BacLuc / ecamp3 / 31259127009

push

github

feat(security): OWASP ASVS 5.0 V6 — add change password and require current password to change password

https://github.com/OWASP/ASVS/blob/master/5.0/en/0x15-V6-Authentication.md#v6-authentication
Implement ASVS 6.2.3 (L1): password change now requires the user's
current password via a new currentPassword field on User.

Switch to Symfony's built-in UserPassword constraint (gated with When
on plainPassword and the existing hashed password) instead of the custom
CurrentPasswordRequired validator, per review. Removed the redundant
testPatchUserWithoutUpdatingPasswordDoesNotRequireCurrentPassword test.

Issue: https://github.com/ecamp/ecamp3/issues/2563

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: BacLuc <lucius.bachmann@clubpage.ch>

671 of 4509 branches covered (14.88%)

Branch coverage included in aggregate %.

4444 of 10675 relevant lines covered (41.63%)

63.89 hits per line