ui: user: password change: require a confirmation-password

To hedge against a scenario where an attacker has local or even
physical access to a computer where a user is logged in.

While that general scenario cannot neither get detected nor really
secured against, at least not without requiring re-authentication on
every API call that can have side-effect (i.e., all but GET method),
it still makes sense to ensure that credentials cannot be modified,
which would allow denial of service.

See the related pve-access-control commit 5bcf553 ("user: password
change: require confirmation-password parameter")

Reported-by: Wouter Arts <security@wth-security.nl>
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

diff --git a/www/manager6/Workspace.js b/www/manager6/Workspace.js
index 89ca47b7cb181263299628cf22e77a3c78ac4d06..52c66108ca247b39adae21c281239ab3480e2a02 100644 (file)
--- a/www/manager6/Workspace.js
+++ b/www/manager6/Workspace.js
@@ -382,6 +382,7 @@ Ext.define('PVE.StdWorkspace', {
                                    handler: function() {
                                        var win = Ext.create('Proxmox.window.PasswordEdit', {
                                            userid: Proxmox.UserName,
+                                           confirmCurrentPassword: Proxmox.UserName !== 'root@pam',
                                        });
                                        win.show();
                                    },

diff --git a/www/manager6/dc/UserView.js b/www/manager6/dc/UserView.js
index 6805e9ff9700275b93bfdc2835f469f94f882254..12c3e85469ddfdc24e997215a50c226070490a87 100644 (file)
--- a/www/manager6/dc/UserView.js
+++ b/www/manager6/dc/UserView.js
@@ -70,6 +70,7 @@ Ext.define('PVE.dc.UserView', {
            handler: function(btn, event, rec) {
                Ext.create('Proxmox.window.PasswordEdit', {
                    userid: rec.data.userid,
+                   confirmCurrentPassword: Proxmox.UserName !== 'root@pam',
                    autoShow: true,
                    listeners: {
                        destroy: () => reload(),