Unable to change password

[sanyappc]

Description:

Unable to change password. The “Please enter your password” window keeps popping up.

Steps to reproduce:

1. Enable Settings -> Accounts -> Two Factor Authentication -> Enable Two Factor Authentication without mandatory 2FA requirement
2. Try to change password

Expected behavior:

Password changed

Actual behavior:

The current password is requested; when the current password is entered, the window pops up again.

Server Setup Information:

• Version of Rocket.Chat Server: 7.10.0
• Deployment Method: docker
• Number of Running Instances: 1

Client Setup Information

• Any

[mac146]

Hey! I’d like to work on this issue.

[reetp]

Server Setup Information:

• Version of Rocket.Chat Server: 7.10.0

You should be using the most recent patch for your version eg 7.10.3 currently. It has security patches.... Upgrade now.

https://github.com/RocketChat/Rocket.Chat/tags

After that, and as per the debugging guidelines, always test on the latest release - so minimum 7.11.x or a 7.12.rc development RC. Issues are often fixed in newer versions.

Thanks.

[reetp]

Hey! I’d like to work on this issue.

Please read this about Rocket & Github

First you need to check it is actually a bug. Can it be reproduced on the latest code?

Second once it is confirmed as a bug you need to ask on open.rocket.chat in the support channel if it's an issue they want worked on. It may have already been picked up internally.

This will save you wasting a lot of your own time.

Thanks.

[mac146]

Thanks for the clarification! I’ll check the bug on the latest version and ask on open.rocket.chat before working on it. Appreciate your guidance

[Khizarshah01]

I tested this issue on both the latest release and the develop branch, the bug still exists. when a user tries to change their password with 2FA enabled or disabled, even after entering the correct TOTP, email code, or current password, the server responds with a 400 error

{
    "success": false,
    "error": "TOTP Required [totp-required]",
    "errorType": "totp-required",
}

[Khizarshah01]

I looked into this further and found the root cause: The global 2FA flow sends the verification code in request headers (x-2fa-code / x-2fa-method), while the users.updateOwnBasicInfo api endpoint only checks the request body for typedPassword, which is not included there.
because of this mismatch, the endpoint fails to detect the valid 2FA code and keeps showing the authentication modal repeatedly.

[reetp]

Please read what I had previously said.

you need to ask on open.rocket.chat in the support channel if it's an issue they want worked on. It may have already been picked up internally.

[Khizarshah01]

got it, thanks!
i will check in the support channel before opening a PR

[TLINDEN]

We can reproduce this behavior. Has this already been addressed in 7.12.1?

[TLINDEN]

It's still not working in 7.12.2

[reetp]

This has been escalated internally.

[TLINDEN]

Still not working in 7.13.2.

I know you have a lot to do, but it's really a security issue not being able to change ones password. So, please, increae the priority if this issue.

Thanks!

[sanyappc]

I hope #37745 fixes this. It's only in 8.0.0-rc.0