SECURITY: Add CSRF token on Special:ChangePassword

Use a login token when logged out user is using Special:ChangePassword
(should only happen when a user is forced to reset their password to
complete the login process).

Logged in users are not logged in as an effect of resetting their
password, and for them, the edit token check should be sufficient.

Bug: 62497
Change-Id: I08afed3e1aeeb8c97d24fe9858a3ba2c03e92adf

diff --git a/includes/specials/SpecialChangePassword.php b/includes/specials/SpecialChangePassword.php
index 0356d45..91d0404 100644 (file)
--- a/includes/specials/SpecialChangePassword.php
+++ b/includes/specials/SpecialChangePassword.php
@@ -107,6 +107,17 @@ class SpecialChangePassword extends FormSpecialPage {
                        ),
                );
 
+               if ( !$this->getUser()->isLoggedIn() ) {
+                       if ( !LoginForm::getLoginToken() ) {
+                               LoginForm::setLoginToken();
+                       }
+                       $fields['LoginOnChangeToken'] = array(
+                               'type' => 'hidden',
+                               'label' => 'Change Password Token',
+                               'default' => LoginForm::getLoginToken(),
+                       );
+               }
+
                $extraFields = array();
                wfRunHooks( 'ChangePasswordForm', array( &$extraFields ) );
                foreach ( $extraFields as $extra ) {
@@ -160,6 +171,14 @@ class SpecialChangePassword extends FormSpecialPage {
                        return false;
                }
 
+               if ( !$this->getUser()->isLoggedIn()
+                       && $request->getVal( 'wpLoginOnChangeToken' ) !== LoginForm::getLoginToken()
+               ) {
+                       // Potential CSRF (bug 62497)
+                       return false;
+               }
+
+
                if ( $request->getCheck( 'wpCancel' ) ) {
                        $titleObj = Title::newFromText( $request->getVal( 'returnto' ) );
                        if ( !$titleObj instanceof Title ) {