From 03559da24d7bd5fc73e2c9403ea54b77f1adb6ff Mon Sep 17 00:00:00 2001 From: Martin Bornhold Date: Fri, 22 Jul 2016 12:57:51 +0200 Subject: [PATCH] auth: Fix password_changed function, fixes #4043. Never repot a changed password for default or anonymous users. If anonymous access is disabled we don't get the default user here so we also have to check if it is the anonymous user. In both cases (default user and anonymous user) we can skip the password change check and return False. --- rhodecode/lib/utils.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/rhodecode/lib/utils.py b/rhodecode/lib/utils.py index 942d885a..e5d4faea 100644 --- a/rhodecode/lib/utils.py +++ b/rhodecode/lib/utils.py @@ -958,8 +958,10 @@ class PartialRenderer(object): def password_changed(auth_user, session): - if auth_user.username == User.DEFAULT_USER: + # Never report password change in case of default user or anonymous user. + if auth_user.username == User.DEFAULT_USER or auth_user.user_id is None: return False + password_hash = md5(auth_user.password) if auth_user.password else None rhodecode_user = session.get('rhodecode_user', {}) session_password_hash = rhodecode_user.get('password', '')