lsm/Orchard
1
0
Fork 0
mirror of https://github.com/OrchardCMS/Orchard.git synced 2025-07-15 15:21:09 +08:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Parameter validation for ChangeExpiredPassword action. (#8626)

Browse Source 
* Parameter validation for ChangeExpiredPassword action. Centralized check for
password expiration.

* Added ForcePasswordChange flag check to redirect to the correct page when that flag is true.

Co-authored-by: Andrea Piovanelli <andrea.piovanelli@laser-group.com>
This commit is contained in:
Matteo Piovanelli 2022-10-07 10:09:36 +02:00 committed by GitHub
parent ab7ebd65c9
commit e0f987951e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/Orchard.Web/Modules/Orchard.Users/Controllers/AccountController.cs
View File

@ -329,15 +329,20 @@ namespace Orchard.Users.Controllers {
[AlwaysAccessible]
public ActionResult ChangeExpiredPassword(string username) {
var membershipSettings = _membershipService.GetSettings();
var userPart = _membershipService.GetUser(username).As<UserPart>();
var lastPasswordChangeUtc = userPart.LastPasswordChangeUtc;
// If there is no last password change date, use user creation date.
if (lastPasswordChangeUtc == null) {
lastPasswordChangeUtc = userPart.CreatedUtc;
if (string.IsNullOrWhiteSpace(username)) {
return RedirectToAction("LogOn");
}
if (lastPasswordChangeUtc != null && lastPasswordChangeUtc.Value.AddDays(membershipSettings.PasswordExpirationTimeInDays) > _clock.UtcNow &&
!userPart.ForcePasswordChange) {
var userPart = _membershipService.GetUser(username)?.As<UserPart>();
if (userPart == null) {
// user not valid / doesn't exist
return RedirectToAction("LogOn");
}
var membershipSettings = _membershipService.GetSettings();
// if the password hasn't actually expired for the user, redirect to logon
var passwordIsActuallyExpired = membershipSettings.EnableCustomPasswordPolicy
&& membershipSettings.EnablePasswordExpiration
&& _membershipService.PasswordIsExpired(userPart, membershipSettings.PasswordExpirationTimeInDays);
if (!passwordIsActuallyExpired && !userPart.ForcePasswordChange) {
return RedirectToAction("LogOn");
}