stable
Clone or download
Read-only
request #15065: Changing password should revoke all OAuth2 tokens
If a user's account is compromised by an attacker, the attacker could try to persist some of its accesses by registering an evil OAuth2 app into the account. By revoking all the OAuth2 tokens and codes when users change their passwords, we make sure the users have purposely wanted to share accesses with the app at least once. All the OAuth2 access tokens, refresh tokens and authorization codes of a user are removed when the password of the account is changed. Authorizations are kept to not make the process too annoying for the user. Change-Id: I20448a793fb894e6fd17ec3b656842a985502cc5
Modified Files
| Name | ||||
|---|---|---|---|---|
| M | plugins/oauth2_server/include/Grant/AuthorizationCode/OAuth2AuthorizationCodeDAO.php | +10 | −0 | Go to diff View file |
| M | plugins/oauth2_server/include/oauth2_serverPlugin.php | +7 | −0 | Go to diff View file |
| M | site-content/en_US/admin/admin.tab | +0 | −1 | Go to diff View file |
| M | site-content/fr_FR/admin/admin.tab | +0 | −1 | Go to diff View file |
| R | src/common/User/Password/Change/PasswordChangeException.php | Go to diff View file | ||
| M | src/common/User/Account/UpdatePasswordController.php | +5 | −1 | Go to diff View file |
| M | src/common/User/Password/Change/PasswordChanger.php | +32 | −13 | Go to diff View file |
| M | src/www/account/lostlogin.php | +12 | −7 | Go to diff View file |
| M | src/www/admin/usergroup.php | +7 | −7 | Go to diff View file |
| M | tests/unit/common/User/Change/PasswordChangerTest.php | +25 | −20 | Go to diff View file |