engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

auth: Fix password_changed function, fixes #4043.

Browse source 
Never repot a changed password for default or anonymous users.

If anonymous access is disabled we don't get the default user here so we
also have to check if it is the anonymous user. In both cases (default user
and anonymous user) we can skip the password change check and return False.
This commit is contained in:
Martin Bornhold 2016-07-22 12:57:51 +02:00
parent fbf489e560
commit 03559da24d
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
rhodecode/lib/utils.py
View file

@ -958,8 +958,10 @@ class PartialRenderer(object):
def password_changed(auth_user, session):
if auth_user.username == User.DEFAULT_USER:
# Never report password change in case of default user or anonymous user.
if auth_user.username == User.DEFAULT_USER or auth_user.user_id is None:
return False
password_hash = md5(auth_user.password) if auth_user.password else None
rhodecode_user = session.get('rhodecode_user', {})
session_password_hash = rhodecode_user.get('password', '')