v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

controller/internal/web/handlers.go

@@ -2507,6 +2507,7 @@ func (s *Server) securityPageData() map[string]interface{} {
 	// EXISTS, and the value comes from POST /settings/retrieval-password/reveal, which is an
 	// explicit authenticated act and is logged as one.
 	data["HasRetrievalPassword"] = strings.TrimSpace(s.settings.GetRetrievalPassword()) != ""
+	data["MinPassword"] = claimMinPassword // R-983: the password form's minimum is the claim's
 	data["HubURL"] = s.cfg.Hub.URL
 	data["SupportEmail"] = "support@felhom.eu"
 	data["SupportURL"] = "https://felhom.eu/kapcsolat"
@@ -2848,9 +2849,10 @@ func (s *Server) settingsPasswordHandler(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	// Validate new password length
-	if len(newPassword) < 8 {
-		data["PasswordError"] = s.msg(r, "settings.pw_too_short")
+	// Validate new password length. R-983 (v0.324.0): the claim's minimum (claim.go claimMinPassword), not 8 — one
+	// dashboard password, one rule, wherever it is set. Pinned by TestR983_SettingsPasswordMinimumIsTheClaims.
+	if len(newPassword) < claimMinPassword {
+		data["PasswordError"] = s.msg(r, "settings.pw_too_short", claimMinPassword)
 		s.executeTemplate(w, r, "settings_security", data)
 		return
 	}
@@ -2881,8 +2883,8 @@ func (s *Server) settingsPasswordHandler(w http.ResponseWriter, r *http.Request)
 
 	s.logger.Printf("[INFO] [web] Password changed via settings page from %s", r.RemoteAddr)
 
-	// Invalidate all sessions (force re-login)
-	s.invalidateAllSessions()
+	// Invalidate all sessions (force re-login) — the dashboard's, the family gate's and every app gate pass (R-976).
+	s.endEverySession("password change")
 
 	// Redirect to login with flash message
 	http.Redirect(w, r, "/login?"+flashQuery("flash", "flash.login.password_changed"), http.StatusFound)