ignacionelson db65731c3a Keep your own credentials behind your profile, and end tokens on a reset ...

Your own email address, password and second factor are changed from your
profile, which asks for your current password. The staff screen and the
API changed the first two with no password at all, and the API removed
the third on your own account without the confirmation the web asks
for. StaffAccounts::ownCredentialChanges is the one rule both now ask:
the staff screen refuses your own email or password with a validation
error and points to the profile, and the API answers 403, as it does for
removing your own second factor.

Changing somebody else's password is unchanged: that is what edit_users
and edit_clients mean, on the screen and over the API. It now also
revokes that account's API tokens. Browser sessions already ended with
the password hash; tokens did not.

GHSA-j5cp-r8pr-m5cr

2026-10-03 23:05:23 -03:00

..

Http

Never remember a JSON request as the page to go back to

2026-09-25 02:40:29 -03:00

Models

Let each role, and each person, choose where they land after signing in

2026-09-13 15:05:40 -03:00

Modules

Keep your own credentials behind your profile, and end tokens on a reset

2026-10-03 23:05:23 -03:00

Providers

ProjectSend 2.0.0

2026-08-14 01:38:12 -03:00

Support

Stop a mistyped CAPTCHA flag from switching the CAPTCHA off

2026-09-08 17:05:30 -03:00