From eefdad7402e28a0ca6930e8d27593e8c290c0b9c Mon Sep 17 00:00:00 2001 From: maliming Date: Wed, 27 May 2026 09:44:59 +0800 Subject: [PATCH] Limit re-check to ShouldChangePassword users to avoid leaking password oracle on other NotAllowed branches --- .../src/Volo.Abp.Account.Web/Pages/Account/Login.cshtml.cs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/account/src/Volo.Abp.Account.Web/Pages/Account/Login.cshtml.cs b/modules/account/src/Volo.Abp.Account.Web/Pages/Account/Login.cshtml.cs index cc5dc12a27..57fcbe9e46 100644 --- a/modules/account/src/Volo.Abp.Account.Web/Pages/Account/Login.cshtml.cs +++ b/modules/account/src/Volo.Abp.Account.Web/Pages/Account/Login.cshtml.cs @@ -137,7 +137,9 @@ public class LoginModel : AccountPageModel using (CurrentTenant.Change(notAllowedUser.TenantId)) { await IdentityOptions.SetAsync(); - if (!await UserManager.CheckPasswordAsync(notAllowedUser, LoginInput.Password)) + if ((notAllowedUser.ShouldChangePasswordOnNextLogin || + await UserManager.ShouldPeriodicallyChangePasswordAsync(notAllowedUser)) && + !await UserManager.CheckPasswordAsync(notAllowedUser, LoginInput.Password)) { Alerts.Danger(L["InvalidUserNameOrPassword"]); return Page();