Page MenuHomePhabricator
Files F13061

bug62497.patch
Public
Actions

Authored By
• bzimport
Nov 22 2014, 2:58 AM
Size
1 KB
Referenced Files
None
Subscribers
None

bug62497.patch
View Options

From a8733b4fd063ba689c41bc7737635789e301965b Mon Sep 17 00:00:00 2001
From: csteipp <csteipp@wikimedia.org>
Date: Mon, 10 Mar 2014 12:26:17 -0700
Subject: [PATCH] SECURITY: Add CSRF token on Special:ChangePassword
Use a login token when logged out user is using Special:ChangePassword
(should only happen when a user is forced to reset their password to
complete the login process).
Logged in users are not logged in as an effect of resetting their
password, and for them, the edit token check should be sufficient.
Bug: 62497
Change-Id: I08afed3e1aeeb8c97d24fe9858a3ba2c03e92adf
---
includes/specials/SpecialChangePassword.php | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/includes/specials/SpecialChangePassword.php b/includes/specials/SpecialChangePassword.php
index 47f5b1e..3f94391 100644
--- a/includes/specials/SpecialChangePassword.php
+++ b/includes/specials/SpecialChangePassword.php
@@ -107,6 +107,17 @@ class SpecialChangePassword extends FormSpecialPage {
),
);
+ if ( !$this->getUser()->isLoggedIn() ) {
+ if ( !LoginForm::getLoginToken() ) {
+ LoginForm::setLoginToken();
+ }
+ $fields['LoginOnChangeToken'] = array(
+ 'type' => 'hidden',
+ 'label' => 'Change Password Token',
+ 'default' => LoginForm::getLoginToken(),
+ );
+ }
+
$extraFields = array();
wfRunHooks( 'ChangePasswordForm', array( &$extraFields ) );
foreach ( $extraFields as $extra ) {
@@ -160,6 +171,14 @@ class SpecialChangePassword extends FormSpecialPage {
return false;
}
+ if ( !$this->getUser()->isLoggedIn()
+ && $request->getVal( 'wpLoginOnChangeToken' ) !== LoginForm::getLoginToken()
+ ) {
+ // Potential CSRF (bug 62497)
+ return false;
+ }
+
+
if ( $request->getCheck( 'wpCancel' ) ) {
$titleObj = Title::newFromText( $request->getVal( 'returnto' ) );
if ( !$titleObj instanceof Title ) {
--
1.8.4.5

File Metadata

Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
12502
Default Alt Text
bug62497.patch (1 KB)

Event Timeline

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL