MDL-22739 keeping the magic 'changeme' password only for manual auth, it does not...

diff --git a/login/index.php b/login/index.php
index 6327ad5..b106bfc 100644 (file)
--- a/login/index.php
+++ b/login/index.php
@@ -172,8 +172,9 @@ if ($frm and isset($frm->username)) {                             // Login WITH
             die;
         }
 
-        if ($frm->password == 'changeme') {
-            //force the change
+        if ($user->auth === 'manual' and $frm->password === 'changeme') {
+            // force the change - this is deprecated and it makes sense only for manual auth,
+            // because most other plugins can not change password easily
             set_user_preference('auth_forcepasswordchange', true, $user->id);
         }