Secure users API and handle manual password recovery.

gns3server/db/models/users.py

@@ -37,6 +37,7 @@ class User(BaseTable):
     is_active = Column(Boolean, default=True)
     is_superadmin = Column(Boolean, default=False)
 
+
 @event.listens_for(User.__table__, 'after_create')
 def create_default_super_admin(target, connection, **kw):
 
@@ -49,4 +50,4 @@ def create_default_super_admin(target, connection, **kw):
     )
     connection.execute(stmt)
     connection.commit()
-    log.info("Default super admin account added")
+    log.info("The default super admin account has been created in the database")

gns3server/db/repositories/users.py

@@ -26,6 +26,10 @@ import gns3server.db.models as models
 from gns3server import schemas
 from gns3server.services import auth_service
 
+import logging
+
+log = logging.getLogger(__name__)
+
 
 class UsersRepository(BaseRepository):
     def __init__(self, db_session: AsyncSession) -> None:
@@ -93,6 +97,13 @@ class UsersRepository(BaseRepository):
         user = await self.get_user_by_username(username)
         if not user:
             return None
+        # Allow user to be authenticated if hashed password in the db is null
+        # this is useful for manual password recovery like:
+        # sqlite3 gns3_controller.db "UPDATE users SET hashed_password = null WHERE username = 'admin';"
+        if user.hashed_password is None:
+            log.warning(f"User '{username}' has been authenticated without a password "
+                        f"configured. Please set a new password.")
+            return user
         if not self._auth_service.verify_password(password, user.hashed_password):
             return None
         return user