dani/lemonldap-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add security token when forcing password reset (#1639)

Browse Source
This commit is contained in:
Clément OUDOT 2019-02-08 10:46:06 +01:00
parent c400495635
commit 5f800003fd
3 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Auth/AD.pm
View File

@ -133,12 +133,16 @@ sub authenticate {
}
# Remember password if password reset needed
$req->data->{oldpassword} = $req->data->{password}
if (
if (
$res == PE_PP_CHANGE_AFTER_RESET
or ( $res == PE_PP_PASSWORD_EXPIRED
and $self->conf->{ldapAllowResetExpiredPassword} )
);
)
{
$req->data->{oldpassword} = $self->{password};
$req->data->{noerror} = 1;
$self->setSecurity($req);
}
return $res;
}

1
lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Auth/LDAP.pm
View File

@ -46,6 +46,7 @@ sub authenticate {
{
$req->data->{oldpassword} = $self->{password};
$req->data->{noerror} = 1;
$self->setSecurity($req);
}
return $res;

4
lemonldap-ng-portal/site/templates/bootstrap/password.tpl
View File

@ -11,6 +11,10 @@
</TMPL_IF>
<input type="hidden" name="skin" value="<TMPL_VAR NAME="SKIN">" />
<TMPL_IF NAME="TOKEN">
<input type="hidden" name="token" value="<TMPL_VAR NAME="TOKEN">" />
</TMPL_IF>
<TMPL_IF NAME="LOGIN">
<div class="input-group mb-3">
<input name="user" type="hidden" value="<TMPL_VAR NAME=LOGIN>" />