BacLuc / ecamp3 / 31948265754

33%

devel: 36%

Build Type

push

github

Committed by BacLuc

Commit Message

feat(security): OWASP ASVS 5.0 V6 — add change password and require current password to change password

https://github.com/OWASP/ASVS/blob/master/5.0/en/0x15-V6-Authentication.md#v6-authentication
Implement ASVS 6.2.3 (L1): password change now requires the user's
current password via a new currentPassword field on User.

Switch to Symfony's built-in UserPassword constraint (gated with When
on plainPassword and the existing hashed password) instead of the custom
CurrentPasswordRequired validator, per review. Removed the redundant
testPatchUserWithoutUpdatingPasswordDoesNotRequireCurrentPassword test.

Issue: https://github.com/ecamp/ecamp3/issues/2563

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: BacLuc <lucius.bachmann@clubpage.ch>

Coverage Stats

671 of 4539 branches covered (14.78%)

Branch coverage included in aggregate %.

0 of 27 new or added lines in 2 files covered. (0.0%)

111 existing lines in 6 files now uncovered.

4444 of 10734 relevant lines covered (41.4%)

63.54 hits per line