diff options
| author | zeripath <art27@cantab.net> | 2020-12-12 18:59:49 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-12-12 19:59:49 +0100 |
| commit | 287b594803105ba517680aa50be478648d434035 (patch) | |
| tree | 87072d48637929757841c9b4d705041c13290503 /routers | |
| parent | d07b8a75d7072a9178358b720fb2da656130e5ff (diff) | |
| download | gitea-287b594803105ba517680aa50be478648d434035.tar.gz gitea-287b594803105ba517680aa50be478648d434035.zip | |
Whenever the password is updated ensure that the hash algorithm is too (#13966)
`user.HashPassword` may potentially - and in fact now likely does - change
the `passwd_hash_algo` therefore whenever the `passwd` is updated, this
also needs to be updated.
Fix #13832
Thanks @fblaese for the hint
Signed-off-by: Andrew Thornton <art27@cantab.net>
Diffstat (limited to 'routers')
| -rw-r--r-- | routers/user/auth.go | 4 | ||||
| -rw-r--r-- | routers/user/setting/account.go | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/routers/user/auth.go b/routers/user/auth.go index 38e90cbef1..1e34099411 100644 --- a/routers/user/auth.go +++ b/routers/user/auth.go @@ -1514,7 +1514,7 @@ func ResetPasswdPost(ctx *context.Context) { } u.HashPassword(passwd) u.MustChangePassword = false - if err := models.UpdateUserCols(u, "must_change_password", "passwd", "rands", "salt"); err != nil { + if err := models.UpdateUserCols(u, "must_change_password", "passwd", "passwd_hash_algo", "rands", "salt"); err != nil { ctx.ServerError("UpdateUser", err) return } @@ -1590,7 +1590,7 @@ func MustChangePasswordPost(ctx *context.Context, cpt *captcha.Captcha, form aut u.HashPassword(form.Password) u.MustChangePassword = false - if err := models.UpdateUserCols(u, "must_change_password", "passwd", "salt"); err != nil { + if err := models.UpdateUserCols(u, "must_change_password", "passwd", "passwd_hash_algo", "salt"); err != nil { ctx.ServerError("UpdateUser", err) return } diff --git a/routers/user/setting/account.go b/routers/user/setting/account.go index 9b72e2a31a..4fb2e4be40 100644 --- a/routers/user/setting/account.go +++ b/routers/user/setting/account.go @@ -68,7 +68,7 @@ func AccountPost(ctx *context.Context, form auth.ChangePasswordForm) { return } ctx.User.HashPassword(form.Password) - if err := models.UpdateUserCols(ctx.User, "salt", "passwd"); err != nil { + if err := models.UpdateUserCols(ctx.User, "salt", "passwd_hash_algo", "passwd"); err != nil { ctx.ServerError("UpdateUser", err) return } |