[Web] translate password errors in the forced password change modal#7344
Open
smpaz7467 wants to merge 1 commit into
Open
[Web] translate password errors in the forced password change modal#7344smpaz7467 wants to merge 1 commit into
smpaz7467 wants to merge 1 commit into
Conversation
The forced password change modal posts to the JSON API and renders data[0].msg directly. The API returns raw language keys rather than translated strings, so a user who fails the complexity policy is shown the literal text "password_complexity" instead of a message. Every other password form renders errors through alertbox_log_parser(), which resolves the key against $lang. The modal is the only one that talks to the API directly, and it never resolved the key. Resolve it against lang_danger, which base.twig already exposes for this purpose. This also covers password_mismatch, password_empty and access_denied, and applies to the admin path as well. Unknown keys still fall through unchanged. The lookup is guarded with hasOwnProperty because msg is attacker- independent but dynamic: a bare lang_danger[msg] would resolve inherited Object.prototype members such as "constructor" to a function, which jQuery's .text() would then invoke as a callback. Language files are untouched: prerequisites.inc.php loads lang.en-gb.json as the base and merges the active locale over it, so locales that lack the key inherit the English string. Fixes mailcow#7301 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
When a user is forced to change their password at next login and enters one that
fails the complexity policy, the modal shows the literal string
password_complexityinstead of a message.Why
The forced password change modal is the only password form that posts to the JSON
API (
/api/v1/edit/self, or/api/v1/edit/adminfor admins) and rendersdata[0].msgstraight into the alert. The API intentionally returns raw languagekeys — every other password form goes through
alertbox_log_parser(), whichresolves the key against
$lang. This modal never did.Fix
Resolve the key against
lang_danger, whichbase.twigalready exposes forexactly this purpose (it is
json_encode($lang['danger']), seefooter.inc.php:74, and is used the same way inadmin.js). No new machinery, noAPI change — the API keeps returning stable keys for external consumers, since the
bug is in the presentation layer.
This also fixes
password_mismatch,password_emptyandaccess_deniedin thesame modal, and covers the admin path through the same handler.
The lookup is guarded with
hasOwnProperty:msgis dynamic, and a barelang_danger[msg]would resolve inheritedObject.prototypemembers likeconstructorto a function, which jQuery's.text()treats as a callback andinvokes.
No language files are touched.
prerequisites.inc.php:269loadslang.en-gb.jsonas the base and merges the active locale over it, so the fourlocales that currently lack
danger.password_complexity(az, gr, lt, nb) inheritthe English string rather than falling back to the raw key.
Verification
base.twigparses clean under Twig (with mailcow's customquery_string/is_uri/rot13/formatBytesextensions registered), before and after.dangersection oflang.en-gb.json:password_complexitypassword_complexitypassword_mismatchpassword_mismatchpassword_emptypassword_emptyaccess_deniedaccess_denied'Password change failed.'(JS fallback)Fixes #7301