Fixed PasswordChange service can ignore errors

[Xon]

Affected version

2.0.10

PasswordChange::isValid assumes that the only error that XF\Entity\UserAuth can return is against the 'password' field. Except UserAuth is a fully entity which can in theory return a large number of potential errors.

public function isValid(&$error)
{
   $this->userAuth->preSave();

   $errors = $this->userAuth->getErrors();
   if (empty($errors['password']))
   {
      return true;
   }
   else
   {
      $error = $errors['password'];
      return false;
   }
}

 

[XF Bug Bot]

Thank you for reporting this issue. The issue is now resolved and we are aiming to include that in a future XF release (2.0.12).

Change log:

Ensure PasswordChange service errors on any UserAuth error.

Any changes made as a result of this issue being resolved may not be rolled out here until later.