changelogs/unreleased/security-users-can-update-their-password-without-entering-current-password.yml · e93cffa8db085c479252d8a4fd49b7338a3bcc54 · nexedi / gitlab-ce

Remove password and password_confirmation from whitelisted params in... · 8417f74f

Tiago Botelho authored May 04, 2018

Remove password and password_confirmation from whitelisted params in ProfilesController to prevent password from being changed without previous password being provided

8417f74f

security-users-can-update-their-password-without-entering-current-password.yml 131 Bytes

Replace security-users-can-update-their-password-without-entering-current-password.yml