{"action":"opened","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/19994","repository_url":"https://api.github.com/repos/joomla/joomla-cms","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19994/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19994/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19994/events","html_url":"https://github.com/joomla/joomla-cms/issues/19994","id":308522260,"number":19994,"title":"Force session change/logout after password change","user":{"login":"feltkamptv","id":13018798,"avatar_url":"https://avatars3.githubusercontent.com/u/13018798?v=4","gravatar_id":"","url":"https://api.github.com/users/feltkamptv","html_url":"https://github.com/feltkamptv","followers_url":"https://api.github.com/users/feltkamptv/followers","following_url":"https://api.github.com/users/feltkamptv/following{/other_user}","gists_url":"https://api.github.com/users/feltkamptv/gists{/gist_id}","starred_url":"https://api.github.com/users/feltkamptv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/feltkamptv/subscriptions","organizations_url":"https://api.github.com/users/feltkamptv/orgs","repos_url":"https://api.github.com/users/feltkamptv/repos","events_url":"https://api.github.com/users/feltkamptv/events{/privacy}","received_events_url":"https://api.github.com/users/feltkamptv/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-26T10:50:12Z","updated_at":"2018-03-26T10:50:12Z","closed_at":null,"author_association":"NONE","body":"If a Joomla user account has been compromised and is logged in and being used on a different computer, changing the password does not help to log the attacker out. It would be nice to force a session change and/or user logout after a password change.\r\n\r\nI use the DB for sessions and I could solve it with a plugin and the ```onUserAfterSave``` function, which would delete all sessions in the DB where user id is X and session id not is the current session id. But I thought posting this here first, maybe this should be integrated in Joomla?\r\n\r\n### Steps to reproduce the issue\r\n1. Login to Joomla on Chrome.\r\n2. Login again on Firefox\r\n3. Go to change password and change the password on Firefox.\r\n4. Reload Chrome account tab.\r\n5. Session is still alive on Chrome even after password change.\r\n\r\n### System information\r\nJoomla version: 3.8.6\r\nPHP: 7.1\r\nMySQL: 5.6\r\n\r\nThis bug was reported to us by a security researcher."}}
{"actor":{"display_login":"feltkamptv"}}