Page MenuHomePhabricator

bug62497_119.patch

Authored By
bzimport
Nov 22 2014, 2:58 AM
Size
2 KB
Referenced Files
None
Subscribers
None

bug62497_119.patch

From 0e5cc8ca0b35aec51094c785a05b4b3dca2001ae Mon Sep 17 00:00:00 2001
From: csteipp <csteipp@wikimedia.org>
Date: Thu, 27 Mar 2014 10:47:10 +0100
Subject: [PATCH] SECURITY: Add CSRF token on Special:ChangePassword
Use a login token when logged out user is using Special:ChangePassword
(should only happen when a user is forced to reset their password to
complete the login process).
Logged in users are not logged in as an effect of resetting their
password, and for them, the edit token check should be sufficient.
Bug: 62497
Change-Id: I08afed3e1aeeb8c97d24fe9858a3ba2c03e92adf
---
includes/specials/SpecialChangePassword.php | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/includes/specials/SpecialChangePassword.php b/includes/specials/SpecialChangePassword.php
index a06b5f3..efff720 100644
--- a/includes/specials/SpecialChangePassword.php
+++ b/includes/specials/SpecialChangePassword.php
@@ -51,6 +51,11 @@ class SpecialChangePassword extends UnlistedSpecialPage {
$this->getOutput()->disallowUserJs();
$user = $this->getUser();
+
+ if ( !$user->isLoggedIn() && !LoginForm::getLoginToken() ) {
+ LoginForm::setLoginToken();
+ }
+
if( !$request->wasPosted() && !$user->isLoggedIn() ) {
$this->error( $this->msg( 'resetpass-no-info' )->text() );
return;
@@ -72,6 +77,14 @@ class SpecialChangePassword extends UnlistedSpecialPage {
return;
}
+ if ( !$user->isLoggedIn()
+ && $request->getVal( 'wpLoginOnChangeToken' ) !== LoginForm::getLoginToken()
+ ) {
+ // Potential CSRF (bug 62497)
+ $this->error( $this->msg( 'sessionfailure' )->text() );
+ return false;
+ }
+
$this->attemptReset( $this->mNewpass, $this->mRetype );
$this->getOutput()->addWikiMsg( 'resetpass_success' );
if( !$user->isLoggedIn() ) {
@@ -136,6 +149,10 @@ class SpecialChangePassword extends UnlistedSpecialPage {
$oldpassMsg = 'oldpassword';
$submitMsg = 'resetpass-submit-loggedin';
}
+ $loginOnChangeToken = '';
+ if ( !$user->isLoggedIn() ) {
+ $loginOnChangeToken = LoginForm::getLoginToken();
+ }
$this->getOutput()->addHTML(
Xml::fieldset( $this->msg( 'resetpass_header' )->text() ) .
Xml::openElement( 'form',
@@ -147,6 +164,7 @@ class SpecialChangePassword extends UnlistedSpecialPage {
Html::hidden( 'wpName', $this->mUserName ) . "\n" .
Html::hidden( 'wpDomain', $this->mDomain ) . "\n" .
Html::hidden( 'returnto', $this->getRequest()->getVal( 'returnto' ) ) . "\n" .
+ $loginOnChangeToken .
$this->msg( 'resetpass_text' )->parseAsBlock() . "\n" .
Xml::openElement( 'table', array( 'id' => 'mw-resetpass-table' ) ) . "\n" .
$this->pretty( array(
--
1.8.4.msysgit.0

File Metadata

Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
12505
Default Alt Text
bug62497_119.patch (2 KB)

Event Timeline