{"action":"created","comment":{"url":"https://api.github.com/repos/sympa-community/sympa/pulls/comments/182975863","pull_request_review_id":113885046,"id":182975863,"diff_hunk":"@@ -635,23 +635,45 @@ sub update_global_user {\n \n     $who = Sympa::Tools::Text::canonic_email($who);\n \n-    ## use hash fingerprint to store password\n-    ## hashes that use salts will randomly generate one\n-    $values->{'password'} =\n-        Sympa::User::password_fingerprint($values->{'password'}, undef)\n-        if ($values->{'password'});\n-\n-    ## Canonicalize lang if possible.\n-    $values->{'lang'} = Sympa::Language::canonic_lang($values->{'lang'})\n-        || $values->{'lang'}\n-        if $values->{'lang'};\n \n+    ## Check whether password is already defined.\n     my $sdm = Sympa::DatabaseManager->instance;\n     unless ($sdm) {\n         $log->syslog('err', 'Unavailable database connection');\n         return undef;\n     }\n \n+\n+    push @sth_stack, $sth;\n+\n+    $sth = $sdm->do_query(\n+        \"SELECT password_user FROM user_table WHERE (email_user=%s)\",\n+        $sdm->quote($who)\n+    );\n+    unless (defined $sth) {\n+        $log->syslog('err',\n+            'Could not check password information for user %s in user_table', $who);\n+        $sth = pop @sth_stack;\n+        return undef;\n+    }\n+\n+    my $current_password = $sth->fetchrow();\n+\n+    $sth = pop @sth_stack;\n+\n+    if ($values->{'password'}) {\n+        if($current_password ne $values->{'password'}) {","path":"src/lib/Sympa/User.pm","position":41,"original_position":41,"commit_id":"31a5b16c04f5b13e691b5a3b130156c8544bf6a8","original_commit_id":"31a5b16c04f5b13e691b5a3b130156c8544bf6a8","user":{"login":"dverdin","id":1244681,"avatar_url":"https://avatars3.githubusercontent.com/u/1244681?v=4","gravatar_id":"","url":"https://api.github.com/users/dverdin","html_url":"https://github.com/dverdin","followers_url":"https://api.github.com/users/dverdin/followers","following_url":"https://api.github.com/users/dverdin/following{/other_user}","gists_url":"https://api.github.com/users/dverdin/gists{/gist_id}","starred_url":"https://api.github.com/users/dverdin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dverdin/subscriptions","organizations_url":"https://api.github.com/users/dverdin/orgs","repos_url":"https://api.github.com/users/dverdin/repos","events_url":"https://api.github.com/users/dverdin/events{/privacy}","received_events_url":"https://api.github.com/users/dverdin/received_events","type":"User","site_admin":false},"body":"Oh yes, 2 is possible: anytime we update an existing user object by passing the sub the content of said user.\r\nThat's the reason why the bug was reported after all. That is exactly what happened.\r\nI think that checking data before updating them is not such  a bad idea. And password is the only case in which we have to make such check.","created_at":"2018-04-20T08:12:14Z","updated_at":"2018-04-20T08:12:14Z","html_url":"https://github.com/sympa-community/sympa/pull/269#discussion_r182975863","pull_request_url":"https://api.github.com/repos/sympa-community/sympa/pulls/269","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/sympa-community/sympa/pulls/comments/182975863"},"html":{"href":"https://github.com/sympa-community/sympa/pull/269#discussion_r182975863"},"pull_request":{"href":"https://api.github.com/repos/sympa-community/sympa/pulls/269"}},"in_reply_to_id":181934886},"pull_request":{"url":"https://api.github.com/repos/sympa-community/sympa/pulls/269","id":181808458,"html_url":"https://github.com/sympa-community/sympa/pull/269","diff_url":"https://github.com/sympa-community/sympa/pull/269.diff","patch_url":"https://github.com/sympa-community/sympa/pull/269.patch","issue_url":"https://api.github.com/repos/sympa-community/sympa/issues/269","number":269,"state":"open","locked":false,"title":"Password spontaneous reinitialization","user":{"login":"dverdin","id":1244681,"avatar_url":"https://avatars3.githubusercontent.com/u/1244681?v=4","gravatar_id":"","url":"https://api.github.com/users/dverdin","html_url":"https://github.com/dverdin","followers_url":"https://api.github.com/users/dverdin/followers","following_url":"https://api.github.com/users/dverdin/following{/other_user}","gists_url":"https://api.github.com/users/dverdin/gists{/gist_id}","starred_url":"https://api.github.com/users/dverdin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dverdin/subscriptions","organizations_url":"https://api.github.com/users/dverdin/orgs","repos_url":"https://api.github.com/users/dverdin/repos","events_url":"https://api.github.com/users/dverdin/events{/privacy}","received_events_url":"https://api.github.com/users/dverdin/received_events","type":"User","site_admin":false},"body":"Fixing issue #167 along with problem reported on the list by Pat Allen: password was reset when subscribing to a list. When updating a user, password was systematically rehashed even if it was not a new password. Consequently, anytime a user was updated, the password was replaced by its own hash. Fixed by checking the database for a pre-existing password before computing the hash. If the hash in database and the value password present in the user data during update are the same, the password is not rehashed.","created_at":"2018-04-16T09:56:36Z","updated_at":"2018-04-20T08:12:14Z","closed_at":null,"merged_at":null,"merge_commit_sha":"39692ef667b2204a628de3c3b567524d60db0dc8","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/sympa-community/sympa/pulls/269/commits","review_comments_url":"https://api.github.com/repos/sympa-community/sympa/pulls/269/comments","review_comment_url":"https://api.github.com/repos/sympa-community/sympa/pulls/comments{/number}","comments_url":"https://api.github.com/repos/sympa-community/sympa/issues/269/comments","statuses_url":"https://api.github.com/repos/sympa-community/sympa/statuses/31a5b16c04f5b13e691b5a3b130156c8544bf6a8","head":{"label":"dverdin:sympa-6.2","ref":"sympa-6.2","sha":"31a5b16c04f5b13e691b5a3b130156c8544bf6a8","user":{"login":"dverdin","id":1244681,"avatar_url":"https://avatars3.githubusercontent.com/u/1244681?v=4","gravatar_id":"","url":"https://api.github.com/users/dverdin","html_url":"https://github.com/dverdin","followers_url":"https://api.github.com/users/dverdin/followers","following_url":"https://api.github.com/users/dverdin/following{/other_user}","gists_url":"https://api.github.com/users/dverdin/gists{/gist_id}","starred_url":"https://api.github.com/users/dverdin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dverdin/subscriptions","organizations_url":"https://api.github.com/users/dverdin/orgs","repos_url":"https://api.github.com/users/dverdin/repos","events_url":"https://api.github.com/users/dverdin/events{/privacy}","received_events_url":"https://api.github.com/users/dverdin/received_events","type":"User","site_admin":false},"repo":{"id":82568235,"name":"sympa","full_name":"dverdin/sympa","owner":{"login":"dverdin","id":1244681,"avatar_url":"https://avatars3.githubusercontent.com/u/1244681?v=4","gravatar_id":"","url":"https://api.github.com/users/dverdin","html_url":"https://github.com/dverdin","followers_url":"https://api.github.com/users/dverdin/followers","following_url":"https://api.github.com/users/dverdin/following{/other_user}","gists_url":"https://api.github.com/users/dverdin/gists{/gist_id}","starred_url":"https://api.github.com/users/dverdin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dverdin/subscriptions","organizations_url":"https://api.github.com/users/dverdin/orgs","repos_url":"https://api.github.com/users/dverdin/repos","events_url":"https://api.github.com/users/dverdin/events{/privacy}","received_events_url":"https://api.github.com/users/dverdin/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/dverdin/sympa","description":"clone of the sympa-6.2-branch 12973 from the RENATER svn","fork":true,"url":"https://api.github.com/repos/dverdin/sympa","forks_url":"https://api.github.com/repos/dverdin/sympa/forks","keys_url":"https://api.github.com/repos/dverdin/sympa/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dverdin/sympa/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dverdin/sympa/teams","hooks_url":"https://api.github.com/repos/dverdin/sympa/hooks","issue_events_url":"https://api.github.com/repos/dverdin/sympa/issues/events{/number}","events_url":"https://api.github.com/repos/dverdin/sympa/events","assignees_url":"https://api.github.com/repos/dverdin/sympa/assignees{/user}","branches_url":"https://api.github.com/repos/dverdin/sympa/branches{/branch}","tags_url":"https://api.github.com/repos/dverdin/sympa/tags","blobs_url":"https://api.github.com/repos/dverdin/sympa/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dverdin/sympa/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dverdin/sympa/git/refs{/sha}","trees_url":"https://api.github.com/repos/dverdin/sympa/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dverdin/sympa/statuses/{sha}","languages_url":"https://api.github.com/repos/dverdin/sympa/languages","stargazers_url":"https://api.github.com/repos/dverdin/sympa/stargazers","contributors_url":"https://api.github.com/repos/dverdin/sympa/contributors","subscribers_url":"https://api.github.com/repos/dverdin/sympa/subscribers","subscription_url":"https://api.github.com/repos/dverdin/sympa/subscription","commits_url":"https://api.github.com/repos/dverdin/sympa/commits{/sha}","git_commits_url":"https://api.github.com/repos/dverdin/sympa/git/commits{/sha}","comments_url":"https://api.github.com/repos/dverdin/sympa/comments{/number}","issue_comment_url":"https://api.github.com/repos/dverdin/sympa/issues/comments{/number}","contents_url":"https://api.github.com/repos/dverdin/sympa/contents/{+path}","compare_url":"https://api.github.com/repos/dverdin/sympa/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dverdin/sympa/merges","archive_url":"https://api.github.com/repos/dverdin/sympa/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dverdin/sympa/downloads","issues_url":"https://api.github.com/repos/dverdin/sympa/issues{/number}","pulls_url":"https://api.github.com/repos/dverdin/sympa/pulls{/number}","milestones_url":"https://api.github.com/repos/dverdin/sympa/milestones{/number}","notifications_url":"https://api.github.com/repos/dverdin/sympa/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dverdin/sympa/labels{/name}","releases_url":"https://api.github.com/repos/dverdin/sympa/releases{/id}","deployments_url":"https://api.github.com/repos/dverdin/sympa/deployments","created_at":"2017-02-20T14:42:19Z","updated_at":"2018-04-16T08:43:28Z","pushed_at":"2018-04-16T09:54:57Z","git_url":"git://github.com/dverdin/sympa.git","ssh_url":"git@github.com:dverdin/sympa.git","clone_url":"https://github.com/dverdin/sympa.git","svn_url":"https://github.com/dverdin/sympa","homepage":null,"size":131394,"stargazers_count":0,"watchers_count":0,"language":"Perl","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"gpl-2.0","name":"GNU General Public License v2.0","spdx_id":"GPL-2.0","url":"https://api.github.com/licenses/gpl-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"sympa-community:sympa-6.2","ref":"sympa-6.2","sha":"f369898f35227ebfe1830cd8062a6fdf528c7408","user":{"login":"sympa-community","id":25160739,"avatar_url":"https://avatars0.githubusercontent.com/u/25160739?v=4","gravatar_id":"","url":"https://api.github.com/users/sympa-community","html_url":"https://github.com/sympa-community","followers_url":"https://api.github.com/users/sympa-community/followers","following_url":"https://api.github.com/users/sympa-community/following{/other_user}","gists_url":"https://api.github.com/users/sympa-community/gists{/gist_id}","starred_url":"https://api.github.com/users/sympa-community/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sympa-community/subscriptions","organizations_url":"https://api.github.com/users/sympa-community/orgs","repos_url":"https://api.github.com/users/sympa-community/repos","events_url":"https://api.github.com/users/sympa-community/events{/privacy}","received_events_url":"https://api.github.com/users/sympa-community/received_events","type":"Organization","site_admin":false},"repo":{"id":79463326,"name":"sympa","full_name":"sympa-community/sympa","owner":{"login":"sympa-community","id":25160739,"avatar_url":"https://avatars0.githubusercontent.com/u/25160739?v=4","gravatar_id":"","url":"https://api.github.com/users/sympa-community","html_url":"https://github.com/sympa-community","followers_url":"https://api.github.com/users/sympa-community/followers","following_url":"https://api.github.com/users/sympa-community/following{/other_user}","gists_url":"https://api.github.com/users/sympa-community/gists{/gist_id}","starred_url":"https://api.github.com/users/sympa-community/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sympa-community/subscriptions","organizations_url":"https://api.github.com/users/sympa-community/orgs","repos_url":"https://api.github.com/users/sympa-community/repos","events_url":"https://api.github.com/users/sympa-community/events{/privacy}","received_events_url":"https://api.github.com/users/sympa-community/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/sympa-community/sympa","description":"Sympa, Mailing List Management Software","fork":false,"url":"https://api.github.com/repos/sympa-community/sympa","forks_url":"https://api.github.com/repos/sympa-community/sympa/forks","keys_url":"https://api.github.com/repos/sympa-community/sympa/keys{/key_id}","collaborators_url":"https://api.github.com/repos/sympa-community/sympa/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/sympa-community/sympa/teams","hooks_url":"https://api.github.com/repos/sympa-community/sympa/hooks","issue_events_url":"https://api.github.com/repos/sympa-community/sympa/issues/events{/number}","events_url":"https://api.github.com/repos/sympa-community/sympa/events","assignees_url":"https://api.github.com/repos/sympa-community/sympa/assignees{/user}","branches_url":"https://api.github.com/repos/sympa-community/sympa/branches{/branch}","tags_url":"https://api.github.com/repos/sympa-community/sympa/tags","blobs_url":"https://api.github.com/repos/sympa-community/sympa/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/sympa-community/sympa/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/sympa-community/sympa/git/refs{/sha}","trees_url":"https://api.github.com/repos/sympa-community/sympa/git/trees{/sha}","statuses_url":"https://api.github.com/repos/sympa-community/sympa/statuses/{sha}","languages_url":"https://api.github.com/repos/sympa-community/sympa/languages","stargazers_url":"https://api.github.com/repos/sympa-community/sympa/stargazers","contributors_url":"https://api.github.com/repos/sympa-community/sympa/contributors","subscribers_url":"https://api.github.com/repos/sympa-community/sympa/subscribers","subscription_url":"https://api.github.com/repos/sympa-community/sympa/subscription","commits_url":"https://api.github.com/repos/sympa-community/sympa/commits{/sha}","git_commits_url":"https://api.github.com/repos/sympa-community/sympa/git/commits{/sha}","comments_url":"https://api.github.com/repos/sympa-community/sympa/comments{/number}","issue_comment_url":"https://api.github.com/repos/sympa-community/sympa/issues/comments{/number}","contents_url":"https://api.github.com/repos/sympa-community/sympa/contents/{+path}","compare_url":"https://api.github.com/repos/sympa-community/sympa/compare/{base}...{head}","merges_url":"https://api.github.com/repos/sympa-community/sympa/merges","archive_url":"https://api.github.com/repos/sympa-community/sympa/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/sympa-community/sympa/downloads","issues_url":"https://api.github.com/repos/sympa-community/sympa/issues{/number}","pulls_url":"https://api.github.com/repos/sympa-community/sympa/pulls{/number}","milestones_url":"https://api.github.com/repos/sympa-community/sympa/milestones{/number}","notifications_url":"https://api.github.com/repos/sympa-community/sympa/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/sympa-community/sympa/labels{/name}","releases_url":"https://api.github.com/repos/sympa-community/sympa/releases{/id}","deployments_url":"https://api.github.com/repos/sympa-community/sympa/deployments","created_at":"2017-01-19T14:50:48Z","updated_at":"2018-04-20T03:34:35Z","pushed_at":"2018-04-20T03:36:11Z","git_url":"git://github.com/sympa-community/sympa.git","ssh_url":"git@github.com:sympa-community/sympa.git","clone_url":"https://github.com/sympa-community/sympa.git","svn_url":"https://github.com/sympa-community/sympa","homepage":"","size":131766,"stargazers_count":36,"watchers_count":36,"language":"Perl","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":24,"mirror_url":null,"archived":false,"open_issues_count":66,"license":{"key":"gpl-2.0","name":"GNU General Public License v2.0","spdx_id":"GPL-2.0","url":"https://api.github.com/licenses/gpl-2.0"},"forks":24,"open_issues":66,"watchers":36,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/sympa-community/sympa/pulls/269"},"html":{"href":"https://github.com/sympa-community/sympa/pull/269"},"issue":{"href":"https://api.github.com/repos/sympa-community/sympa/issues/269"},"comments":{"href":"https://api.github.com/repos/sympa-community/sympa/issues/269/comments"},"review_comments":{"href":"https://api.github.com/repos/sympa-community/sympa/pulls/269/comments"},"review_comment":{"href":"https://api.github.com/repos/sympa-community/sympa/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/sympa-community/sympa/pulls/269/commits"},"statuses":{"href":"https://api.github.com/repos/sympa-community/sympa/statuses/31a5b16c04f5b13e691b5a3b130156c8544bf6a8"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"dverdin"}}