Skip to content

v1.2.7

Choose a tag to compare

View all tags
@MichelleFindlay MichelleFindlay released this 13 Oct 00:12
· 20 commits to main since this release
v1.2.7
0732e9d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Stay signed in on the devices you use most, and reset a forgotten password yourself.

✨ New

Remember this device

  • Stay signed in: tick Remember this device above Sign in, and that phone or computer stays signed in for 90 days after you last used it. Each use starts the 90 days again, so devices you use often stay signed in. Leave it unticked on a shared or public computer.
  • Single sign-on: it works with Microsoft and the other sign-in buttons too.
  • PINs: Mind and the private pages still ask for their PIN.
  • Account → Sign-in: a new Remembered devices list shows each one (e.g. "Chrome on Linux"), with when it was remembered and last used. Forget any you no longer use.
  • When devices are forgotten:
    • Signing out forgets that device.
    • Sign out everywhere else and changing your password forget the others.
    • An admin resetting your password or disabling your account forgets them all.

Forgotten password

  • Reset by email: Forgotten your password? on the sign-in page emails a link to choose a new password, to the email address on your account.
  • The link: it works once, for an hour. Changing your password signs you out everywhere and sends an email confirming the change.
  • Privacy: the page gives the same answer whether or not an account exists, so it can't be used to find out who has one.
  • Who can use it: you need an email address on your account (add one under Account → Profile). If your Pillbox can't send email, or you sign in with Microsoft or another sign-in button, ask whoever runs it.

🔒 Security

  • Stored tokens: remembered devices and reset links are stored only as hashes, so a copy of the database can't be used to sign in.
  • Copied or guessed tokens: a remembered device whose cookie fails the check is forgotten straight away.
  • Reset links: a link is moved out of the address bar as soon as it's opened, and expired links are tidied up automatically.
  • Limits: at most 3 reset emails an hour per account, with the same throttling as failed sign-ins.

⚙️ For admins

  • remember_days (under 'app' in config/config.php) sets how long a remembered device stays signed in. The default is 90; 0 turns the option off.
  • Forgotten password needs email: set it up under Site settings → Email. Without email, people are told to ask you, and you can still reset passwords from Admin → Manage.

⬆️ Upgrading

Upload the new files over your current ones, keeping config/ and storage/. The database updates itself the next time a page is opened, adding the tables for remembered devices and password resets.

Full changelog: v1.2.6...v1.2.7

Assets 2
Loading