Require password confirmation when user changes their primary email
Compare changes
Files
9+ 9
− 0
With this MR, user is prompted with a modal to re-authenticate with their current password, when they want to save changes to their primary email.
This MR solves for #339145 (closed).
When user changes their primary email, a re-authentication with current user password is required, unless the user is signed in via OmniAuth/LDAP/SAML/etc. and they do not have a local password.
Implementation detail: frontend doesn't prompt for the password when password_automatically_set?
returns true
.
Note: It can be extended to require password confirmation for changes to some other user attributes (by adding to ATTRS_REQUIRING_PASSWORD_CHECK
).
Screen_Recording_2021-09-20_at_6.26.29_PM
Does this MR contain changes to processing or storing of credentials or tokens, authorization and authentication methods or other items described in the security review guidelines? If not, then delete this Security section.
@gitlab-com/gl-security/appsec