lsm/Orchard
1
0
Fork 0
mirror of https://github.com/OrchardCMS/Orchard.git synced 2025-10-27 04:19:04 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Logon crash when checking if password is expired (#8624)

Browse Source 
* Added null check for last password change date. If that is null, use user date creation to check for password expiration.

* Added nullable date checks in AccountController ChangeExpiredPassword action too.
This commit is contained in:
Andrea Piovanelli
2022-09-30 09:00:00 +02:00
committed by GitHub
parent 0234738573
commit ab7ebd65c9
2 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/Orchard.Web/Modules/Orchard.Users/Controllers/AccountController.cs
View File

@@ -332,7 +332,11 @@ namespace Orchard.Users.Controllers {
var membershipSettings = _membershipService.GetSettings();
var userPart = _membershipService.GetUser(username).As<UserPart>();
var lastPasswordChangeUtc = userPart.LastPasswordChangeUtc;
if (lastPasswordChangeUtc.Value.AddDays(membershipSettings.PasswordExpirationTimeInDays) > _clock.UtcNow &&
// If there is no last password change date, use user creation date.
if (lastPasswordChangeUtc == null) {
lastPasswordChangeUtc = userPart.CreatedUtc;
}
if (lastPasswordChangeUtc != null && lastPasswordChangeUtc.Value.AddDays(membershipSettings.PasswordExpirationTimeInDays) > _clock.UtcNow &&
!userPart.ForcePasswordChange) {
return RedirectToAction("LogOn");
}

14
src/Orchard.Web/Modules/Orchard.Users/Services/MembershipService.cs
View File

@@ -167,7 +167,19 @@ namespace Orchard.Users.Services {
public bool PasswordIsExpired(IUser user, int days) {
// TODO: add providers to extend this
var passwordIsExpired = user.As<UserPart>().LastPasswordChangeUtc.Value.AddDays(days) < _clock.UtcNow;
// Null check on LastPasswordChangeUtc.
// If this is null, use CreatedUtc as if it's the last password change date.
// If both are null, consider the password to be expired.
var passwordIsExpired = true;
DateTime? date = null;
date = user.As<UserPart>().LastPasswordChangeUtc;
if (date == null) {
date = user.As<UserPart>().CreatedUtc;
}
if (date != null) {
passwordIsExpired = date.Value.AddDays(days) < _clock.UtcNow;
}
var securityPart = user.As<UserSecurityConfigurationPart>();
var preventExpiration = securityPart != null && securityPart.PreventPasswordExpiration;
return passwordIsExpired