Jeremy Daer 417f087964 Ask for the current password to change it ...

Changing the password now ends every other session, so whoever holds
one could shut the owner out of their own account with a new password.
The profile asks for the current password whenever the password
changes; without it, or with a wrong one, nothing is saved and the page
says why. Other profile edits don't need it, and the admin
reset-password script still works without it.

Attempts are rate limited like signing in, 10 in 3 minutes per address,
so the current password can't be guessed here instead.

From #371. The cached-response test it touches isn't in 1.5.2.

(cherry picked from commit 44a92ff6c6)

2026-10-19 12:17:27 -07:00

..

accounts

Disable libvips unfuzzed operations (#226)

2026-07-28 11:57:57 -04:00

autocompletable

Hello world

2025-08-21 09:31:59 +01:00

concerns

Add IP-based user banning

2025-11-26 14:30:38 +00:00

messages

Cache boosts with their message instead of one by one

2026-10-05 16:40:49 +02:00

rooms

Delete a room's messages in a job, one transaction each

2026-10-06 13:57:05 +02:00

sessions

End sign-in links made before a password change

2026-10-19 11:37:05 -07:00

users

Ask for the current password to change it

2026-10-19 12:17:27 -07:00

.keep

Hello world

2025-08-21 09:31:59 +01:00

accounts_controller_test.rb

Merge pull request #316: List one page of account members at a time

2026-10-07 10:32:12 +02:00

active_storage_authentication_test.rb

Require authentication for Active Storage direct uploads (#267)

2026-08-30 10:24:41 -07:00

first_runs_controller_test.rb

Address race condition during "first run" account creation

2025-12-12 10:51:28 -05:00

messages_caching_test.rb

Merge pull request #330: bound attachment preview work

2026-10-07 10:33:02 +02:00

messages_controller_test.rb

Preserve request ports in message copy links

2026-10-07 16:37:53 +02:00

qr_code_controller_test.rb

Hello world

2025-08-21 09:31:59 +01:00

rooms_controller_test.rb

Reset former members' connections and grant open rooms in one statement

2026-10-06 14:45:18 +02:00

searches_controller_test.rb

Search for operator words instead of parsing them

2026-10-05 01:08:53 +02:00

sessions_controller_test.rb

Close live Action Cable connections on sign out (#268)

2026-08-31 18:21:16 -07:00

unfurl_links_controller_test.rb

Put the whole unfurl, lookups included, under one deadline

2026-10-06 14:03:26 +02:00

users_controller_test.rb

Hello world

2025-08-21 09:31:59 +01:00

welcome_controller_test.rb

Hello world

2025-08-21 09:31:59 +01:00