Admin->Basic Configuration: Receiver can be configured without an email about globaleaks HOT 5 CLOSED

There are two possible solution:

@hellais at the moment, the receiver, need a name for be create (POST) and then the update for be completed (PUT). In order to enforce username/mail, password fields, it's required change the client UX interaction, and perform with the creation operation only when the required fields are filled.

Or, without change the client interaction, can be created a status/marker in the receiver, like activate flag, and until the fields are not available, it's not possible activate the receiver.

This latest option it's probably required in the future, because receiver need to be handled with he status of "password lockdown" (and would mean, more or less, like the activate flag is set to False. When reactivated by the Admin, a new activation mail can be sent). And this latest option can be implemented without @hellais effort in change client UX.

from globaleaks.

I'd prefer to goes for the quickest solution, just to make the fields enforced on GLC and GLB.

Password lockout is a feature not currently provided for testing in the functional workflow.
I'm going to create a ticket of type "enhancement" to remind about this feature,requiring to touch many places in the code:

• the admin configuration of lockout
• the UI visualization on failed attempt (the user must be informed that he has remaining X passwords while typing)
• the concept of receiver activated/deactivated
• the logging of the security incident

from globaleaks.

I have made some changes to the UI of the add receivers so that it's no longer possible to add a receiver without an email address.

This is how it looks like:

from globaleaks.

I remove GLClient tag from the ticket, now it's only a GLB issue to be enforced.

from globaleaks.

done in https://github.com/globaleaks/GLBackend/commit/025f3cafa654d1849b268a72a87647eace775bf3 with unitTest and receiver notification_fields, too

from globaleaks.