From da8cef6b25c004d1fd56d67eca883c6a21444dc9 Mon Sep 17 00:00:00 2001 From: csteipp Date: Mon, 10 Mar 2014 12:26:17 -0700 Subject: [PATCH] SECURITY: Add CSRF token on Special:ChangePassword Use a login token when logged out user is using Special:ChangePassword (should only happen when a user is forced to reset their password to complete the login process). Logged in users are not logged in as an effect of resetting their password, and for them, the edit token check should be sufficient. Bug: 62497 Change-Id: I08afed3e1aeeb8c97d24fe9858a3ba2c03e92adf --- includes/specials/SpecialChangePassword.php | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/includes/specials/SpecialChangePassword.php b/includes/specials/SpecialChangePassword.php index 0356d45b73..91d0404d8f 100644 --- a/includes/specials/SpecialChangePassword.php +++ b/includes/specials/SpecialChangePassword.php @@ -107,6 +107,17 @@ class SpecialChangePassword extends FormSpecialPage { ), ); + if ( !$this->getUser()->isLoggedIn() ) { + if ( !LoginForm::getLoginToken() ) { + LoginForm::setLoginToken(); + } + $fields['LoginOnChangeToken'] = array( + 'type' => 'hidden', + 'label' => 'Change Password Token', + 'default' => LoginForm::getLoginToken(), + ); + } + $extraFields = array(); wfRunHooks( 'ChangePasswordForm', array( &$extraFields ) ); foreach ( $extraFields as $extra ) { @@ -160,6 +171,14 @@ class SpecialChangePassword extends FormSpecialPage { return false; } + if ( !$this->getUser()->isLoggedIn() + && $request->getVal( 'wpLoginOnChangeToken' ) !== LoginForm::getLoginToken() + ) { + // Potential CSRF (bug 62497) + return false; + } + + if ( $request->getCheck( 'wpCancel' ) ) { $titleObj = Title::newFromText( $request->getVal( 'returnto' ) ); if ( !$titleObj instanceof Title ) { -- 2.20.1