[#OF-221] Openfire does not honor option to stop password changes

Openfire

Openfire does not honor option to stop password changes

Created: 04/15/09 11:31 AM Updated: 01/31/10 08:59 PM

Component/s:

Core

Affects Version/s:

3.6.4

Fix Version/s:

3.7.0

Time Tracking:

Not Specified

Resolution Date:	01/31/10 08:59 PM
Acceptance Test - Add?:	No

Description

« Hide

Disabling password changes on the console has no effect. One can still send the IQ packet manually to change their password.

All

Comments

Work Log

Change History

FishEye

Sort Order:

[ Permalink | « Hide ]

Daryl Herzmann added a comment - 06/16/09 10:38 PM

r11076

[ Permalink | « Hide ]

Gaston Dombiak added a comment - 08/05/09 04:56 PM

I think there is a misunderstanding here that lead to an incorrect fix. The system property "register.password" was being used to specify if users can change their password or not. The system property "xmpp.auth.iqauth" was being used to specify if the old IQ authentication method was available or if SASL should be used instead.

Having said that, the error was that the old IQ auth method also allowed to change password and not only authenticate people. AFAIK, the fix would be to modify IQAuthHandler#passwordReset so that it checks on the system property "register.password" to see if users can change their passwords.

[ Permalink | « Hide ]

Daryl Herzmann added a comment - 08/05/09 05:00 PM

Hi Gato,

Thanks for the feedback. You wish for me to commit a patch correcting this or can you do it quick?

daryl

[ Permalink | « Hide ]

Gaston Dombiak added a comment - 08/05/09 05:06 PM

I just checked in my version of the fix. Let me know if you are ok with it. Tks.

[ Permalink | « Hide ]

Daryl Herzmann added a comment - 08/05/09 05:10 PM

Hehe, I doubt I can challenge your changes! Thanks for the fix.