Page Menu
Home
Phabricator
Search
Configure Global Search
Log In
Files
F13063
bug62497_121.patch
Public
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Mute Notifications
Award Token
Flag For Later
Authored By
•
bzimport
Nov 22 2014, 2:58 AM
2014-11-22 02:58:12 (UTC+0)
Size
2 KB
Referenced Files
None
Subscribers
None
bug62497_121.patch
View Options
From 77188fe3ac826397b43acc14f3e1b482b04ca62b Mon Sep 17 00:00:00 2001
From: csteipp <csteipp@wikimedia.org>
Date: Thu, 27 Mar 2014 10:23:47 +0100
Subject: [PATCH] [PATCH] SECURITY: Add CSRF token on Special:ChangePassword
Use a login token when logged out user is using Special:ChangePassword
(should only happen when a user is forced to reset their password to
complete the login process).
Logged in users are not logged in as an effect of resetting their
password, and for them, the edit token check should be sufficient.
Bug: 62497
Change-Id: I08afed3e1aeeb8c97d24fe9858a3ba2c03e92adf
---
includes/specials/SpecialChangePassword.php | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/includes/specials/SpecialChangePassword.php b/includes/specials/SpecialChangePassword.php
index e538cac..4f93c9e 100644
--- a/includes/specials/SpecialChangePassword.php
+++ b/includes/specials/SpecialChangePassword.php
@@ -52,6 +52,11 @@ class SpecialChangePassword extends UnlistedSpecialPage {
$this->mDomain = $request->getVal( 'wpDomain' );
$user = $this->getUser();
+
+ if ( !$user->isLoggedIn() && !LoginForm::getLoginToken() ) {
+ LoginForm::setLoginToken();
+ }
+
if( !$request->wasPosted() && !$user->isLoggedIn() ) {
$this->error( $this->msg( 'resetpass-no-info' )->text() );
return;
@@ -72,6 +77,14 @@ class SpecialChangePassword extends UnlistedSpecialPage {
return;
}
+ if ( !$user->isLoggedIn()
+ && $request->getVal( 'wpLoginOnChangeToken' ) !== LoginForm::getLoginToken()
+ ) {
+ // Potential CSRF (bug 62497)
+ $this->error( $this->msg( 'sessionfailure' )->text() );
+ return false;
+ }
+
$this->attemptReset( $this->mNewpass, $this->mRetype );
if( $user->isLoggedIn() ) {
@@ -153,6 +166,9 @@ class SpecialChangePassword extends UnlistedSpecialPage {
'wpName' => $this->mUserName,
'wpDomain' => $this->mDomain,
) + $this->getRequest()->getValues( 'returnto', 'returntoquery' );
+ if ( !$user->isLoggedIn() ) {
+ $hiddenFields['wpLoginOnChangeToken'] = LoginForm::getLoginToken();
+ }
$hiddenFieldsStr = '';
foreach( $hiddenFields as $fieldname => $fieldvalue ) {
$hiddenFieldsStr .= Html::hidden( $fieldname, $fieldvalue ) . "\n";
--
1.8.4.msysgit.0
File Metadata
Details
Attached
Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
12504
Default Alt Text
bug62497_121.patch (2 KB)
Attached To
Mode
T64497: Login csrf in Special:ChangePassword
Attached
Detach File
Event Timeline
Log In to Comment