BMCWeb changes login password

[George Liu (刘锡伟)]

I want to discuss with everyone about the solution to change the login
password.

  In the WEB, When the user needs to change the login password, the current
solution is to directly enter the new password twice to change successfully,
but the old password is not verified. the advantage is that we can use the
new password through this solution if we forget the old password. but for
the security reasons, I think should verifying the old password instead of
directly entering the new password before change login password. 

if everyone have any ideas or experience, please share, thanks!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ozlabs.org/pipermail/openbmc/attachments/20190828/633d3607/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3600 bytes
Desc: not available
URL: <http://lists.ozlabs.org/pipermail/openbmc/attachments/20190828/633d3607/attachment.bin>