Ralf HaferkampandRalf Haferkamp
29f52515e1
Up to now the /me/changePassword endpoint return a 500 Status when issue a password change with the old password set to the wrong password. This changes the code to return 400 (Bad Request) with an additional message that the old password is wrong. This does not seem to weaken the security of /me/changePassword (i.e. for allowing easier brute-force attacks) as the endpoint is only available to already authenticated users (and only for changing their own passwords) See #4480
18 lines
858 B
Gherkin
18 lines
858 B
Gherkin
@api
|
|
Feature: an user changes its own password
|
|
|
|
Scenario Outline: change own password
|
|
Given user "Alice" has been created with default attributes and without skeleton files
|
|
When the user "Alice" changes its own password "<currentPassword>" to "<newPassword>" using the Graph API
|
|
Then the HTTP status code should be "<code>"
|
|
Examples:
|
|
| currentPassword | newPassword | code |
|
|
| 123456 | validPass | 204 |
|
|
| 123456 | кириллица | 204 |
|
|
| 123456 | 密码 | 204 |
|
|
| 123456 | ?&^%0 | 204 |
|
|
| 123456 | | 400 |
|
|
| 123456 | 123456 | 400 |
|
|
| wrongPass | 123456 | 400 |
|
|
| | validPass | 400 |
|