From 77188fe3ac826397b43acc14f3e1b482b04ca62b Mon Sep 17 00:00:00 2001 From: csteipp Date: Thu, 27 Mar 2014 10:23:47 +0100 Subject: [PATCH] [PATCH] SECURITY: Add CSRF token on Special:ChangePassword Use a login token when logged out user is using Special:ChangePassword (should only happen when a user is forced to reset their password to complete the login process). Logged in users are not logged in as an effect of resetting their password, and for them, the edit token check should be sufficient. Bug: 62497 Change-Id: I08afed3e1aeeb8c97d24fe9858a3ba2c03e92adf --- includes/specials/SpecialChangePassword.php | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/includes/specials/SpecialChangePassword.php b/includes/specials/SpecialChangePassword.php index e538cac..4f93c9e 100644 --- a/includes/specials/SpecialChangePassword.php +++ b/includes/specials/SpecialChangePassword.php @@ -52,6 +52,11 @@ class SpecialChangePassword extends UnlistedSpecialPage { $this->mDomain = $request->getVal( 'wpDomain' ); $user = $this->getUser(); + + if ( !$user->isLoggedIn() && !LoginForm::getLoginToken() ) { + LoginForm::setLoginToken(); + } + if( !$request->wasPosted() && !$user->isLoggedIn() ) { $this->error( $this->msg( 'resetpass-no-info' )->text() ); return; @@ -72,6 +77,14 @@ class SpecialChangePassword extends UnlistedSpecialPage { return; } + if ( !$user->isLoggedIn() + && $request->getVal( 'wpLoginOnChangeToken' ) !== LoginForm::getLoginToken() + ) { + // Potential CSRF (bug 62497) + $this->error( $this->msg( 'sessionfailure' )->text() ); + return false; + } + $this->attemptReset( $this->mNewpass, $this->mRetype ); if( $user->isLoggedIn() ) { @@ -153,6 +166,9 @@ class SpecialChangePassword extends UnlistedSpecialPage { 'wpName' => $this->mUserName, 'wpDomain' => $this->mDomain, ) + $this->getRequest()->getValues( 'returnto', 'returntoquery' ); + if ( !$user->isLoggedIn() ) { + $hiddenFields['wpLoginOnChangeToken'] = LoginForm::getLoginToken(); + } $hiddenFieldsStr = ''; foreach( $hiddenFields as $fieldname => $fieldvalue ) { $hiddenFieldsStr .= Html::hidden( $fieldname, $fieldvalue ) . "\n"; -- 1.8.4.msysgit.0