Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 339413

Summary:	Changing password should require old password
Product:	[ECD] Orion	Reporter:	John Arthorne <john.arthorne>
Component:	Client	Assignee:	Malgorzata Janczarska <malgorzata.tomczyk>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	P3
Version:	0.2
Target Milestone:	0.2
Hardware:	PC
OS:	Windows 7
Whiteboard:

Description John Arthorne

2011-03-09 14:05:46 EST

Currently I can change a password without knowing my old password. This is bad because:

- If someone accessed my machine when I'm not looking, they can change my password
- If malicious code somehow gets into our pages it can invoke the service to change passwords without knowing the current one.

However the admin user needs to be able to change passwords without knowing the old one, for the case where the user has forgotten their password. So, I suggest:

The service call to change password accept both old and new passwords. If the currently authenticated user is the administrator, the old password is not ignored/not required. If the currently authenticated user is not the administartor, we check for a match on the old password before processing the request.

Comment 1 Malgorzata Janczarska

2011-05-06 11:10:40 EDT

done