Fix current password requirement during password changes (#9550)

* Fix current password requirement during password changes

Regression from #9358 (follow-up, PR not present in a stable/versioned release)

Fix [GHSA-5vxm-62pg-frff](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-5vxm-62pg-frff)

* Remove stale client side bcrypt comment from passwordUtil

* docs: PHP 8.1 is no longer supported

* Minor typographic preference

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

CHANGELOG.md

@@ -15,7 +15,7 @@ See also [the FreshRSS releases](https://github.com/FreshRSS/FreshRSS/releases).
 	* Fix saved search references with overlapping IDs or names [#9484](https://github.com/FreshRSS/FreshRSS/pull/9484)
 	* Fix non-ASCII characters in scripts of fetched HTML pages [#9384](https://github.com/FreshRSS/FreshRSS/pull/9384)
 * Security
-	* 💥 Replace bcrypt challenge auth with direct password comparison [#9358](https://github.com/FreshRSS/FreshRSS/pull/9358)
+	* 💥 Replace bcrypt challenge auth with direct password comparison [#9358](https://github.com/FreshRSS/FreshRSS/pull/9358), [#9550](https://github.com/FreshRSS/FreshRSS/pull/9550)
 	* WebSub security: Implement support for `hub.secret` [#9430](https://github.com/FreshRSS/FreshRSS/pull/9430)
 	* Fix escape labels during JSON import and render tag dropdown as text [#9504](https://github.com/FreshRSS/FreshRSS/pull/9504)
 	* Document threat model for security scanners [#9509](https://github.com/FreshRSS/FreshRSS/pull/9509)

app/Controllers/userController.php

@@ -73,7 +73,12 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
 		return $limit_registrations > 0 && $number_accounts >= $limit_registrations;
 	}
 
-	/** @param array<string,mixed> $userConfigUpdated */
+	/**
+	 * Update a username’s email, password hash and chosen user configuration attributes.
+	 * If `$passwordPlain` is passed an empty string, the user’s password hash stays unupdated.
+	 *
+	 * @param array<string,mixed> $userConfigUpdated
+	 */
 	public static function updateUser(string $user, ?string $email, #[\SensitiveParameter] string $passwordPlain, array $userConfigUpdated = []): bool {
 		$userConfig = FreshRSS_UserConfiguration::getForUser($user);
 		if ($userConfig === null) {
@@ -170,10 +175,13 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
 
 			$email = Minz_Request::paramString('email');
 
+			// Don’t update the user’s password, until the passwordPlain input is
+			// verified to match against the actual current password.
+			$newPasswordPlain = '';
 			$passwordPlain = Minz_Request::paramString('passwordPlain', plaintext: true, trim: false);
-			$newPasswordPlain = Minz_Request::paramString('newPasswordPlain', plaintext: true, trim: false);
-			$confirmPasswordPlain = Minz_Request::paramString('confirmPasswordPlain', plaintext: true, trim: false);
 			if ($passwordPlain !== '') {
+				$newPasswordPlain = Minz_Request::paramString('newPasswordPlain', plaintext: true, trim: false);
+				$confirmPasswordPlain = Minz_Request::paramString('confirmPasswordPlain', plaintext: true, trim: false);
 				$username = Minz_User::name();
 
 				$passwordRequirementsMet = FreshRSS_FormAuth::passwordRequirementsMet(
@@ -230,7 +238,7 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
 			$ok = self::updateUser(
 				Minz_User::name(),
 				$email,
-				$newPasswordPlain,
+				$newPasswordPlain,	// Empty if passwordPlain didn’t match against the current password.
 				[
 					'token' => Minz_Request::paramString('token'),
 				]

app/Utils/passwordUtil.php

@@ -2,8 +2,6 @@
 declare(strict_types=1);
 
 class FreshRSS_password_Util {
-	// Will also have to be computed client side on mobile devices,
-	// so do not use a too high cost
 	public const BCRYPT_COST = 9;
 
 	/**

docs/en/admins/09_AccessControl.md

@@ -40,7 +40,7 @@ These steps are not necessary for trusted, single-user deployments, but are stro
 
 ## Form Authentication
 
-Form Authentication is using a standard HTML form, it does not require any JavaScript since FreshRSS v1.31.0. It will work on any supported version of PHP (>=8.1).
+Form Authentication is using a standard HTML form, it does not require any JavaScript since FreshRSS v1.31.0. It will work on any supported version of PHP (>=8.2).
 
 This option requires nothing more than selecting Form Authentication during installation, and properly configured PHP sessions.