Studio: gate change-password submit on current_password length#5738
Closed
danielhanchen wants to merge 3 commits into
Closed
Studio: gate change-password submit on current_password length#5738danielhanchen wants to merge 3 commits into
danielhanchen wants to merge 3 commits into
Conversation
The change-password form's submit-button disable logic checks new password length, confirm equality and current!=new, but skipped a current-password length check. When __UNSLOTH_BOOTSTRAP__ is injected that is harmless -- currentPassword falls back to a 16+ char bootstrap value -- but on the admin-forced must_change_password path no bootstrap is published, the "Current password" input is rendered, and the gate let users submit with an empty current_password. The submit handler then rejected it with "Unable to initialize setup. Reload the page and try again." -- a misleading error that suggests a backend bootstrap problem. Add the missing currentPassword.length < 8 check so the button stays disabled until every required field is filled. The new gate is a strict superset of the submit handler's own validation, so the noisy reload error path becomes unreachable. Common bootstrap-injection path is unaffected: bootstrap pws are 16+ chars, so currentPassword.length < 8 is always false there.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the password change form validation logic in auth-form.tsx to include a minimum length requirement of 8 characters for the current password field. I have no further feedback to provide as there were no review comments to evaluate.
…ndler Reviewer round on the original PR flagged that the disable-gate update left the submit handler asymmetric: the button predicate now requires currentPassword.length >= 8, but handleSubmit still only does `if (!currentPassword)`. The button is normally kept disabled in this state, but native form submission (Enter on a focused input, browser autofill replaying a form post) can bypass the disabled attribute and reach handleSubmit with a 1-7 char current_password, which the backend schema then rejects with a noisier 422. Tighten the submit handler to the same length check so both validation surfaces stay in lockstep. Empty input still surfaces the original "Unable to initialize setup" reload-prompt error; short non-empty input surfaces a more accurate "must be at least 8 characters" message.
Member
Author
|
Pushed 8091ea7 addressing one P1 from a fresh reviewer.py pass. Asymmetric-fix bug: the disable-gate update made the button require Tightened the submit handler to the same length check so both validation surfaces stay in lockstep. Empty input still surfaces the original "Unable to initialize setup" reload-prompt error; short non-empty input now surfaces a more accurate "must be at least 8 characters" message.
|
danielhanchen
added a commit
that referenced
this pull request
May 23, 2026
Bundles three independent CI regressions hitting the maintainer PR backlog. Each one is verified end-to-end on a staging fork against real Ubuntu / macOS / Windows GitHub-hosted runners before this lands. 1. Windows --no-torch install: pydantic + pydantic-core drift to incompatible versions under `uv pip install --no-deps -r no-torch-runtime.txt` because pip resolves each independently from latest. pydantic.VERSION 2.13.4 pins pydantic-core==2.46.4 but pydantic-core 2.47.0 was the freshest published wheel, so `import pydantic` raised `SystemError: pydantic-core 2.47.0 is incompatible with the current pydantic version`. Resolve pydantic WITH deps in a focused pip call (install.sh, install.ps1, install_python_stack.py) before the --no-deps no-torch-runtime pass so pip pins pydantic-core to the version pydantic declares. pydantic's transitive deps (annotated-types, pydantic-core, typing-extensions, typing-inspection) are torch-free. Drop the redundant `Patch Studio venv with full typer / pydantic dep trees` workaround from the four Windows smoke YAMLs. Supersedes #5733 + #5734. 2. Linux Studio Update CI: upstream llama.cpp b9261+ split each binary's entry code into a paired `libllama-<binary>-impl.so` shared library. `llama-server` and `llama-quantize` NEEDED-link against `libllama-server-impl.so` / `libllama-quantize-impl.so` with RUNPATH `$ORIGIN`, so the prebuilt overlay must copy those alongside the binaries. Without that, ldd reports them missing, preflight rejects, the installer falls back to source build, and studio-update-smoke annotates `setup.sh idempotency regressed`. Add `libllama-*-impl.so*` to the Linux runtime patterns and lock the pattern in test_rocm_support.TestRuntimePatterns. 3. Mac Studio UI Chat: change-password submit clicked while disabled. The disable gate only checked new + confirm password length, but Playwright's first click landed before the current-password field's React state had committed, so the form was simultaneously logically-invalid (current_password empty) and the button was disabled. Tighten the gate to require `currentPassword.length >= 8` and mirror the same check in the submit handler so Enter / autofill cannot bypass. Supersedes #5738.
Member
Author
|
Superseded by #5741 (now merged). The pydantic-core mismatch, llama.cpp |
rsd-darshan
pushed a commit
to rsd-darshan/unsloth
that referenced
this pull request
Jun 3, 2026
Bundles three independent CI regressions hitting the maintainer PR backlog. Each one is verified end-to-end on a staging fork against real Ubuntu / macOS / Windows GitHub-hosted runners before this lands. 1. Windows --no-torch install: pydantic + pydantic-core drift to incompatible versions under `uv pip install --no-deps -r no-torch-runtime.txt` because pip resolves each independently from latest. pydantic.VERSION 2.13.4 pins pydantic-core==2.46.4 but pydantic-core 2.47.0 was the freshest published wheel, so `import pydantic` raised `SystemError: pydantic-core 2.47.0 is incompatible with the current pydantic version`. Resolve pydantic WITH deps in a focused pip call (install.sh, install.ps1, install_python_stack.py) before the --no-deps no-torch-runtime pass so pip pins pydantic-core to the version pydantic declares. pydantic's transitive deps (annotated-types, pydantic-core, typing-extensions, typing-inspection) are torch-free. Drop the redundant `Patch Studio venv with full typer / pydantic dep trees` workaround from the four Windows smoke YAMLs. Supersedes unslothai#5733 + unslothai#5734. 2. Linux Studio Update CI: upstream llama.cpp b9261+ split each binary's entry code into a paired `libllama-<binary>-impl.so` shared library. `llama-server` and `llama-quantize` NEEDED-link against `libllama-server-impl.so` / `libllama-quantize-impl.so` with RUNPATH `$ORIGIN`, so the prebuilt overlay must copy those alongside the binaries. Without that, ldd reports them missing, preflight rejects, the installer falls back to source build, and studio-update-smoke annotates `setup.sh idempotency regressed`. Add `libllama-*-impl.so*` to the Linux runtime patterns and lock the pattern in test_rocm_support.TestRuntimePatterns. 3. Mac Studio UI Chat: change-password submit clicked while disabled. The disable gate only checked new + confirm password length, but Playwright's first click landed before the current-password field's React state had committed, so the form was simultaneously logically-invalid (current_password empty) and the button was disabled. Tighten the gate to require `currentPassword.length >= 8` and mirror the same check in the submit handler so Enter / autofill cannot bypass. Supersedes unslothai#5738.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
__UNSLOTH_BOOTSTRAP__is injected this is harmless (currentPassword falls back to a 16+ char bootstrap value), but on the admin-forcedmust_change_passwordpath no bootstrap is published, the "Current password" input is rendered, and the gate let users submit with an empty current_password.UNSLOTH_STUDIO_HOMEbuild.Fix
currentPassword.length < 8toinvalidChangePasswordForminstudio/frontend/src/features/auth/components/auth-form.tsx. The new gate is a strict superset of the submit handler's own validation, so the noisy reload-error path becomes unreachable.currentPassword.length < 8is always false there.Test plan
cd studio/frontend && npm run typecheckcleanmust_change_password=truereset (no bootstrap): "Current password" input rendered, button stays disabled until that field has 8+ chars, no more "Unable to initialize setup" error