{"action":"created","issue":{"url":"https://api.github.com/repos/ato/clojars-web/issues/383","labels_url":"https://api.github.com/repos/ato/clojars-web/issues/383/labels{/name}","comments_url":"https://api.github.com/repos/ato/clojars-web/issues/383/comments","events_url":"https://api.github.com/repos/ato/clojars-web/issues/383/events","html_url":"https://github.com/ato/clojars-web/issues/383","id":108778613,"number":383,"title":"Insecure Password Change Mechanism","user":{"login":"shawarkhan52","id":12973275,"avatar_url":"https://avatars.githubusercontent.com/u/12973275?v=3","gravatar_id":"","url":"https://api.github.com/users/shawarkhan52","html_url":"https://github.com/shawarkhan52","followers_url":"https://api.github.com/users/shawarkhan52/followers","following_url":"https://api.github.com/users/shawarkhan52/following{/other_user}","gists_url":"https://api.github.com/users/shawarkhan52/gists{/gist_id}","starred_url":"https://api.github.com/users/shawarkhan52/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shawarkhan52/subscriptions","organizations_url":"https://api.github.com/users/shawarkhan52/orgs","repos_url":"https://api.github.com/users/shawarkhan52/repos","events_url":"https://api.github.com/users/shawarkhan52/events{/privacy}","received_events_url":"https://api.github.com/users/shawarkhan52/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-09-29T01:38:39Z","updated_at":"2015-09-29T01:50:18Z","closed_at":null,"body":"Hi,\r\n\r\nI have found a security issue in your site, i have found that the Password of a user's account can be changed without any validation or without knowing the old password as there is no \"Current Password\" field in password change area located in https://clojars.org/profile , this is a high risk issue which can compromise an account. Please add a Current Password field for validation which should  ask for old password before changing the password. As i am doing a responsible disclosure i'd appreciate if you can add my name to your hall of fame:\r\n\r\nName: Shawar Khan\r\nLink: https://www.facebook.com/shawarkhanskofficial\r\n\r\nRegards,\r\n\r\nShawar Khan\r\nWeb Application Security Researcher"},"comment":{"url":"https://api.github.com/repos/ato/clojars-web/issues/comments/143922165","html_url":"https://github.com/ato/clojars-web/issues/383#issuecomment-143922165","issue_url":"https://api.github.com/repos/ato/clojars-web/issues/383","id":143922165,"user":{"login":"shawarkhan52","id":12973275,"avatar_url":"https://avatars.githubusercontent.com/u/12973275?v=3","gravatar_id":"","url":"https://api.github.com/users/shawarkhan52","html_url":"https://github.com/shawarkhan52","followers_url":"https://api.github.com/users/shawarkhan52/followers","following_url":"https://api.github.com/users/shawarkhan52/following{/other_user}","gists_url":"https://api.github.com/users/shawarkhan52/gists{/gist_id}","starred_url":"https://api.github.com/users/shawarkhan52/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shawarkhan52/subscriptions","organizations_url":"https://api.github.com/users/shawarkhan52/orgs","repos_url":"https://api.github.com/users/shawarkhan52/repos","events_url":"https://api.github.com/users/shawarkhan52/events{/privacy}","received_events_url":"https://api.github.com/users/shawarkhan52/received_events","type":"User","site_admin":false},"created_at":"2015-09-29T01:50:18Z","updated_at":"2015-09-29T01:50:18Z","body":"okay i will create an issue like that"}}