Skip to content

fix: allow admins to reset their own pass without old_password #2222

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jun 10, 2022
Merged

fix: allow admins to reset their own pass without old_password #2222

merged 1 commit into from
Jun 10, 2022

Conversation

f0ssel
Copy link
Contributor

@f0ssel f0ssel commented Jun 9, 2022

Fixes issue where you cannot reset your own password as an admin.

@f0ssel f0ssel requested review from kylecarbs, Emyrk and a team June 9, 2022 23:41
@f0ssel f0ssel enabled auto-merge (squash) June 9, 2022 23:52
deansheather
deansheather reviewed Jun 10, 2022
View reviewed changes
Copy link
Member

@deansheather deansheather left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why don't we just make a utility to do this directly via the DB instead of opening up a security hole like this. This could be made to only work on --dev installs if we do that

@Emyrk
Copy link
Member

Emyrk commented Jun 10, 2022

@deansheather I'm not sure if it's a security hole. Currently they can just make a new admin user and use that new user to reset their password.

@deansheather
Copy link
Member

Fair

@f0ssel f0ssel merged commit 92bda0d into main Jun 10, 2022
@f0ssel f0ssel deleted the f0ssel/fix-old-pass branch June 10, 2022 01:43
kylecarbs pushed a commit that referenced this pull request Jun 10, 2022
@f0ssel @kylecarbs
fix: allow admins to reset their own pass without old_password (#2222)
928315f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@deansheather deansheather deansheather approved these changes

@kylecarbs kylecarbs Awaiting requested review from kylecarbs

@Emyrk Emyrk Awaiting requested review from Emyrk

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@f0ssel @Emyrk @deansheather
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy