MC-31435: PHPSessionId should changed after logout

Author: tsviklinskyi

app/code/Magento/Customer/Model/AccountManagement.php

@@ -720,6 +720,7 @@ public function resetPassword($email, $resetToken, $newPassword)
             $newPassword
         );
         $this->checkPasswordStrength($newPassword);
+        $this->sessionManager->regenerateId();
         //Update secure data
         $customerSecure = $this->customerRegistry->retrieveSecureData($customer->getId());
         $customerSecure->setRpToken(null);
@@ -1045,10 +1046,11 @@ private function changePasswordForCustomer($customer, $currentPassword, $newPass
         }
         $customerEmail = $customer->getEmail();
         $this->credentialsValidator->checkPasswordDifferentFromEmail($customerEmail, $newPassword);
+        $this->checkPasswordStrength($newPassword);
+        $this->sessionManager->regenerateId();
         $customerSecure = $this->customerRegistry->retrieveSecureData($customer->getId());
         $customerSecure->setRpToken(null);
         $customerSecure->setRpTokenCreatedAt(null);
-        $this->checkPasswordStrength($newPassword);
         $customerSecure->setPasswordHash($this->createPasswordHash($newPassword));
         $this->destroyCustomerSessions($customer->getId());
         $this->disableAddressValidation($customer);

app/code/Magento/Customer/Test/Unit/Model/AccountManagementTest.php

@@ -1551,6 +1551,7 @@ public function testChangePassword()
             ->with($customer);
 
         $this->sessionManager->expects($this->atLeastOnce())->method('getSessionId');
+        $this->sessionManager->expects($this->atLeastOnce())->method('regenerateId');
 
         $visitor = $this->getMockBuilder(\Magento\Customer\Model\Visitor::class)
             ->disableOriginalConstructor()
@@ -1628,6 +1629,7 @@ function ($string) {
 
         $this->sessionManager->method('isSessionExists')->willReturn(false);
         $this->sessionManager->expects($this->atLeastOnce())->method('getSessionId');
+        $this->sessionManager->expects($this->atLeastOnce())->method('regenerateId');
         $visitor = $this->getMockBuilder(\Magento\Customer\Model\Visitor::class)
             ->disableOriginalConstructor()
             ->setMethods(['getSessionId'])