GitHub PullRequestEvent at 2014-07-19 03:47:51
Repository: openmrs-contrib-id
Actor: elliottwilliams
Payload: {"action":"closed","number":12,"pull_request":{"url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/pulls/12","id":18615800,"html_url":"https://github.com/openmrs/openmrs-contrib-id/pull/12","diff_url":"https://github.com/openmrs/openmrs-contrib-id/pull/12.diff","patch_url":"https://github.com/openmrs/openmrs-contrib-id/pull/12.patch","issue_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/issues/12","number":12,"state":"closed","title":"ID-42 (3): Fixed password middleware relying on req.session","user":{"login":"elliottwilliams","id":910198,"avatar_url":"https://avatars.githubusercontent.com/u/910198?","gravatar_id":"9671c7e02ed9235482bc758105e37a21","url":"https://api.github.com/users/elliottwilliams","html_url":"https://github.com/elliottwilliams","followers_url":"https://api.github.com/users/elliottwilliams/followers","following_url":"https://api.github.com/users/elliottwilliams/following{/other_user}","gists_url":"https://api.github.com/users/elliottwilliams/gists{/gist_id}","starred_url":"https://api.github.com/users/elliottwilliams/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elliottwilliams/subscriptions","organizations_url":"https://api.github.com/users/elliottwilliams/orgs","repos_url":"https://api.github.com/users/elliottwilliams/repos","events_url":"https://api.github.com/users/elliottwilliams/events{/privacy}","received_events_url":"https://api.github.com/users/elliottwilliams/received_events","type":"User","site_admin":false},"body":"My changes in #9 broke the middleware used to validate passwords. (note to self: should be testing that piece of middleware.) It was using `req.session.user.password` to check the hash, and my change removed `password` from the session data.\r\n\r\nI've stuck by that change and am using a query to re-obtain the user object in this middleware function. Here's why:\r\n\r\n- The session object is accessible from the view renderer. This means that anyone who maliciously manipulates ejs (for example code injection) could potentially read password hashes. I'd rather not have to worry about this point of failure.\r\n- There's only a minimal performance drawback to adding a DB query here, since few users are changing their passwords.\r\n- While session data is stored on the same MongoDB server as the user table is *right now*, there's always potential to move session data elsewhere in the future (e.g. redis, for faster performance). I'd prefer the minimum number of copies of password hashes, regardless.","created_at":"2014-07-19T00:56:05Z","updated_at":"2014-07-19T03:47:49Z","closed_at":"2014-07-19T03:47:49Z","merged_at":"2014-07-19T03:47:49Z","merge_commit_sha":"d0a10070687fc04c7909a57a70d3bc7111268244","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/pulls/12/commits","review_comments_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/pulls/12/comments","review_comment_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/pulls/comments/{number}","comments_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/issues/12/comments","statuses_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/statuses/32f9d53c98f56b47fa0b215aa968e5094fdab84b","head":{"label":"elliottwilliams:ID-42","ref":"ID-42","sha":"32f9d53c98f56b47fa0b215aa968e5094fdab84b","user":{"login":"elliottwilliams","id":910198,"avatar_url":"https://avatars.githubusercontent.com/u/910198?","gravatar_id":"9671c7e02ed9235482bc758105e37a21","url":"https://api.github.com/users/elliottwilliams","html_url":"https://github.com/elliottwilliams","followers_url":"https://api.github.com/users/elliottwilliams/followers","following_url":"https://api.github.com/users/elliottwilliams/following{/other_user}","gists_url":"https://api.github.com/users/elliottwilliams/gists{/gist_id}","starred_url":"https://api.github.com/users/elliottwilliams/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elliottwilliams/subscriptions","organizations_url":"https://api.github.com/users/elliottwilliams/orgs","repos_url":"https://api.github.com/users/elliottwilliams/repos","events_url":"https://api.github.com/users/elliottwilliams/events{/privacy}","received_events_url":"https://api.github.com/users/elliottwilliams/received_events","type":"User","site_admin":false},"repo":{"id":20122280,"name":"openmrs-contrib-id","full_name":"elliottwilliams/openmrs-contrib-id","owner":{"login":"elliottwilliams","id":910198,"avatar_url":"https://avatars.githubusercontent.com/u/910198?","gravatar_id":"9671c7e02ed9235482bc758105e37a21","url":"https://api.github.com/users/elliottwilliams","html_url":"https://github.com/elliottwilliams","followers_url":"https://api.github.com/users/elliottwilliams/followers","following_url":"https://api.github.com/users/elliottwilliams/following{/other_user}","gists_url":"https://api.github.com/users/elliottwilliams/gists{/gist_id}","starred_url":"https://api.github.com/users/elliottwilliams/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elliottwilliams/subscriptions","organizations_url":"https://api.github.com/users/elliottwilliams/orgs","repos_url":"https://api.github.com/users/elliottwilliams/repos","events_url":"https://api.github.com/users/elliottwilliams/events{/privacy}","received_events_url":"https://api.github.com/users/elliottwilliams/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/elliottwilliams/openmrs-contrib-id","description":"A self-service management system for the OpenMRS ID single sign on identity.","fork":true,"url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id","forks_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/forks","keys_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/keys{/key_id}","collaborators_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/teams","hooks_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/hooks","issue_events_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/issues/events{/number}","events_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/events","assignees_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/assignees{/user}","branches_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/branches{/branch}","tags_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/tags","blobs_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/git/refs{/sha}","trees_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/git/trees{/sha}","statuses_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/statuses/{sha}","languages_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/languages","stargazers_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/stargazers","contributors_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/contributors","subscribers_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/subscribers","subscription_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/subscription","commits_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/commits{/sha}","git_commits_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/git/commits{/sha}","comments_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/comments{/number}","issue_comment_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/issues/comments/{number}","contents_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/contents/{+path}","compare_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/compare/{base}...{head}","merges_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/merges","archive_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/downloads","issues_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/issues{/number}","pulls_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/pulls{/number}","milestones_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/milestones{/number}","notifications_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/labels{/name}","releases_url":"https://api.github.com/repos/elliottwilliams/openmrs-contrib-id/releases{/id}","created_at":"2014-05-24T04:57:31Z","updated_at":"2014-07-16T14:21:34Z","pushed_at":"2014-07-19T00:48:50Z","git_url":"git://github.com/elliottwilliams/openmrs-contrib-id.git","ssh_url":"git@github.com:elliottwilliams/openmrs-contrib-id.git","clone_url":"https://github.com/elliottwilliams/openmrs-contrib-id.git","svn_url":"https://github.com/elliottwilliams/openmrs-contrib-id","homepage":"","size":1530,"stargazers_count":1,"watchers_count":1,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"openmrs:master","ref":"master","sha":"45699066a8c66c0339485d818a9f2e2bff16baa6","user":{"login":"openmrs","id":860776,"avatar_url":"https://avatars.githubusercontent.com/u/860776?","gravatar_id":"69dec0e05ef979a50cf839fad032afe0","url":"https://api.github.com/users/openmrs","html_url":"https://github.com/openmrs","followers_url":"https://api.github.com/users/openmrs/followers","following_url":"https://api.github.com/users/openmrs/following{/other_user}","gists_url":"https://api.github.com/users/openmrs/gists{/gist_id}","starred_url":"https://api.github.com/users/openmrs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openmrs/subscriptions","organizations_url":"https://api.github.com/users/openmrs/orgs","repos_url":"https://api.github.com/users/openmrs/repos","events_url":"https://api.github.com/users/openmrs/events{/privacy}","received_events_url":"https://api.github.com/users/openmrs/received_events","type":"Organization","site_admin":false},"repo":{"id":3069589,"name":"openmrs-contrib-id","full_name":"openmrs/openmrs-contrib-id","owner":{"login":"openmrs","id":860776,"avatar_url":"https://avatars.githubusercontent.com/u/860776?","gravatar_id":"69dec0e05ef979a50cf839fad032afe0","url":"https://api.github.com/users/openmrs","html_url":"https://github.com/openmrs","followers_url":"https://api.github.com/users/openmrs/followers","following_url":"https://api.github.com/users/openmrs/following{/other_user}","gists_url":"https://api.github.com/users/openmrs/gists{/gist_id}","starred_url":"https://api.github.com/users/openmrs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openmrs/subscriptions","organizations_url":"https://api.github.com/users/openmrs/orgs","repos_url":"https://api.github.com/users/openmrs/repos","events_url":"https://api.github.com/users/openmrs/events{/privacy}","received_events_url":"https://api.github.com/users/openmrs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openmrs/openmrs-contrib-id","description":"A self-service management system for the OpenMRS ID single sign on identity.","fork":false,"url":"https://api.github.com/repos/openmrs/openmrs-contrib-id","forks_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/forks","keys_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/teams","hooks_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/hooks","issue_events_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/issues/events{/number}","events_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/events","assignees_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/assignees{/user}","branches_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/branches{/branch}","tags_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/tags","blobs_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/git/refs{/sha}","trees_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/statuses/{sha}","languages_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/languages","stargazers_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/stargazers","contributors_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/contributors","subscribers_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/subscribers","subscription_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/subscription","commits_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/commits{/sha}","git_commits_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/git/commits{/sha}","comments_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/comments{/number}","issue_comment_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/issues/comments/{number}","contents_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/contents/{+path}","compare_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/merges","archive_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/downloads","issues_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/issues{/number}","pulls_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/pulls{/number}","milestones_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/milestones{/number}","notifications_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/labels{/name}","releases_url":"https://api.github.com/repos/openmrs/openmrs-contrib-id/releases{/id}","created_at":"2011-12-29T16:15:25Z","updated_at":"2014-06-25T23:27:43Z","pushed_at":"2014-07-19T03:47:51Z","git_url":"git://github.com/openmrs/openmrs-contrib-id.git","ssh_url":"git@github.com:openmrs/openmrs-contrib-id.git","clone_url":"https://github.com/openmrs/openmrs-contrib-id.git","svn_url":"https://github.com/openmrs/openmrs-contrib-id","homepage":"","size":6296,"stargazers_count":3,"watchers_count":3,"language":"JavaScript","has_issues":false,"has_downloads":true,"has_wiki":false,"forks_count":4,"mirror_url":null,"open_issues_count":0,"forks":4,"open_issues":0,"watchers":3,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openmrs/openmrs-contrib-id/pulls/12"},"html":{"href":"https://github.com/openmrs/openmrs-contrib-id/pull/12"},"issue":{"href":"https://api.github.com/repos/openmrs/openmrs-contrib-id/issues/12"},"comments":{"href":"https://api.github.com/repos/openmrs/openmrs-contrib-id/issues/12/comments"},"review_comments":{"href":"https://api.github.com/repos/openmrs/openmrs-contrib-id/pulls/12/comments"},"review_comment":{"href":"https://api.github.com/repos/openmrs/openmrs-contrib-id/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/openmrs/openmrs-contrib-id/pulls/12/commits"},"statuses":{"href":"https://api.github.com/repos/openmrs/openmrs-contrib-id/statuses/32f9d53c98f56b47fa0b215aa968e5094fdab84b"}},"merged":true,"mergeable":null,"mergeable_state":"unknown","merged_by":{"login":"elliottwilliams","id":910198,"avatar_url":"https://avatars.githubusercontent.com/u/910198?","gravatar_id":"9671c7e02ed9235482bc758105e37a21","url":"https://api.github.com/users/elliottwilliams","html_url":"https://github.com/elliottwilliams","followers_url":"https://api.github.com/users/elliottwilliams/followers","following_url":"https://api.github.com/users/elliottwilliams/following{/other_user}","gists_url":"https://api.github.com/users/elliottwilliams/gists{/gist_id}","starred_url":"https://api.github.com/users/elliottwilliams/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elliottwilliams/subscriptions","organizations_url":"https://api.github.com/users/elliottwilliams/orgs","repos_url":"https://api.github.com/users/elliottwilliams/repos","events_url":"https://api.github.com/users/elliottwilliams/events{/privacy}","received_events_url":"https://api.github.com/users/elliottwilliams/received_events","type":"User","site_admin":false},"comments":0,"review_comments":0,"commits":1,"additions":19,"deletions":10,"changed_files":1}}