nextcloud / nextcloud/password_policy
When password expiration is enabled, accounts without a stored pwd_last_updated timestamp are not treated as expired
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 39
- Forks
- 27
- Avg merge
- 1h 36m
- Merged PRs (30d)
- 10
Description
When password expiration is enabled, accounts without a stored pwd_last_updated timestamp are not treated as expired. Instead, the first successful login recreates the timestamp with the current time and allows access. This lets pre-existing local accounts bypass the expiration policy without changing their password.
App version observed: password_policy 5.0.0
Nextcloud 33.0.2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing password expiration handling in the password_policy 5.0.0 login path, especially how accounts without pwd_last_updated are processed. Verify the behavior for a pre-existing local account and ensure it cannot bypass expiration by recreating the timestamp at login.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100