MilkyShots/MilkyShots
4
0
Fork 0
Code Issues 49 Pull Requests 1 Packages Projects Releases Wiki Activity

feat: enforce old-password verification on own password change, allow admin override

Browse Source
This commit is contained in:
Samuele Lorefice
2026-07-10 10:15:03 +02:00
parent 3f56f9afdc
commit 15b3fcedf1
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
Lactose/Controllers/UserController.cs
View File

@@ -149,7 +149,17 @@ namespace Lactose.Controllers {
if (dto.Email != null) { user.Email = dto.Email; }
if (dto.Password != null) { user.Password = passwordHasher.HashPassword(user, dto.Password); }
if (dto.Password != null) {
if (dto.OldPassword != null) {
if (passwordHasher.VerifyHashedPassword(user, user.Password, dto.OldPassword) == PasswordVerificationResult.Failed) {
return BadRequest("Old password is incorrect");
}
} else if (authenticatedUser.AccessLevel != EAccessLevel.Admin) {
return BadRequest("Old password is required to change your own password");
}
user.Password = passwordHasher.HashPassword(user, dto.Password);
}
if (dto.IsDeleted != null) { user.DeletedAt = dto.IsDeleted.Value ? DateTime.UtcNow : null; }