Password Reset Client Side Bug not working no error indicated

[Lee182]

Hi so I ran into this problem. I setup an installation with the install script. And let my client create a user with the webmail interface.

My client forgot the password so reset with the wildduck api. curl -X POST \ http://localhost:8080/users/6614041ba893260ddef6482a/password/reset

When my client logined in with the reset password. He went to account change password. Put the existing password as the reset password and the new password twice, click change password. It looks like it did something but nothing actually happened.

So he logged out and couldn't login with the new password.

Looking at the db i saw an tempPassword field added but the password field the same. tempPassword: { validAfter: ISODate('2024-04-18T02:52:17.300Z'), password: '$pbkdf2-sha256$i=100000$Q5j/gx+Jn+hx4f3kEGpLsA$iK4f8ls4hBr1GmV+ifMPlbtaD0qalhkB/5U73XJs36Y', created: ISODate('2024-04-18T02:52:17.300Z') } }

I think it maybe a problem in that the webmail checks the existing password again the password field and not tempPassword?