Activities of "ahmet.kuyrukcu"

Summary

On 2026-10-07, five security advisories (three of them high severity) were published for SixLabors.ImageSharp. ABP depends on the affected version through the following chain:

Advisories

| Advisory | Severity | Affected range | Patched | |---|---|---|---| | GHSA-j3p4-wp97-rph4 | High | >= 2.0.0, <= 4.1.1 | 4.1.2 | | GHSA-j9gm-c75j-xc9q | High | >= 2.0.0, <= 4.1.1 | 4.1.2 | | GHSA-jjfr-hcj7-qf5w | High | >= 2.1.0, <= 4.1.1 | 4.1.2 | | GHSA-gwg2-r3hj-4w44 | Moderate | >= 1.0.0-beta0001, <= 4.1.1 | 4.1.2 | | GHSA-wmxv-xphr-5c9g | Moderate | >= 2.0.0, <= 4.1.1 | 4.1.2 |

There is no patched 3.1.x release; the only fixed version is 4.1.2.

Request

Please treat this as urgent and let us know:

1. When a patched ABP release that resolves these advisories will be available.

Thank you.

Hello ABP Support Team,

We are using the ABP Identity module and appreciate the existing features like periodic password changes (password aging), which forces users to update their passwords after a set period.

However, we also have a requirement to implement password history to prevent users from reusing any of their last N passwords. From previous support discussions, it appears this functionality is not currently supported natively, and a custom implementation is required.

It would be ideal to have built-in support for password history as part of the Identity module. This is a common enterprise security requirement and helps align with compliance standards in industries such as finance, healthcare, and government systems.

Requested Feature:

• Configurable number of previous passwords to remember (e.g., 6).
• Automatic storage of hashed previous passwords.
• Validation during both user self-service changes and admin resets.

Benefits:

• Enhances security compliance for enterprise customers.
• Prevents weak password cycling.
• Aligns ABP with enterprise identity management best practices.
• Complements the existing password expiration feature for stronger policies.

Thank you for considering this request! We believe this would be a valuable addition to the ABP Identity module and look forward to your feedback.

When I add "Abp.Account.IsSelfRegistrationEnabled": "false" in the AuthServer project's appsettings.json, the behavior works correctly (self-registration is disabled), but the UI still shows the checkbox as enabled on the host/tenant settings page under the Account tab.

If I toggle the value once in the UI and save, the display becomes correct, because a new record is created in the AbpSettings table.

Reproduction Steps:

• Create a new project with the following command:

abp new MyApp -u angular -t app-pro --theme lepton -m none --separate-auth-server --database-provider ef -csf --version 9.2.4

• Fix Angular build errors, then add the following to app.module.ts in the Angular project:

AccountAdminConfigModule.forRoot()

• In the AuthServer project's appsettings.json, under Settings, add:

"Abp.Account.IsSelfRegistrationEnabled": "false"

• Start the project and navigate to host/tenant settings → Account tab.

Expected Result:

"Enable self registration" should be unchecked in the UI when the setting is false.

Actual Result:

The checkbox is still shown as enabled, even though self-registration is disabled in behavior.