revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-12-23 22:10:55 +01:00
Code Issues Releases Wiki Activity

Allow passwords to be edited even if account.editable is false

Browse source 
Summary:
Fixes T5900. We have some very old code here which does not let you update your password if the `account.editable` flag is set.

This was approximately introduced in D890, and I think it was mostly copy/pasted at that point. I'm not sure this ever really made sense. The option is not documented as affecting this, for example. In the modern environment of auth providers, it definitely does not make sense.

Instead, always allow users to change passwords if the install has a password provider configured.

Test Plan:
  - Set `account.editable` to false.
  - Used a password reset link.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T5900

Differential Revision: https://secure.phabricator.com/D10331
This commit is contained in:
epriestley 2014-08-21 15:35:43 -07:00
parent 05eb77c0a7
commit 4a566f9e5d
2 changed files with 3 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/applications/auth/controller/PhabricatorAuthOneTimeLoginController.php
View file

@ -120,7 +120,7 @@ final class PhabricatorAuthOneTimeLoginController
$next = '/';
if (!PhabricatorPasswordAuthProvider::getPasswordProvider()) {
$next = '/settings/panel/external/';
} else if (PhabricatorEnv::getEnvConfig('account.editable')) {
} else {
// We're going to let the user reset their password without knowing
// the old one. Generate a one-time token for that.

11
src/applications/settings/panel/PhabricatorSettingsPanelPassword.php
View file

@ -16,15 +16,8 @@ final class PhabricatorSettingsPanelPassword
}
public function isEnabled() {
// There's no sense in showing a change password panel if the user
// can't change their password...
if (!PhabricatorEnv::getEnvConfig('account.editable')) {
return false;
}
// ...or this install doesn't support password authentication at all.
// There's no sense in showing a change password panel if this install
// doesn't support password authentication.
if (!PhabricatorPasswordAuthProvider::getPasswordProvider()) {
return false;
}