Password can be reset wiithout new password confirmation.

[ilhamije]

Issue Description

User can reset their password by only fiilling out new password field without filling out password confirmation.

How to reproduce it:

1. Go to https://www.freecodecamp.org/forgot and try to reset your password.
2. Open a confirmation email from FCC to be directed to reset password page.
3. Fill out your new password on the New Password field and leave the Confirm Password blank.
4. Hit Change Password button.
5. Try to login with your new password.

Browser Information

• Browser Name, Version: Google Chrome Version 58.0.3029.110 (64-bit)
• Operating System: Linux Ubuntu 16.04
• On Desktop

Screenshot

[raisedadead]

This essentially needs a client-side validation of the password to be same in both the inputs, and should be added here.

https://github.com/freeCodeCamp/freeCodeCamp/blob/backup/master/server/views/account/reset.jade#L15

The server-side code is all fine.

[raisedadead]

Potential contributors, please add some jQuery based validation in the reset view mentioned above. Also note that this needs to go into the backup/master branch.

Happy fixing!

[shovanch]

@raisedadead Looking forward to fix this. This would be my first open source contribution to freeCodeCamp

[raisedadead]

Yes please go ahead!

[msasad]

All input validations must be carried out on the server side also. Just client side validation is not the solution. Server side code needs to be fixed as well.

[raisedadead]

Server side code needs to be fixed as well.

Please elaborate, or point to code which is to be fixed.

[tracyalison11]

Are you looking for the change password button to be disabled until both inputs are filled and matched or do you want an error message thrown?

[raisedadead]

@tracyalison11 we would like to display an error message (basic html5 validation), and of course blocking the submit until the form has validated.

some inspiration https://www.html5rocks.com/en/tutorials/forms/constraintvalidation/

[shovanch]

@raisedadead I have been working on this. Hoping to add PR before the end of the day

[msasad]

Please elaborate, or point to code which is to be fixed.

If password can be changed without confirmation, this clearly means that there is no validation on the server side. The lack of validation at the server side itself is an issue which needs to be fixed.
The answer to this SF question might help in understanding why server side validation is necessary.
While it is better to have validation on both sides, if we ever choose to have validation in only one side, then it has to be at the server.

[raisedadead]

If password can be changed without confirmation, this clearly means that there is no validation on the server side.

Did you get a chance to look at the server side code and confirm this? And that there is actually no validation?

What the SF article suggests is totally valid, and thanks for sharing it.

... Server-side validation is also crucial due to the fact that client-side validation can be completely bypassed by turning off JavaScript. ...

But that said, the use case we have here has one additional server-side check already. Hence my comments earlier. IMHO, I suggest you to please confirm this yourself if you so, please by actually checking the code. Should you face issues finding it, we would be glad to help you.

Yes, that said the client side view needs to be fixed, which again as per the article you shared:

... In practice, all it does is prevent your client (with JS enabled) to know whether the form is okay ...

And I totally agree.

Finally, this issue basically boils down to the fact that we had missed doing so in letting the user know that the form was not okay, as pointed out by OP.

[mohisen]

Thanks a lot ‏في الثلاثاء، ٢٦ سبتمبر، ٢٠١٧, mrugesh mohapatra <notifications@github.com> كتب:

…

If password can be changed without confirmation, this clearly means that there is no validation on the server side. Did you get a chance to look at the server side code and confirm this? And that there is actually no validation? What the SF article suggests is totally valid, and thanks for sharing it. *... Server-side validation is also crucial due to the fact that client-side validation can be completely bypassed by turning off JavaScript. ...* But that said, the use case we have here has one additional server-side check already. Hence my comments earlier. IMHO, I suggest you to please confirm this yourself if you so, please by actually checking the code. Should you face issues finding it, we would be glad to help you. Yes, that said the client side view needs to be fixed, which again as per the article you shared: *... In practice, all it does is prevent your client (with JS enabled) to know whether the form is okay ...* And I totally agree. Finally, this issue basically boils down to the fact that we had missed doing so in letting the user know that the form was not okay, as pointed out by OP. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#15909 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AYPt1YgL5wWUzn87k1_X2r1oA9xoaf7rks5smSSVgaJpZM4PhIhj> .