Merge pull request #2949 from modoboa/fix/update_password_from_profile

Fixed security issue with password update.

.github/workflows/modoboa.yml

@@ -113,12 +113,14 @@ jobs:
           LDAP_SERVER_PORT: ${{ job.services.openldap.ports[389] }}
 
       - name: Test with pytest and coverage
-        if: ${{ matrix.python-version == '3.8' && matrix.database == 'postgres' }}
+        if: ${{ matrix.python-version == '3.10' && matrix.database == 'postgres' }}
         run: |
           python ./tests.py
           cd test_project
           coverage run manage.py test modoboa
           coverage combine
+          coverage xml
+          coverage report
         env:
           # use localhost for the host here because we are running the job on the VM.
           # If we were running the job on in a container this would be postgres
@@ -129,32 +131,25 @@ jobs:
           REDIS_PORT: ${{ job.services.redis.ports[6379] }}
           LDAP_SERVER_PORT: ${{ job.services.openldap.ports[389] }}
       - name: Upload coverage result
-        if: ${{ matrix.python-version == '3.8' }}
+        if: ${{ matrix.python-version == '3.10' && matrix.database == 'postgres' }}
         uses: actions/upload-artifact@v2
         with:
           name: coverage-results
-          path: test_project/.coverage
+          path: test_project/coverage.xml
 
   coverage:
     needs: test
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Set up Python 3.8
-        uses: actions/setup-python@v2
-        with:
-          python-version: '3.8'
-      - name: Install dependencies
-        run: |
-          pip install codecov
       - name: Download coverage results
         uses: actions/download-artifact@v2
         with:
           name: coverage-results
-      - name: Report coverage
-        run: |
-          coverage report
-          codecov
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v3
+        with:
+          files: ./coverage.xml
 
   release:
     if: github.event_name != 'pull_request'

modoboa/core/forms.py

@@ -49,7 +49,7 @@ class ProfileForm(forms.ModelForm):
         widget=forms.PasswordInput(attrs={"class": "form-control"})
     )
 
-    class Meta(object):
+    class Meta:
         model = User
         fields = ("first_name", "last_name", "language",
                   "phone_number", "secondary_email")
@@ -92,6 +92,11 @@ class ProfileForm(forms.ModelForm):
                         confirmation, self.instance)
             else:
                 self.add_error("oldpassword", _("This field is required."))
+        elif newpassword or confirmation:
+            if not confirmation:
+                self.add_error("confirmation", _("This field is required."))
+            else:
+                self.add_error("newpassword", _("This field is required."))
         return self.cleaned_data
 
     def save(self, commit=True):

modoboa/core/tests/test_core.py

@@ -148,8 +148,26 @@ class ProfileTestCase(ModoTestCase):
 
         self.ajax_post(
             reverse("core:user_profile"),
-            {"oldpassword": "toto",
-             "newpassword": "tutu", "confirmation": "tutu"},
+            {"language": "en",
+             "oldpassword": "toto",
+             "confirmation": "tutu"},
+            status=400
+        )
+
+        self.ajax_post(
+            reverse("core:user_profile"),
+            {"language": "en",
+             "oldpassword": "toto",
+             "newpassword": "tutu"},
+            status=400
+        )
+
+        self.ajax_post(
+            reverse("core:user_profile"),
+            {"language": "en",
+             "oldpassword": "toto",
+             "newpassword": "tutu",
+             "confirmation": "tutu"},
             status=400
         )