Sets a new password on a DRM account with the token from the link that the hacked e-mail list mails when a new device logs in to an account whose password may be known to attackers. Used by the public page /#/iptvreset on the reseller's portal.
No authentication: the token is the credential, so an unknown or expired token registers a brute force attempt for the client IP. The link is valid for 30 minutes and can be used once. The change sets passwordChangedAt on the account (iptvdrmaccounts) and is written to the change log as “Security: new password chosen through the hacked e-mail link”. Devices already on the account are not logged out.
| URL | https://api.telecomx.dk/iptv/app/setpassword | ||
|---|---|---|---|
| Method | POST | ||
| Access level | None (public), rate limited per IP. | ||
| Body | token | String | The token from the link. |
| password | String | The new password, 6-64 characters. Must differ from the current password. | |
{ token: 'Zm9vYmFyYmF6cXV4Y29ycmVjdGhvcnNl', password: 'NewSecret42' }
| Property | Type | Description |
|---|---|---|
| success | Boolean | True on success |
{ success: true }
| Error code | Message | Description |
|---|---|---|
| 422 | token | The token is missing, unknown, has been used or has expired. |
| 422 | password | The password is missing, shorter than 6 or longer than 64 characters, or (check same) it is the current password. |
| 429 | too_many_requests | Rate limit exceeded. |
| 500 | internal_error | <Unspecified> |