Frontend: Administration Creature Comforts #242

New issue

Closed

opened 2022-11-18 22:46:24 +00:00 by sc-milo · 2 comments

sc-milo commented

2022-11-18 22:46:24 +00:00

Just a couple of ideas that would be useful for migrating a herd of users over to Misskey from another platform since the frontend already allows generation of new user accounts.

Modify a User's user_profile entry (such as Email, Verification Status).

Did this by hand by editing the database already.

A Button to execute password reset links (to copy paste, or send via SMTP).

Can be done by requesting a password reset like a normal user from the login page.

Just a couple of ideas that would be useful for migrating a herd of users over to Misskey from another platform since the frontend already allows generation of new user accounts. - [ ] Modify a User's user_profile entry (such as Email, Verification Status). > Did this by hand by editing the database already. - [ ] A Button to execute password reset links (to copy paste, or send via SMTP). > Can be done by requesting a password reset like a normal user from the login page.

Johann150 commented

2022-11-19 12:18:18 +00:00

Owner

I think regarding to the 1st point we need to be clear on which columns exactly may be modified by an admin. Because I think many columns should not be modified by an admin.

For example, I do not think administrators should ever reset/remove two factor authentication, because that undermines the security advantage that 2FA provides if the admin can be social engineered into resetting it. Of course the admin can still do so through the database but we should not make it easy to do so IMHO.

Regarding the 2nd point: Why can you not use the already existing password recovery process?

I think regarding to the 1st point we need to be clear on which columns exactly may be modified by an admin. Because I think many columns should not be modified by an admin. For example, I do not think administrators should ever reset/remove two factor authentication, because that undermines the security advantage that 2FA provides if the admin can be social engineered into resetting it. Of course the admin can still do so through the database but we should not make it easy to do so IMHO. Regarding the 2nd point: Why can you not use the already existing password recovery process?

Johann150 added the

feature

label 2022-12-23 10:29:53 +00:00

Johann150 commented

2023-01-12 18:53:59 +00:00

Owner

There already is a button to reset the user's password to a randomly generated one. See users profile -> three dot menu -> About -> "Reset password" button at end of "Moderation" section.

Johann150 closed this issue

2023-01-12 18:54:00 +00:00