Project

General

Profile

Task #5386

Increase security for Email Change

Added by Marcin Kuzminski [staff] about 2 years ago. Updated over 1 year ago.

Status:
Resolved
Priority:
Normal
Category:
-
Target version:
Start date:
13.09.2017
Due date:
% Done:

80%

Estimated time:
Sorting:
Commit Number:

Description

We already require OLD password when changing the current user password, but email is another way to recover an account. If hacker is able to access open instance of RC he can trigger an email change and change the password after that.
Proposed idea to fix this is:

  • Make email a select field instead of text input
  • Inside the input we allow user to pick any of the addresses added via extra emails
  • In order to change an email user needs to add a new email from additional emails, this needs to require a password, and then he can select a new email from the entry.

THis should force users to give current password to change the email


Related issues

Related to RhodeCode CE/EE - Task #5391: Secure Email changeResolved2017-09-21

History

#1 Updated by Marcin Kuzminski [staff] almost 2 years ago

  • Status changed from New to In Progress

#2 Updated by Anonymous almost 2 years ago

-- deleted spam comment ---

#3 Updated by Marcin Kuzminski [staff] over 1 year ago

  • Target version changed from v4.11 to v4.12

#4 Updated by Marcin Kuzminski [staff] over 1 year ago

  • Assignee set to Bartłomiej Wołyńczyk

#5 Updated by Marcin Kuzminski [staff] over 1 year ago

  • Related to Task #5391: Secure Email change added

#6 Updated by Bartłomiej Wołyńczyk over 1 year ago

  • % Done changed from 0 to 80

#7 Updated by Bartłomiej Wołyńczyk over 1 year ago

  • Assignee changed from Bartłomiej Wołyńczyk to Marcin Kuzminski [staff]
  • Status changed from In Progress to Resolved

Also available in: Atom PDF