Modify

Opened 11 years ago

Closed 11 years ago

Last modified 11 years ago

#682 closed defect (fixed)

User should know old password in order to change password

Reported by: dan@… Owned by: Matt Good
Priority: normal Component: AccountManagerPlugin
Severity: normal Keywords:
Cc: Trac Release: 0.9

Description

This is a pretty standard security thing. In an office of people using Trac, it prevents someone from locking a coworker out of their Trac account while they're at lunch...

Attachments (1)

require_old_password.diff (1.4 KB) - added by Michael Renzmann 11 years ago.
Patch: require old password to set a new one

Download all attachments as: .zip

Change History (5)

Changed 11 years ago by Michael Renzmann

Attachment: require_old_password.diff added

Patch: require old password to set a new one

comment:1 Changed 11 years ago by Michael Renzmann

The attached patch adds the requested feature. It is for trunk and has been lightly tested.

comment:2 in reply to:  1 ; Changed 11 years ago by rupert thurner

Replying to otaku42:

The attached patch adds the requested feature. It is for trunk and has been lightly tested.

the most typical use case of resetting the password is when you forgot your old one. how does this patch solve this use case?

comment:3 in reply to:  2 Changed 11 years ago by anonymous

Replying to ThurnerRupert:

Replying to otaku42:

The attached patch adds the requested feature. It is for trunk and has been lightly tested.

the most typical use case of resetting the password is when you forgot your old one. how does this patch solve this use case?

ThurnerRupert, this issue isn't meant to address the use-case you are identifying. (I am the original filer of the ticket.) It's only meant to address the requirement that you know the old password in order to change it.

comment:4 Changed 11 years ago by Matt Good

Resolution: fixed
Status: newclosed

(In [1709]) require users to enter current password in order to change their password or delete their accounts (fixes #682)

Modify Ticket

Change Properties
Set your email in Preferences
Action
as closed The owner will remain Matt Good.
The resolution will be deleted.

Add Comment


E-mail address and name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.