Account Lock Bypass via Password Reset Flow

[marcoAntonioNina]

Issue & Reproduction Steps

During the process of resetting a password in the Forgot Password section, it was possible to access the user's session even if the user was locked out.

Solution

• Now, if a user is locked out and accesses the Forgot Password section, they are no longer sent the password reset email.

How to Test

This should be tested with both active and locked users in the Forgot Password section.

Related Tickets & Packages

• FOUR-30040

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

ci:deploy

[processmaker-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[Kookster310]

QA server K8S was successfully deployed https://ci-e064d31301.engk8s.processmaker.net