Skip to content

Conversation

0xi4o
Copy link
Contributor

@0xi4o 0xi4o commented Oct 6, 2025

  • Change password now requires old password to be filled and validated before applying new password

@0xi4o 0xi4o self-assigned this Oct 6, 2025
@0xi4o 0xi4o added bug Something isn't working enhancement New feature or request labels Oct 6, 2025
if (!compareHash(newUserData.oldPassword, oldUserData.credential)) {
throw new InternalFlowiseError(StatusCodes.UNAUTHORIZED, UserErrorMessage.INVALID_USER_CREDENTIAL)
}
if (newUserData.newPassword !== newUserData.confirmPassword) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For consistency, shouldn't this also use the compareHash() function to do the comparison?

// @ts-ignore
const hash = bcrypt.hashSync(newUserData.password, salt)
if (newUserData.oldPassword && newUserData.newPassword && newUserData.confirmPassword) {
if (!oldUserData.credential) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this because you can't change your password if you authenticated with social login? If that's the case, is there nothing more explicit on the user model that could be used to drive this condition rather than the presence or absence of a password?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants