Password change is disabled

[nextcloud]

Password change is disabled

[sushifrick]

Same problem here,

we are sending users to a separate webinterface to manage their passwords using the lost_password_link configuration-option. When this option is set the guest will see the mentioned error message when she tries to set up her account.

As guests always use local (DB) accounts, they should circumvent the lost_password_link in my opinion.

Kind regards,
Sascha

[ChristophWurst]

The logic is in https://github.com/nextcloud/server/blob/master/core/Controller/LostController.php. We have the user ID there, so it should be possible to somehow determine if password reset should still be possibly. The question is how. We should likely not check for the guests app directly but ask the user back-end if password reset is allowed or not.

[blizzz]

In LostController::resetform() and LostController::setPassword() we might move it behind the token verification check. These methods are not the entry point for the password reset mechanism, so it is even considerable to remove them. Otherwise, we "reset is disabled" page can be shown when no token is present. This should be good enough to cater for special cases like these. This has to be done in server though, so not specific to the guests app.

[blizzz]

Proposed fix at nextcloud/server#28794