bug62497_122.patch
Public
Actions

Authored By

	• bzimport
	Nov 22 2014, 2:58 AM

Size

2 KB

Referenced Files

None

Subscribers

None

bug62497_122.patch
View Options

	From cfa552093c94f10a5cea76a043e23afebae1dded Mon Sep 17 00:00:00 2001
	From: csteipp <csteipp@wikimedia.org>
	Date: Wed, 26 Mar 2014 17:53:07 -0700
	Subject: [PATCH] SECURITY: Add CSRF token on Special:ChangePassword

	Use a login token when logged out user is using Special:ChangePassword
	(should only happen when a user is forced to reset their password to
	complete the login process).

	Logged in users are not logged in as an effect of resetting their
	password, and for them, the edit token check should be sufficient.

	Bug: 62497
	Change-Id: I08afed3e1aeeb8c97d24fe9858a3ba2c03e92adf
	---
	includes/specials/SpecialChangePassword.php \| 16 ++++++++++++++++
	1 file changed, 16 insertions(+)

	diff --git a/includes/specials/SpecialChangePassword.php b/includes/specials/SpecialChangePassword.php
	index c54b557..a75e7e8 100644
	--- a/includes/specials/SpecialChangePassword.php
	+++ b/includes/specials/SpecialChangePassword.php
	@@ -52,6 +52,11 @@ class SpecialChangePassword extends UnlistedSpecialPage {
	$this->mDomain = $request->getVal( 'wpDomain' );

	$user = $this->getUser();
	+
	+ if ( !$user->isLoggedIn() && !LoginForm::getLoginToken() ) {
	+ LoginForm::setLoginToken();
	+ }
	+
	if ( !$request->wasPosted() && !$user->isLoggedIn() ) {
	$this->error( $this->msg( 'resetpass-no-info' )->text() );

	@@ -81,6 +86,14 @@ class SpecialChangePassword extends UnlistedSpecialPage {
	return;
	}

	+ if ( !$user->isLoggedIn()
	+ && $request->getVal( 'wpLoginOnChangeToken' ) !== LoginForm::getLoginToken()
	+ ) {
	+ // Potential CSRF (bug 62497)
	+ $this->error( $this->msg( 'sessionfailure' )->text() );
	+ return false;
	+ }
	+
	$this->attemptReset( $this->mNewpass, $this->mRetype );

	if ( $user->isLoggedIn() ) {
	@@ -157,6 +170,9 @@ class SpecialChangePassword extends UnlistedSpecialPage {
	'wpName' => $this->mUserName,
	'wpDomain' => $this->mDomain,
	) + $this->getRequest()->getValues( 'returnto', 'returntoquery' );
	+ if ( !$user->isLoggedIn() ) {
	+ $hiddenFields['wpLoginOnChangeToken'] = LoginForm::getLoginToken();
	+ }
	$hiddenFieldsStr = '';
	foreach ( $hiddenFields as $fieldname => $fieldvalue ) {
	$hiddenFieldsStr .= Html::hidden( $fieldname, $fieldvalue ) . "\n";
	--
	1.8.4.5

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 12503
Default Alt Text: bug62497_122.patch (2 KB)

bug62497_122.patchPublicActions

bug62497_122.patchView Options

File Metadata

Event Timeline

bug62497_122.patch
Public
Actions

bug62497_122.patch
View Options