diff options
author | Lukas Fleischer <lfleischer@archlinux.org> | 2020-01-30 10:23:50 +0100 |
---|---|---|
committer | Lukas Fleischer <lfleischer@archlinux.org> | 2020-01-30 10:31:26 +0100 |
commit | daee20c694000e1e85a98760773bcbbdc0709527 (patch) | |
tree | 939c7d7f57ffd3b2aab1dbe7a4e25f27d929cd9d /web/template | |
parent | eeaa1c3a3220e3735445d094dc7d2cd9ac07b621 (diff) | |
download | aur-daee20c694000e1e85a98760773bcbbdc0709527.tar.gz aur-daee20c694000e1e85a98760773bcbbdc0709527.tar.xz |
Require current password when setting a new one
Prevent from easily taking over an account by changing the password with
a stolen session ID.
Fixes FS#65325.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
Diffstat (limited to 'web/template')
-rw-r--r-- | web/template/account_edit_form.php | 32 |
1 files changed, 20 insertions, 12 deletions
diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 5e84aa71..25e91853 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -86,18 +86,6 @@ <input type="checkbox" name="H" id="id_hide" <?= $H ? 'checked="checked"' : '' ?> /> </p> - <?php if ($A == "UpdateAccount"): ?> - <p> - <label for="id_passwd1"><?= __("Password") ?>:</label> - <input type="password" size="30" name="P" id="id_passwd1" value="<?= $P ?>" /> - </p> - - <p> - <label for="id_passwd2"><?= __("Re-type password") ?>:</label> - <input type="password" size="30" name="C" id="id_passwd2" value="<?= $C ?>" /> - </p> - <?php endif; ?> - <p> <label for="id_realname"><?= __("Real Name") ?>:</label> <input type="text" size="30" maxlength="32" name="R" id="id_realname" value="<?= htmlspecialchars($R,ENT_QUOTES) ?>" /> @@ -150,6 +138,26 @@ </p> </fieldset> + <?php if ($A == "UpdateAccount"): ?> + <fieldset> + <legend><?= __("If you want to change your password, enter your current passport, your new password and confirm the new password by entering it again.") ?></legend> + <p> + <label for="id_passwd_old"><?= __("Old password") ?>:</label> + <input type="password" size="30" name="PO" id="id_passwd_old" value="<?= $PO ?>" /> + </p> + + <p> + <label for="id_passwd1"><?= __("Password") ?>:</label> + <input type="password" size="30" name="P" id="id_passwd1" value="<?= $P ?>" /> + </p> + + <p> + <label for="id_passwd2"><?= __("Re-type password") ?>:</label> + <input type="password" size="30" name="C" id="id_passwd2" value="<?= $C ?>" /> + </p> + </fieldset> + <?php endif; ?> + <fieldset> <legend><?= __("The following information is only required if you want to submit packages to the Arch User Repository.") ?></legend> <p> |