacy}","received_events_url":"https://api.github.com/users/cmonteroluque/received_events","type":"User","site_admin":false},"open_issues":631,"closed_issues":1378,"state":"open","created_at":"2015-07-07T14:21:23Z","updated_at":"2016-02-10T14:21:56Z","due_on":"2016-03-08T04:00:00Z","closed_at":null},"comments":2,"created_at":"2016-02-10T13:53:11Z","updated_at":"2016-02-10T14:22:51Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/owncloud/core/pulls/22276","html_url":"https://github.com/owncloud/core/pull/22276","diff_url":"https://github.com/owncloud/core/pull/22276.diff","patch_url":"https://github.com/owncloud/core/pull/22276.patch"},"body":"- Reset tokens after 2 hours as discussed at https://github.com/owncloud/updater/issues/220#issuecomment-182033453\r\n- Used BCrypt for storing the password in the config.php. This makes it substantially harder in case of a leakage of the token to bruteforce it. In the future we can evaluate also an HMAC including the IP. That's a bit tricker though at the moment considering that we support reverse proxies. Didn't feel brave enough to touch that dragon now as well ;)\r\n\r\nReason behind this that if somebody is able to read the config file somehow this won't immediately result in a RCE.\r\n<hr/>\r\n\r\nRequires https://github.com/owncloud/updater/pull/239"},"comment":{"url":"https://api.github.com/repos/owncloud/core/issues/comments/182394470","html_url":"https://github.com/owncloud/core/pull/22276#issuecomment-182394470","issue_url":"https://api.github.com/repos/owncloud/core/issues/22276","id":182394470,"user":{"login":"MorrisJobke","id":245432,"avatar_url":"https://avatars.githubusercontent.com/u/245432?v=3","gravatar_id":"","url":"https://api.github.com/users/MorrisJobke","html_url":"https://github.com/MorrisJobke","followers_url":"https://api.github.com/users/MorrisJobke/followers","following_url":"https://api.github.com/users/MorrisJobke/following{/other_user}","gists_url":"https://api.github.com/users/MorrisJobke/gists{/gist_id}","starred_url":"https://api.github.com/users/MorrisJobke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MorrisJobke/subscriptions","organizations_url":"https://api.github.com/users/MorrisJobke/orgs","repos_url":"https://api.github.com/users/MorrisJobke/repos","events_url":"https://api.github.com/users/MorrisJobke/events{/privacy}","received_events_url":"https://api.github.com/users/MorrisJobke/received_events","type":"User","site_admin":false},"created_at":"2016-02-10T14:22:51Z","updated_at":"2016-02-10T14:22:51Z","body":":+1: "}}