Merge pull request #7627 from umbraco/v8/bugfix/AB4828-resetpassword-mail

AB4828 - Reset Password Email

(cherry picked from commit f00680bfe6)

src/SolutionInfo.cs

@@ -18,5 +18,5 @@ using System.Resources;
 [assembly: AssemblyVersion("8.0.0")]
 
 // these are FYI and changed automatically
-[assembly: AssemblyFileVersion("8.4.1")]
-[assembly: AssemblyInformationalVersion("8.4.1")]
+[assembly: AssemblyFileVersion("8.4.2")]
+[assembly: AssemblyInformationalVersion("8.4.2")]

src/Umbraco.Core/Persistence/Repositories/Implement/UserRepository.cs

@@ -557,6 +557,16 @@ ORDER BY colName";
                 }
             }
 
+            // If userlogin or the email has changed then need to reset security stamp
+            if (changedCols.Contains("userLogin") || changedCols.Contains("userEmail"))
+            {
+                userDto.EmailConfirmedDate = null;
+                userDto.SecurityStampToken = entity.SecurityStamp = Guid.NewGuid().ToString();
+                
+                changedCols.Add("emailConfirmedDate");
+                changedCols.Add("securityStampToken");  
+            }
+
             //only update the changed cols
             if (changedCols.Count > 0)
             {

src/Umbraco.Tests/Persistence/Repositories/UserRepositoryTest.cs

@@ -409,6 +409,35 @@ namespace Umbraco.Tests.Persistence.Repositories
             }
         }
 
+        [Test]
+        public void Can_Invalidate_SecurityStamp_On_Username_Change()
+        {
+            // Arrange
+            var provider = TestObjects.GetScopeProvider(Logger);
+            using (var scope = provider.CreateScope())
+            {
+                var repository = CreateRepository(provider);
+                var userGroupRepository = CreateUserGroupRepository(provider);
+
+                var user = CreateAndCommitUserWithGroup(repository, userGroupRepository);
+                var originalSecurityStamp = user.SecurityStamp;
+
+                // Ensure when user generated a security stamp is present
+                Assert.That(user.SecurityStamp, Is.Not.Null);
+                Assert.That(user.SecurityStamp, Is.Not.Empty);
+
+                // Update username
+                user.Username = user.Username + "UPDATED";
+                repository.Save(user);
+
+                // Get the user
+                var updatedUser = repository.Get(user.Id);
+
+                // Ensure the Security Stamp is invalidated & no longer the same
+                Assert.AreNotEqual(originalSecurityStamp, updatedUser.SecurityStamp);
+            }
+        }
+
         private void AssertPropertyValues(IUser updatedItem, IUser originalUser)
         {
             Assert.That(updatedItem.Id, Is.EqualTo(originalUser.Id));

src/Umbraco.Web.UI/Umbraco.Web.UI.csproj

@@ -347,9 +347,9 @@
         <WebProjectProperties>
           <UseIIS>False</UseIIS>
           <AutoAssignPort>True</AutoAssignPort>
-          <DevelopmentServerPort>8410</DevelopmentServerPort>
+          <DevelopmentServerPort>8420</DevelopmentServerPort>
           <DevelopmentServerVPath>/</DevelopmentServerVPath>
-          <IISUrl>http://localhost:8410</IISUrl>
+          <IISUrl>http://localhost:8420</IISUrl>
           <NTLMAuthentication>False</NTLMAuthentication>
           <UseCustomServer>False</UseCustomServer>
           <CustomServerUrl>

src/Umbraco.Web/Mvc/ValidateMvcAngularAntiForgeryTokenAttribute.cs

@@ -22,7 +22,7 @@ namespace Umbraco.Web.Mvc
             var userIdentity = filterContext.HttpContext.User.Identity as ClaimsIdentity;
             if (userIdentity != null)
             {
-                //if there is not CookiePath claim, then exist
+                //if there is not CookiePath claim, then exit
                 if (userIdentity.HasClaim(x => x.Type == ClaimTypes.CookiePath) == false)
                 {
                     base.OnActionExecuting(filterContext);

src/Umbraco.Web/Security/BackOfficeCookieAuthenticationProvider.cs

@@ -41,6 +41,9 @@ namespace Umbraco.Web.Security
                     : Guid.NewGuid();
 
                 backOfficeIdentity.SessionId = session.ToString();
+
+                //since it is a cookie-based authentication add that claim
+                backOfficeIdentity.AddClaim(new Claim(ClaimTypes.CookiePath, "/", ClaimValueTypes.String, UmbracoBackOfficeIdentity.Issuer, UmbracoBackOfficeIdentity.Issuer, backOfficeIdentity));
             }
 
             base.ResponseSignIn(context);

src/Umbraco.Web/WebApi/Filters/ValidateAngularAntiForgeryTokenAttribute.cs

@@ -21,7 +21,7 @@ namespace Umbraco.Web.WebApi.Filters
             var userIdentity = ((ApiController) actionContext.ControllerContext.Controller).User.Identity as ClaimsIdentity;
             if (userIdentity != null)
             {
-                //if there is not CookiePath claim, then exist
+                //if there is not CookiePath claim, then exit
                 if (userIdentity.HasClaim(x => x.Type == ClaimTypes.CookiePath) == false)
                 {
                     base.OnActionExecuting(actionContext);