From 35645672aeb960e92c5984d6b77b71e99dfc5b33 Mon Sep 17 00:00:00 2001 From: Shannon Date: Fri, 10 May 2019 02:00:45 +1000 Subject: [PATCH] Ensures the reset flag is set for users when the legacy user membership provider setting allowManuallyChangingPassword is used --- src/Umbraco.Web.UI.Client/src/views/users/user.controller.js | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/Umbraco.Web.UI.Client/src/views/users/user.controller.js b/src/Umbraco.Web.UI.Client/src/views/users/user.controller.js index e32d331d0a..d04fe6a507 100644 --- a/src/Umbraco.Web.UI.Client/src/views/users/user.controller.js +++ b/src/Umbraco.Web.UI.Client/src/views/users/user.controller.js @@ -135,7 +135,10 @@ //anytime a user is changing another user's password, we are in effect resetting it so we need to set that flag here if (vm.user.changePassword) { - vm.user.changePassword.reset = !vm.user.changePassword.oldPassword && !vm.user.isCurrentUser; + //NOTE: the check for allowManuallyChangingPassword is due to this legacy user membership provider setting, if that is true, then the current user + //can change their own password without entering their current one (this is a legacy setting since that is a security issue but we need to maintain compat). + //if allowManuallyChangingPassword=false, then we are using default settings and the user will need to enter their old password to change their own password. + vm.user.changePassword.reset = (!vm.user.changePassword.oldPassword && !vm.user.isCurrentUser) || vm.changePasswordModel.config.allowManuallyChangingPassword; } vm.page.saveButtonState = "busy";