diff options
| author | Reed Loden <reed@reedloden.com> | 2011-12-13 23:30:07 +0100 |
|---|---|---|
| committer | Reed Loden <reed@reedloden.com> | 2011-12-13 23:30:07 +0100 |
| commit | a6aa75fc6f96527f01e8b4f0da414d9fa8ad8ce1 (patch) | |
| tree | 4fd1b57b81d9467912099f4ac3b71fd9af0abd3a | |
| parent | 0133e0b65b1d73d87604b9f94b92c712206137e3 (diff) | |
| download | bugzilla-a6aa75fc6f96527f01e8b4f0da414d9fa8ad8ce1.tar.gz bugzilla-a6aa75fc6f96527f01e8b4f0da414d9fa8ad8ce1.tar.xz | |
Bug 705474 - CSRF vulnerability in createaccount.cgi allows possible unauthorized account creation e-mail request
[r=mkanat a=mkanat]
| -rw-r--r-- | Bugzilla/Token.pm | 9 | ||||
| -rwxr-xr-x | createaccount.cgi | 5 | ||||
| -rw-r--r-- | template/en/default/account/create.html.tmpl | 1 |
3 files changed, 13 insertions, 2 deletions
diff --git a/Bugzilla/Token.pm b/Bugzilla/Token.pm index 86220aa29..2bb68e721 100644 --- a/Bugzilla/Token.pm +++ b/Bugzilla/Token.pm @@ -176,9 +176,14 @@ sub issue_hash_token { $data ||= []; $time ||= time(); + # For the user ID, use the actual ID if the user is logged in. + # Otherwise, use the remote IP, in case this is for something + # such as creating an account or logging in. + my $user_id = Bugzilla->user->id || remote_ip(); + # The concatenated string is of the form - # token creation time + site-wide secret + user ID + data - my @args = ($time, Bugzilla->localconfig->{'site_wide_secret'}, Bugzilla->user->id, @$data); + # token creation time + site-wide secret + user ID (either ID or remote IP) + data + my @args = ($time, Bugzilla->localconfig->{'site_wide_secret'}, $user_id, @$data); my $token = join('*', @args); # Wide characters cause md5_hex() to die. diff --git a/createaccount.cgi b/createaccount.cgi index db0727add..2348d4e91 100755 --- a/createaccount.cgi +++ b/createaccount.cgi @@ -62,6 +62,11 @@ unless ($createexp) { my $login = $cgi->param('login'); if (defined($login)) { + # Check the hash token to make sure this user actually submitted + # the create account form. + my $token = $cgi->param('token'); + check_hash_token($token, ['create_account']); + $login = Bugzilla::User->check_login_name_for_creation($login); $vars->{'login'} = $login; diff --git a/template/en/default/account/create.html.tmpl b/template/en/default/account/create.html.tmpl index 5b8220193..5acd9f541 100644 --- a/template/en/default/account/create.html.tmpl +++ b/template/en/default/account/create.html.tmpl @@ -73,6 +73,7 @@ </tr> </table> <br> + <input type="hidden" id="token" name="token" value="[% issue_hash_token(['create_account']) FILTER html %]"> <input type="submit" id="send" value="Send"> </form> |