strongloop / loopback / 6056 / 2

90%

master: 90%

push

travis-ci

Fix "POST /change-password" for multi-user setup

Fix the code extracting current user id from the access token provided
in the HTTP request, to allow only access tokens created by the target
user models to execute the action.

This fixes the following security vulnerability:

* We have two user models, e.g. Admin and Customer

* We have an Admin instance and a Customer instance with the same
  id and the same password.

* The Customer can change Admin's password using their
  regular access token.

1818 of 2273 branches covered (79.98%)

3302 of 3668 relevant lines covered (90.02%)

3162.08 hits per line