| That was always the case. See:
MHD_RESULT
TMH_private_post_instances_ID_auth (const struct TMH_RequestHandler *rh,
struct MHD_Connection *connection,
struct TMH_HandlerContext *hc)
{
struct TMH_MerchantInstance *mi = hc->instance;
return post_instances_ID_auth (mi,
connection,
hc,
false,
TMH_TCS_NONE);
}
in taler-merchant-httpd_post-management-instances-INSTANCE-auth.c:
If you have the old password (are logged in), you can change it. So this is NOT a regression. We can discuss the policy though... |