New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Administrator can change user's password #1451
Conversation
Thanks for your contribution. I had just a cursory look, so no detailed but some general comments at the moment.
|
Fixes #15658
This reverts commit 4aaa09c.
I've added the conditional statement for login method. AFAIK MD5 is the only method which uses mantis database as a source of truth, so this feature is not relevant for other methods. |
@atrol |
Not true. I don't have enough time at the moment to provide a lot of feedback. Please have a look at account_page.php and function auth_process_plain_password in authentication_api.php to get some hints how to find out if password can be changed, the right length of the password field in form, the right password string to store, ... |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @callmecabman for your contribution.
We shouldn't have any logic that is specific to one approach of storing/hashing passwords. See my detailed comments.
We should also check if target user is allowed to change their password. For example, a user that logs in via LDAP or Office 365 or Google doesn't have a password with us and we shouldn't show the feature for changing password. See account_page.php
and use of auth_can_set_password()
. However, note that we need to check that target user's password can't be changed and not the password of the logged in admin, because they may use different models.
@@ -186,6 +199,10 @@ | |||
$t_changes .= lang_get( 'username_label' ) . ' ' . $t_old_username . ' => ' . $f_username . "\n"; | |||
} | |||
|
|||
if( $t_password_changed ) { | |||
$t_changes .= lang_get( 'password' ) . ' ' . $t_old_password . ' => ' . "[REDACTED]" . "\n"; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[REDACTED]
is not localized, and we shouldn't show old password. I would just have a localized message here that password was changed.
@@ -127,6 +127,24 @@ | |||
</td> | |||
</tr> | |||
|
|||
<!-- Password --> | |||
<?php | |||
if ( MD5 == $g_login_method ) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We shouldn't have password type specific logic here. Look at account_update.php and see how it changes the password via standard APIs that handles all hashing models via user_set_password()
.
@@ -356,6 +356,7 @@ $s_change_preferences_link = 'Preferences'; | |||
$s_edit_account_title = 'Edit Account'; | |||
$s_username = 'Username'; | |||
$s_username_label = 'Username'; | |||
$s_password_hash_notice = 'Password hash is being displayed. Enter plaintext to change the password.'; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why do we want to display the password hash? That is a security issue.
@callmecabman are you planning to address / respond to the above review comments ? |
There is a plenty of local MantisBT installations where managing passwords with email reset is simply not feasible.