[I] [Bug] A stale self-service password change can overwrite an administrator reset [rocketmq-dashboard]

["Aias00 (via GitHub)" <gi...@apache.org>]

Aias00 opened a new issue, #7193:
URL: https://github.com/apache/rocketmq-dashboard/issues/7193

   ### Before Creating the Bug Report
   - [x] Searched all-state issues and PRs for concurrent/stale password changes.
   - [x] This concerns RocketMQ Studio.
   
   ### Studio Version
   `rocketmq-studio` at `127c47b06a268cc74224d5f34c56ec7c36ac0d55`.
   
   ### Runtime Environment
   Source review on macOS; database-backed AuthService. Regression verification will use the dev H2 profile in MySQL compatibility mode.
   
   ### Connected RocketMQ Cluster
   Not involved.
   
   ### Describe the Bug
   `AuthService.changePassword` reads the user hash and validates the current password, but its subsequent UPDATE is conditional only on user ID. A request that validated a now-obsolete password can overwrite an administrator reset completed in the meantime. The existing transaction makes the update/revoke pair atomic but does not prevent this lost update.
   
   ### Steps to Reproduce
   1. Start a self-service password change with the current password and pause after verification, before its user UPDATE.
   2. Complete an administrator reset to a different password.
   3. Resume the first request. It updates by ID and replaces the administrator's password with its own value.
   
   ### Expected Behavior
   Reject the stale mutation with a conflict and preserve the completed reset. Use the observed hash as an optimistic UPDATE condition and check the affected-row count before revoking sessions.
   
   ### Related Work
   PR #4686 (merged) makes password replacement/session revocation atomic. PR #6849 (open) coordinates login issuance with password changes. Neither adds optimistic concurrency protection to two competing password changes. This report is about competing mutations, not an old-password login creating a session.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org