Require current password when changing your own password
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 42/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- python
- Domain
- authentication, backend, frontend, security
Research direction
Start at the update_account handler, which accepts a new password without checking the current one, and read the review thread of #378 for the earlier discussion. Add a current-password field to the Edit Account page and verify it on the backend whenever password is submitted. Done means a wrong or missing current password is rejected, and Google-login accounts either skip the check or cannot change a password, with a test covering each case. Confirm the Google-login choice with a maintainer before writing the code.
Written by the indexing model from the issue text.
Description
update_account lets a logged-in user set a new password without entering the current one, so anyone with access to a logged-in session can take over the account. Fix: add a current-password field on the Edit Account page and check it on the backend when password is sent. Google-login accounts have no password, so they need their own handling (either skip the check or don't offer password changes). This was already the case before #378 and was raised in its review.
- Dominant language
- Python
- Stars
- 13
- Forks
- 0
- Avg merge
- 2h 4m
- Merged PRs (30d)
- 1
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from kiat/codeAssist
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
kiat/codeAssist#391 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
kiat/codeAssist#364 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 63/100
kiat/codeAssist#392 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
kiat/codeAssist#390 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
kiat/codeAssist#389 ·
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Deltares/imod-python#1940 ·
Maintainers usually reply within 1 day
-
effort: low prio: low ready
Difficulty 1/5 Under an hour Newbie friendliness 82/100
digitalfabrik/integreat-cms#4621 ·
Maintainers usually reply within 5 days
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
ioos/compliance-checker#1375 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
netbox status: backlog topic: testing type: housekeeping
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
netbox-community/netbox#23395 ·
Maintainers usually reply within 1 day