Syspass: Question about link to syspass

[SteeveGL]

Does there are a way to get url to the account detail? I think the API display the password, but it bypass the security, right?

So, what I would do is have a link to sysPass from my wiki and allow only permeated people to see the account detail.

[nuxsmin]

Hi, you are partially right, API access won't bypass security because it needs the user login and password to get the account password, but it shows the retrieved data in JSON format.

Recently I've developed a new module for public links that provides an URL for direct access to an account details, but they have an expiration time. It could be useful for you.

You can test it by downloading sysPass dev branch at github.

[SteeveGL]

What I'm looking for is more like: http://syspass.mydomain.com/accounts.php?id=15485453

So if you click that and you doesn't have the permission to see it, you get Acces Denied.

[nuxsmin]

Ummm, but how do you identify the requester?, and how do you provide the master pass to view its pass?

Don't miss that the master pass is not stored on the server (only encrypted with the user pass and a derivated key). So the only approach would be a hashed link, but I won't identify anybody.

[SteeveGL]

if you click on this: https://mail.google.com/mail/#inbox/14f93618566e413a, you will be redirect to the login page. If your sessionid is still active, you will see the email...

I would use sysPass has a password manager, but not necessarily the first place where people go to check passwords but on the wiki. Once they get information on the wiki, they could click on the link to get the user/pass (and use their sysPass account if the PHPSESSID timeout)

[stuba]

Whis sounds good feature :+1:

[LeDistordu]

Very important for me to be able to give link to a specific access in sysPass. For wiki / rocketchat conversation / Mail / ...

[nuxsmin]

Sure...this has been implemented for the next version.

You can try out it by downloading the devel branch.

[nuxsmin]

Done

[eriktack]

Where and how exactly is this implemented? I cant find a direct link to an account anywhere.
(not talking about the "public link"-feature).
Using version 2.1 (2.1.14.17090102)

[nuxsmin]

@ErikxNilsson your're right, the only way to get it is by creating a public link, since URL routing isn't fully implemented in sysPass.

Sorry about this, I missed to read the whole issue. I'll add it as a new feature request.

Thanks for the feedback!