search

BallStateCBER / commentaries-cake3

CBER Data Center: Weekly Commentary
0 stars 0 forks source link

Not changing your password changes your password #23

Open PhantomWatson opened 6 years ago

PhantomWatson commented 6 years ago

This code in UsersController.php:

if (empty($this->request->getData('password'))) {
    $password = $this->Users->getOldPassword($id);
    $user->password = $password;
}
if ($this->Users->save($user)) {

has the effect of changing the user's password to the hash of what their password previously was. So if they ever submit the form without changing their password, their existing password becomes unusable.