[JS2-1308] Disabled Password is never checked and user can log in

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.3, 2.3.0
• Fix Version/s: 2.2.3, 2.3.0
• Component/s: Security
• Assignee: David Sean Taylor
• Reporter: David Sean Taylor
• Due: 20/Dec/14
• Created: 20/Dec/14 01:33
• Updated: 20/Dec/14 01:37
• Resolved: 20/Dec/14 01:37

Description

in our portal a new created user has to confirm it's password via email.
So we set the password to NOT enabled after user creation:

User user = userManager.getUser(userName);
PasswordCredential pwc = userManager.getPasswordCredential(user);
pwc.setEnabled(false);
userManager.storePasswordCredential(pwc);

But the user can immediately log in, although the password is disabled.
I verified this in the database (security_credential.IS_ENABLED = 0).

The bug seems to be in the
UserPasswordCredentialManagerImpl.getAuthenticatedPasswordCredential
where isEnabled() is never checked !