Skip to content

old password validation on change password flow #15202

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
defelmnq opened this issue Oct 23, 2024 · 1 comment
Closed

old password validation on change password flow #15202

defelmnq opened this issue Oct 23, 2024 · 1 comment
Assignees
@defelmnq

Comments

@defelmnq
Copy link
Contributor

The flow allowing users to change their current password is missing the part validating that the old password is indeed the correct one.

There's two logic :

  • One, as an admin, allowing me to change the password of any user. This one is used to reset, as an admin, the password of a user when this one forget it.
  • One, as a regular user, allowing me to change my password. This flow is done from your settings page and requires you to know your current password.

The logic is here.
@coder-labeler coder-labeler bot added the bug risk Prone to bugs label Oct 23, 2024
@defelmnq defelmnq mentioned this issue Oct 23, 2024
Merged
@defelmnq defelmnq self-assigned this Oct 24, 2024
@defelmnq defelmnq mentioned this issue Oct 24, 2024
Merged
@coadler coadler removed the bug risk Prone to bugs label Oct 24, 2024
defelmnq added a commit that referenced this issue Oct 24, 2024
@defelmnq
fix(coderd): improve password update logic (#15210)
e566872 
Working on #15202

The main change is to fetch the user doing the action to verify if it
should be able to change the password if there's no old_password set.
@defelmnq
Copy link
Contributor Author

Fixed ✅

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@defelmnq defelmnq

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@coadler @defelmnq