mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-10-27 07:56:48 +09:00
Jeremy Daer
44a92ff6c6
Changing the password now ends every other session, so whoever holds one could shut the owner out of their own account with a new password. The profile asks for the current password whenever the password changes; without it, or with a wrong one, nothing is saved and the page says why. Other profile edits don't need it, and the admin reset-password script still works without it. Attempts are rate limited like signing in, 10 in 3 minutes per address, so the current password can't be guessed here instead.