Browse Source
Limit re-check to ShouldChangePassword users to avoid leaking password oracle on other NotAllowed branches
pull/25482/head
maliming
2 months ago
No known key found for this signature in database
GPG Key ID: A646B9CB645ECEA4
1 changed files with
3 additions and
1 deletions
-
modules/account/src/Volo.Abp.Account.Web/Pages/Account/Login.cshtml.cs
|
|
|
@ -137,7 +137,9 @@ public class LoginModel : AccountPageModel |
|
|
|
using (CurrentTenant.Change(notAllowedUser.TenantId)) |
|
|
|
{ |
|
|
|
await IdentityOptions.SetAsync(); |
|
|
|
if (!await UserManager.CheckPasswordAsync(notAllowedUser, LoginInput.Password)) |
|
|
|
if ((notAllowedUser.ShouldChangePasswordOnNextLogin || |
|
|
|
await UserManager.ShouldPeriodicallyChangePasswordAsync(notAllowedUser)) && |
|
|
|
!await UserManager.CheckPasswordAsync(notAllowedUser, LoginInput.Password)) |
|
|
|
{ |
|
|
|
Alerts.Danger(L["InvalidUserNameOrPassword"]); |
|
|
|
return Page(); |
|
|
|
|
