Aias00 opened a new issue, #7193: URL: https://github.com/apache/rocketmq-dashboard/issues/7193
### Before Creating the Bug Report - [x] Searched all-state issues and PRs for concurrent/stale password changes. - [x] This concerns RocketMQ Studio. ### Studio Version `rocketmq-studio` at `127c47b06a268cc74224d5f34c56ec7c36ac0d55`. ### Runtime Environment Source review on macOS; database-backed AuthService. Regression verification will use the dev H2 profile in MySQL compatibility mode. ### Connected RocketMQ Cluster Not involved. ### Describe the Bug `AuthService.changePassword` reads the user hash and validates the current password, but its subsequent UPDATE is conditional only on user ID. A request that validated a now-obsolete password can overwrite an administrator reset completed in the meantime. The existing transaction makes the update/revoke pair atomic but does not prevent this lost update. ### Steps to Reproduce 1. Start a self-service password change with the current password and pause after verification, before its user UPDATE. 2. Complete an administrator reset to a different password. 3. Resume the first request. It updates by ID and replaces the administrator's password with its own value. ### Expected Behavior Reject the stale mutation with a conflict and preserve the completed reset. Use the observed hash as an optimistic UPDATE condition and check the affected-row count before revoking sessions. ### Related Work PR #4686 (merged) makes password replacement/session revocation atomic. PR #6849 (open) coordinates login issuance with password changes. Neither adds optimistic concurrency protection to two competing password changes. This report is about competing mutations, not an old-password login creating a session. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
