Hi,

I pasted the ChangePassword code from DNN's UserController.cs below. Irrespective of the return value of ChangePassword on MembershipProvider instance, the UpdatePassword is set to false. I thought only on successful password change the UpdatePassword field need to be set to false. Is this a bug? This is a issue as I have a custom password reset control when a user is forced to change the password on login by the admin, if the user enters the current password wrong, MembershipProvider's ChangePassword returns false then UpdatePassword is set to false, but the user didn't even change his password as requested by the admin.

public static bool ChangePassword(UserInfo user, string oldPassword, string newPassword)

        {

            bool retValue;

 

            //Although we would hope that the caller has already validated the password,

            //Validate the new Password

            if (ValidatePassword(newPassword))

            {

                retValue = MembershipProvider.Instance().ChangePassword(user, oldPassword, newPassword);

 

                //Update User

                user.Membership.UpdatePassword = false;

                UpdateUser(user.PortalID, user);

            }

            else

            {

                throw new Exception("Invalid Password");

            }

            return retValue;

        }

Also, what is the best way to validate that the user entered the right password before calling UserController's ChangePassword method to avoid this issue. I appreciate any help.

Thanks,

Ana

DNN 07.03.04

that's a bug - please log it to support.dnnsoftware.com - as to the best way to validate it, ChangePassword is, as that integrates with other functions such as password history to verify that as well as being a valid string, the password has not been used (or is not the same as the username) when password history is enabled

---

Buy the new Professional DNN7: Open Source .NET CMS Platform book Amazon US