Silverpeas » Silverpeas Core

• The first one is to check the password satisfies all the password rules;
• The last one is to save effectively the password.

In order to avoid a mismatch between the password that was checked and the one that has to be saved, the password to save is compared to the checked one. For doing, the checked password is cached under an auto generated key. The client asking to effectively save the new password has to pass this key. If this key is invalid or not provided, then an error is sent back. If the checked password doesn't match the password to save, an error is also sent back. By this way, with a double verification, we ensure to block any attempts to circumvent the process of password change/set.

See PR https://github.com/Silverpeas/Silverpeas-Core/pull/1352

Merged into the branches 6.4.x and master