@mohasinac/appkit 4.6.0 → 4.6.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -71,6 +71,12 @@ const rawTesterChecklistItems = [
|
|
|
71
71
|
{ key: "avatar-upload", label: "Uploading a profile avatar works" },
|
|
72
72
|
{ key: "notification-prefs", label: "Notification preferences save correctly" },
|
|
73
73
|
{ key: "public-profile-toggle", label: "Public profile visibility toggle works" },
|
|
74
|
+
{
|
|
75
|
+
key: "password-change-otp-required",
|
|
76
|
+
label: "Changing your password from Settings requires entering an emailed 6-digit code before it actually takes effect — the password does not change just from submitting the current/new password form",
|
|
77
|
+
description: "Fixed 2026-08-20 — the password-change API previously trusted the session cookie alone, with no server-side check of the current password at all. Submit the Change Password form with a correct current password; confirm you land on a \"we sent a code to your email\" step, and the password only actually updates after entering the correct code. Also verify: an expired/wrong code is rejected with a clear error, and \"Resend code\" works.",
|
|
78
|
+
href: "/user/settings",
|
|
79
|
+
},
|
|
74
80
|
{
|
|
75
81
|
key: "own-public-profile-quick-links",
|
|
76
82
|
label: "\"View public profile\" is easy to find and works from three places: the My Account dashboard header, the My Account quick-links grid (\"My Public Profile\" tile), and the /user/profile page (next to \"Manage Addresses\")",
|