[SECURITY] Destroy user sessions on password change

Author: derhansen

Classes/Service/FrontendUserService.php

@@ -14,6 +14,7 @@
 use TYPO3\CMS\Core\Context\Context;
 use TYPO3\CMS\Core\Crypto\PasswordHashing\PasswordHashFactory;
 use TYPO3\CMS\Core\Database\ConnectionPool;
+use TYPO3\CMS\Core\Session\SessionManager;
 use TYPO3\CMS\Core\Utility\GeneralUtility;
 
 /**
@@ -110,6 +111,15 @@ public function updatePassword(string $newPassword)
 
         // Unset reason for password change in user session
         $this->getFrontendUser()->setKey('ses', self::SESSION_KEY, null);
+
+        // Destroy all sessions of the user except the current one
+        $sessionManager = GeneralUtility::makeInstance(SessionManager::class);
+        $sessionBackend = $sessionManager->getSessionBackend('FE');
+        $sessionManager->invalidateAllSessionsByUserId(
+            $sessionBackend,
+            (int)$this->getFrontendUser()->user['uid'],
+            $this->getFrontendUser()
+        );
     }
 
     /**

ext_emconf.php

@@ -10,7 +10,7 @@
     'state' => 'stable',
     'uploadfolder' => '0',
     'clearCacheOnLoad' => 0,
-    'version' => '2.0.4',
+    'version' => '2.0.5',
     'constraints' => [
         'depends' => [
             'typo3' => '9.5.0-10.4.99',