287741 - changing password from 'password' to 'password' should not invalidate login cookies

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect)

Description

[timeless]

i have what i believe are dozens of browsers that were logged into
bugzilla.mozilla.org, i went to change my realname, and as per custom (because a
long time ago bugzilla refused to allow real name changes unless you changed
your password), i changed my password from 'password' to 'password' (verified
'password'). this fried my login cookies to all the browsers i have. the change
should not have fried my cookies.

Comment 1

[Marc Schumann [:Wurblzap]]

Attachment: Patch

Comment 2

[Frédéric Buclin]

Comment on attachment 205838 [details] [diff] [review]
Patch

>             my $cryptedpassword = bz_crypt($pwd1);
>+            if ($oldcryptedpwd ne $cryptedpassword) {

This doesn't work. bz_crypt() uses a salt to encrypt the password and so both encrypted passwords differ, even if both passwords are equal.

Comment 3

[Marc Schumann [:Wurblzap]]

Attachment: Patch 1.1

Fixed. I don't know what went wrong here.

Comment 4

[Frédéric Buclin]

Comment on attachment 205855 [details] [diff] [review]
Patch 1.1

r=LpSolit

Comment 5

[Frédéric Buclin]

Checking in userprefs.cgi;
/cvsroot/mozilla/webtools/bugzilla/userprefs.cgi,v  <--  userprefs.cgi
new revision: 1.95; previous revision: 1.94
done