Insecure password change function. Fixes #5538

[josegar74]

• Update API service to request the old password.
• Update the Administration UI to allow reset the password of the logged user. Administrators could also use the API service to reset the password of other users, but require to know the old user password, a bit unlikely. I don't see a reason for this as a user can reset his password or recover it.

[archaeogeek]

I haven't had chance to fully test all possible cases but in general it seems to work just fine

[pvgenuchten]

A script to add settings to the database is missing
Change password fails with a nullpointer if settings are unavailable

[josegar74]

@pvgenuchten the change doesn't use any setting. Can you add the stacktrace?

I just notice your UI is not updated, please check the wro4j cache.

[pvgenuchten]

Administrators could also use the API service to reset the password of other users, but require to know the old user password, a bit unlikely. I don't see a reason for this as a user can reset his password or recover it.

What Jo means is that when somebody walks to your screen, clicks change password and changes the password and can then use another machine to login with that password. For that case it is relevant also to provide the current password

[fxprunayre]

LGTM but if there is no mail server available to use the recover my password then it will not be possible to reset a user password (it will require to go in the DB).

@archaeogeek what do you think about keeping the reset password for administrator users on all users if no mail server available (like https://github.com/geonetwork/core-geonetwork/blob/master/web-ui/src/main/resources/catalog/templates/signin.html#L98) ?

[fxprunayre]

@archaeogeek @josegar74 any ideas for a workaround for the issue "if there is no mail server available to use the recover my password then it will not be possible to reset a user password (it will require to go in the DB)." ? A number of users get stucked on this when they have no smtp server and no db access.

[archaeogeek]

@fxprunayre I missed your comment before, sorry. Yes, I think that keeping the password reset option for administrators if there is no smtp or database access is fine.

[fxprunayre]

@archaeogeek discussing with @josegar74 we were thinking adding a setting so we can turn this on or off. Is this fine for you?

[archaeogeek]

@fxprunayre personally I agree. It might not pass a really strict penetration test though, because if an admin account is compromised, this setting could be changed, which would bypass this whole security fix.

[fxprunayre]

Maybe we could have a setting which is not defined in database by default. So when setting up a catalogue, user can choose to add it:

-- WARNING: Security / Add this settings only if you need to allow admin
-- users to be able to reset user password. If you have mail server configured
-- user can reset password directly. If not, then you may want to add that settings
-- if you don't have access to the database.
-- INSERT INTO Settings (name, value, datatype, position, internal) 
-- VALUES ('system/security/password/allowAdminReset', 'false', 2, 12004, 'n');

What do you think @archaeogeek @josegar74 ?
So an installation without that setting will always be secured from this point of view.

[josegar74]

@fxprunayre if we integrate this PR: #6161, I think we can add it with the default false value, so can't be edited in the UI? (instead of requiring to be added manually, no?)

[fxprunayre]

It is another level in between but if you know the API, you'll still be able to change the value ?