Jeremy Daer 4a580302a5 Check the current password whenever the saved password changes ...

The profile asked for the current password when the request's password
field was filled in. The check now follows the save itself: the model
checks the challenge whenever the password digest is about to change,
and the profile always hands it the challenge. Editing a name, avatar
or email without a new password still needs none, and scripts that
reset a password, which set no challenge, are unaffected.

Only a string counts as a challenge, and the rate limit counts every
non-empty one, so what's limited is exactly what gets checked.

2026-10-19 15:05:19 -07:00

..

push_subscriptions

Hello world

2025-08-21 09:31:59 +01:00

avatars_controller.rb

Disable libvips unfuzzed operations (#226)

2026-07-28 11:57:57 -04:00

bans_controller.rb

Add IP-based user banning

2025-11-26 14:30:38 +00:00

profiles_controller.rb

Check the current password whenever the saved password changes

2026-10-19 15:05:19 -07:00

push_subscriptions_controller.rb

Look the endpoint up past the query cache, and keep a subscription a race refused

2026-10-19 13:34:34 -07:00

sidebars_controller.rb

Reuse authorized read pages without stale presentation or CSRF masks

2026-10-07 20:02:20 +02:00