strongloop / loopback / 6041 / 1

90%

master: 90%

push

travis-ci

Fix "POST /reset-password" for multi-user setup

Fix the code extracting current user id from the access token provided
in the HTTP request, to allow only access tokens created by the target
user models to execute the action.

This fixes the following security vulnerability:

* A UserA with id 1 (for example), requires a resetToken1

* A UserB with the same id requires a resetToken2.

* Using resetToken2, use the UserAs/reset-password endpoint and change
  the password of UserA and/or vice-versa.

1820 of 2275 branches covered (80.0%)

3303 of 3669 relevant lines covered (90.02%)

3165.53 hits per line