diff options
| author | Mark Wells <mark@freeside.biz> | 2015-11-12 16:49:39 -0800 |
|---|---|---|
| committer | Mark Wells <mark@freeside.biz> | 2015-11-13 13:00:42 -0500 |
| commit | d3f33fa4dbabb61cd94dac9f4f63cd8f249313da (patch) | |
| tree | f9559ddf824ab90fcc68e1854e1219caeef5e907 /httemplate/edit | |
| parent | 75a3ac488dc908290e75edd09471e01dba2199cb (diff) | |
limit password reuse, core and svc_acct, #29354
Diffstat (limited to 'httemplate/edit')
| -rwxr-xr-x | httemplate/edit/process/svc_acct.cgi | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/httemplate/edit/process/svc_acct.cgi b/httemplate/edit/process/svc_acct.cgi index 9cac2c568..d75ff92c1 100755 --- a/httemplate/edit/process/svc_acct.cgi +++ b/httemplate/edit/process/svc_acct.cgi @@ -81,7 +81,12 @@ if ( $cgi->param('clear_password') eq '*HIDDEN*' || $cgi->param('clear_password') =~ /^\(.* encrypted\)$/ ) { die "fatal: no previous account to recall hidden password from!" unless $old; } else { - $error ||= $new->set_password($cgi->param('clear_password')); + my $newpass = $cgi->param('clear_password'); + if ( ! $old->check_password($newpass) ) { + # then the password is being changed + $error ||= $new->is_password_allowed($newpass) + || $new->set_password($newpass); + } } if ( ! $error ) { |