search

RocketChat / Rocket.Chat

The communications platform that puts data protection first.
https://rocket.chat/
Other
40.62k stars 10.63k forks source link

Changing user permissions invalidates password #18493

Open EnCz opened 4 years ago

EnCz commented 4 years ago

Description:

After changing user permissions on a user it's no longer possible to login with this account.

Steps to reproduce:

  1. Create 'test' user with 'admin' permissions
  2. Login with 'test' user in another browser
  3. Change permissions of 'test' user from 'admin' to 'guest' with original admin account -> 'test' user in second browser gets logged out
  4. Try to login again with 'test' user

Expected behavior:

You log in with the test user

Actual behavior:

"User not found or incorrect password" error message

Server Setup Information:

Client Setup Information

EnCz commented 4 years ago

Maybe this has to do with those ones: https://github.com/RocketChat/Rocket.Chat/issues/18441 https://github.com/RocketChat/Rocket.Chat/issues/18458

pierre-lehnen-rc commented 4 years ago

I couldn't replicate this issue here.

EnCz commented 4 years ago

EDIT: IGNORE THIS AND GO TO THE NEXT COMMENT

~I just tried it again with 3.7.0.~

~2 Browsers~ ~Chrome: My usual Admin Account~ ~Firefox: My "Guest"-Account~

~With my usual admin-user I change the guest user (give him the admin role, but I think I could also just change his name or something else).~ ~Guest-User gets kicked out of his session and cannot log in.~

~It just seems like every field in the admin sidebar gets saved / overwritten, even though I had no changes in them.~

~If I look at the password input's dom I see that there is "Curtis123" as a value, even though I used the password "guestguest". Curtis was a password from way before this test).~

~I think there are some bigger problems in those admin sidebars since the refactoring :/ I can give you 5 examples out of my head where the admin sidebar doesn't behave as expected.~

~This really needs to get tested and fixed.~

EnCz commented 4 years ago

@pierre-lehnen-rc

Found out what happened.

The Chrome AutoFill from the rocketchat login page: image

automatically fills out parts of the user-admin sidebar: image

Probably because the Inputs have the same ids or something like that. So when I save and miss that there are fields automatically filled the password obviously gets overwritten.