lasdf1234 opened a new pull request, #13963: URL: https://github.com/apache/gravitino/pull/13963
**Cherry-pick Information:** - Original commit: d7e8b22ca56f4dab50c7ad728cf287ca735374b7 - Target branch: `branch-1.3` - Status: Clean cherry-pick adapted for branch-1.3 (no conflict markers). ### What changes were proposed in this pull request? Backport [#13926](https://github.com/apache/gravitino/pull/13926) / [#13925](https://github.com/apache/gravitino/issues/13925) to `branch-1.3`: - Require `oldPassword` for self password changes and verify it against the stored hash - Move password changes to `PUT /api/idp/users/{user}/password` with `newPassword` / optional `oldPassword` - Allow authenticated non-admin users to `GET` their own user and `PUT` their own password - Service admins resetting another user send only `newPassword` and must omit `oldPassword` ### Backport notes - `branch-1.3` does not include the local-user `enabled` flag / `PUT .../enabled` API from main, so that part of #13926 is omitted. - Replaces auto cherry-pick [#13956](https://github.com/apache/gravitino/pull/13956), which landed with unresolved conflict markers. ### Why are the changes needed? Self-service (and admin self) password change previously accepted only the new password. Callers with a valid Basic session could change a password without proving knowledge of the existing password again. Fix: #13925 ### Does this PR introduce _any_ user-facing change? Yes. - Password change path: `PUT /api/idp/users/{user}/password` - Self-change body: `{"newPassword":"...","oldPassword":"..."}` - Admin reset of another user: `{"newPassword":"..."}` (must omit `oldPassword`) - Create-user still uses `password` ### How was this patch tested? - `./gradlew :plugins:idp-basic:test --tests org.apache.gravitino.idp.TestIdpUserGroupManager --tests org.apache.gravitino.idp.dto.requests.TestChangePasswordRequest --tests org.apache.gravitino.idp.web.rest.TestIdpOperations --tests org.apache.gravitino.idp.web.rest.TestIdpAuthorizationFilter -PskipITs` - `./gradlew :docs:build` Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
