admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4725 - sessions end on password reset and login disabled, exact login route, default SuperUser limited when licensed

Browse Source 
A password set by someone else (reset code, administrator) or a disabled
login replaces the user's session token and download key; changing one's
own password keeps the session. PasswordResetCodeExpire is cleared (was
DlKeyExpire). The token middleware exempts only the exact login and
notify/hello routes and refuses inactive users and users who may not log
in. With a purchased licence, notify/hello no longer offers the default
SuperUser login and a SuperUser with the default password may only change
it (SuperUserDefaultPasswordRoutes). F7, F8 and F9 fixed. Manual and
changelog updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 19:54:03 -07:00
parent 4141217c04
commit 80f81aea0f
12 changed files with 123 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/8.0/ayanova/docs/ay-evaluate.md
View File

@@ -60,7 +60,7 @@ The default login for the AyaNova SuperUser account is user name: `superuser` pa
Before AyaNova is licensed and used in production or before you import / migrate or enter any real world data into an evaluation AyaNova you **MUST** change the sample User passwords or anyone could potentially login and view your data.
AyaNova will prompt you to change it if it discovers a login using the default superuser password with a non evaluation license.
With a non evaluation license, AyaNova requires it to be changed: a login using the default superuser password can only be used to change the password, until it is changed.
## Generating sample data

2
docs/8.0/ayanova/docs/ay-start-login.md
View File

@@ -36,7 +36,7 @@ The default login for the AyaNova SuperUser account is user name: `superuser` pa
Before AyaNova is licensed and used in production you **MUST** change this or anyone could login with this default.
AyaNova will prompt you to change it if it discovers a login using the default superuser password with a non evaluation license.
With a non evaluation license, AyaNova requires it to be changed: a login using the default superuser password can only be used to change the password, until it is changed.
The built-in SuperUser User account in AyaNova is not a normal type of User and does not consume a license; it is used for specific special operations in AyaNova that could lead to loss of data or affect the operations of the server over all.

2
docs/8.0/ayanova/docs/changelog.md
View File

@@ -27,6 +27,8 @@ IN PROGRESS
- Server: log files are now named with an increasing number when they are archived; the [server log](ops-log.md) form lists them newest first.
- Server: removed an unused internal performance profiling component.
- Server: AyaNova now checks the email (SMTP) server's security certificate when sending email. If your mail server uses a self-signed or internal certificate and email notifications stop after upgrading, see [SMTP certificate check](ops-config-smtp-accept-any-certificate.md).
- Server: when a user's password is reset or set by an administrator, or their login is disabled, they are signed out and must sign in again.
- Server: on a server with a purchased license, the SuperUser account can only be used to change its password while it still has the default password, and the login form no longer offers the default SuperUser login. See [SuperUser login](ay-start-login.md).
- Server: the SMTP server password is no longer shown in the [notification settings](ops-notification-system.md) form; it shows `********` when a password is set. Type a new password to change it.
- Linux: Ubuntu 24.04 and 26.04 are now tested and supported. On Ubuntu 24.04 and newer the .NET runtime is installed from Ubuntu's own package archive.
- Docs: updated the [Linux server](ops-install-linux-server.md), [Linux desktop](ops-install-linux-desktop.md), [Windows local network](ops-install-windows-lan.md) and [Windows IIS](ops-install-windows-iis.md) installation and upgrade instructions for .NET 10 and Ubuntu 24.04 / 26.04.

2
docs/8.0/ayanova/docs/tour-bootstrap-configure.md
View File

@@ -36,7 +36,7 @@ It is **critically important** to do this before taking any further steps; parti
Failing to do this would mean you will have no effective security as the AyaNova superuser password is well known and could be used by anyone to cause significant damage to your data or create more Users with administrative level privileges.
Once AyaNova is licensed, if you log in as the superuser with the default password `l3tm3in`, you will be taken automatically to the change password form to encourage it to be changed.
Once AyaNova is licensed, if you log in as the superuser with the default password `l3tm3in`, you will be taken automatically to the change password form, and the rest of AyaNova can not be used by the superuser until the password is changed.
We have [secure password guidelines](home-password.md#what-is-a-secure-password) for the latest best practices in choosing a secure password and we encourage you to read about it and consider the advice written there in order to choose an easy to memorize, secure password that does not need to be written down or stored insecurely.