Jeremy Daer 4a580302a5 Check the current password whenever the saved password changes ...

The profile asked for the current password when the request's password
field was filled in. The check now follows the save itself: the model
checks the challenge whenever the password digest is about to change,
and the profile always hands it the challenge. Editing a name, avatar
or email without a new password still needs none, and scripts that
reset a password, which set no challenge, are unaffected.

Only a string counts as a challenge, and the rate limit counts every
non-empty one, so what's limited is exactly what gets checked.

2026-10-19 15:05:19 -07:00

..

accounts

Disable libvips unfuzzed operations (#226)

2026-07-28 11:57:57 -04:00

autocompletable

Hello world

2025-08-21 09:31:59 +01:00

concerns

Add IP-based user banning

2025-11-26 14:30:38 +00:00

messages

Keep transaction guards temporary and simplify quick boost forms

2026-10-08 12:40:31 +02:00

rooms

Delete a room's messages in a job, one transaction each

2026-10-06 13:57:05 +02:00

sessions

End sign-in links made before a password change

2026-10-19 11:36:16 -07:00

users

Check the current password whenever the saved password changes

2026-10-19 15:05:19 -07:00

.keep

Hello world

2025-08-21 09:31:59 +01:00

accounts_controller_test.rb

Merge pull request #316: List one page of account members at a time

2026-10-07 10:32:12 +02:00

active_storage_authentication_test.rb

Require authentication for Active Storage direct uploads (#267)

2026-08-30 10:24:41 -07:00

cached_responses_test.rb

Ask for the current password to change it

2026-10-19 12:17:14 -07:00

fetch_metadata_test.rb

Use header-only forgery protection and cache complete responses

2026-10-08 09:05:10 +02:00

first_runs_controller_test.rb

Address race condition during "first run" account creation

2025-12-12 10:51:28 -05:00

fragment_cache_test.rb

Retain content-validated message fragments across unrelated commits

2026-10-08 12:00:45 +02:00

messages_caching_test.rb

Merge pull request #330: bound attachment preview work

2026-10-07 10:33:02 +02:00

messages_controller_test.rb

Reuse token-free message controls and render posting deliveries once

2026-10-08 11:43:27 +02:00

qr_code_controller_test.rb

Reject a QR code request that can't become a QR code

2026-10-06 22:53:47 +02:00

rooms_controller_test.rb

Reset former members' connections and grant open rooms in one statement

2026-10-06 14:45:18 +02:00

searches_controller_test.rb

Search for operator words instead of parsing them

2026-10-05 01:08:53 +02:00

sessions_controller_test.rb

Close live Action Cable connections on sign out (#268)

2026-08-31 18:21:16 -07:00

unfurl_links_controller_test.rb

Put the whole unfurl, lookups included, under one deadline

2026-10-06 14:03:26 +02:00

users_controller_test.rb

Hello world

2025-08-21 09:31:59 +01:00

welcome_controller_test.rb

Hello world

2025-08-21 09:31:59 +01:00