API : IPTV : App : Set Password

Introduction

Sets a new password on a DRM account with the token from the link that the hacked e-mail list mails when a new device logs in to an account whose password may be known to attackers. Used by the public page /#/iptvreset on the reseller's portal.

No authentication: the token is the credential, so an unknown or expired token registers a brute force attempt for the client IP. The link is valid for 30 minutes and can be used once. The change sets passwordChangedAt on the account (iptvdrmaccounts) and is written to the change log as “Security: new password chosen through the hacked e-mail link”. Devices already on the account are not logged out.

Request

URL	https://api.telecomx.dk/iptv/app/setpassword
Method	POST
Access level	None (public), rate limited per IP.
Body	token	String	The token from the link.
Body	password	String	The new password, 6-64 characters. Must differ from the current password.

Body example

{
  token: 'Zm9vYmFyYmF6cXV4Y29ycmVjdGhvcnNl',
  password: 'NewSecret42'
}

Response

Property	Type	Description
success	Boolean	True on success

Example

{
  success: true
}

Errors

Error code	Message	Description
422	token	The token is missing, unknown, has been used or has expired.
422	password	The password is missing, shorter than 6 or longer than 64 characters, or (check `same`) it is the current password.
429	too_many_requests	Rate limit exceeded.
500	internal_error	<Unspecified>

WIKI

Table of Contents