cmandib opened a new pull request, #6790: URL: https://github.com/apache/fineract/pull/6790
## Description Fixes [FINERACT-2961](https://issues.apache.org/jira/browse/FINERACT-2961). This is the current-password handling moved out of #6670 during review. `isChangeInPasswordParameterNamed` compared bcrypt hashes with `equals()`, so submitting the current password always counted as a change (new hash, history row, date reset). The behaviour changes: 1. **The current password is no longer a change.** The check now uses `matches()`. `PUT /users/{id}` ignores an unchanged password, so an admin resending it no longer sets "password reset required", and legacy `{SHA-256}` hashes are no longer re-hashed to bcrypt as a side effect. 2. **`POST /users/{id}/pwd` rejects the current password** with 400 `error.msg.password.must.be.different`, whatever the reuse setting. Otherwise it would return a 200 that changes nothing. With the setting at N, `/pwd` therefore blocks N+1 passwords: the current one plus the last N. `PasswordMustBeDifferentException` (removed as unused in #6373) is restored for this. 3. **Stored hashes with no encoder prefix are handled safely.** `matches()` throws on a hash that has no `{id}` prefix, so change-detection now guards for that and treats such a value as changed instead of failing with a 500. No extra bcrypt work: `matches()` replaces the old `encode()`. Unit tests in `JsonCommandTest`, `AppUserUpdatePasswordTest`, and `AppUserWritePlatformServiceJpaRepositoryImplTest`. ## Checklist Please make sure these boxes are checked before submitting your pull request - thanks! - [x] Write the commit message as per [our guidelines](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#pull-requests) - [x] Acknowledge that we will not review PRs that are not passing the build _("green")_ - it is your responsibility to get a proposed PR to pass the build, not primarily the project's maintainers. - [x] Create/update [unit or integration tests](https://fineract.apache.org/docs/current/#_testing) for verifying the changes made. - [x] Follow our [coding conventions](https://cwiki.apache.org/confluence/display/FINERACT/Coding+Conventions). - [ ] Add required Swagger annotation and update API documentation at fineract-provider/src/main/resources/static/legacy-docs/apiLive.htm with details of any API changes - [x] [This PR must not be a "code dump"](https://cwiki.apache.org/confluence/display/FINERACT/Pull+Request+Size+Limit). Large changes can be made in a branch, with assistance. Ask for help on the [developer mailing list](https://fineract.apache.org/#contribute). - [x] If merging this PR resolves a JIRA issue, I will mark that issue as resolved and set "Fix Version/s" appropriately. - [x] I followed the [AI Policy](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#ai-policy). Your assigned reviewer(s) will follow our [guidelines for code reviews](https://cwiki.apache.org/confluence/display/FINERACT/Code+Review+Guide). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
