721624 - use admin_update_password for forced password update

Status: RESOLVED FIXED

(Cloud Services :: Server: Registration, defect)

Description

[Ryan Kelly [:rfkelly]]

Attachment: patch to use admin_update_password

Currently server-reg uses admin_update_field() to forcibly reset the user's password.  That's bad news for SQL auth backends, since it writes the raw password into the database instead of the hashed-and-salted version.

Attached patch changes it to use admin_update_password().

Comment 1

[Toby Elliott [:telliott]]

Comment on attachment 592034 [details] [diff] [review]
patch to use admin_update_password

Whoops. Good catch.

Comment 2

[Ryan Kelly [:rfkelly]]

Applied in http://hg.mozilla.org/services/server-reg/rev/ea7aaa1f240a

Comment 3

[Ryan Kelly [:rfkelly]]

Attachment: patch to correct use of admin_update_password

Yeah, um, so...the patch committed above doesn't actually work.  It resets the password to "password" rather than the value entered by the user.  Whoops!  Attached patch fixed it and adds a test to make sure it really works.

Comment 4

[Toby Elliott [:telliott]]

Comment on attachment 635634 [details] [diff] [review]
patch to correct use of admin_update_password

Whoops!

Comment 5

[Ryan Kelly [:rfkelly]]

http://hg.mozilla.org/services/server-reg/rev/984937e39ac8