Project

General

Profile

Actions

Feature #99611

open

Require current password in ext:setup on password change

Added by Torben Hansen over 1 year ago. Updated 3 months ago.

Status:
New
Priority:
Should have
Assignee:
Category:
-
Target version:
Start date:
2023-01-18
Due date:
% Done:

0%

Estimated time:
PHP Version:
Tags:
Complexity:
Sprint Focus:

Description

When a backend user want to change the password, it is currently not required to enter the current password. From a security perspective, a current password verification should be implemented (see https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#change-password-feature).

Actions

Also available in: Atom PDF