summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorByron Jones <glob@mozilla.com>2011-08-04 22:44:48 +0200
committerFrédéric Buclin <LpSolit@gmail.com>2011-08-04 22:44:48 +0200
commit75b2accb3ad0c02aff7d1c5925456040abb130a8 (patch)
treef98d220551a6058093dff3a68759ea913215e5fb
parent818ad5e10408f6b513ac276f575bceb082401142 (diff)
downloadbugzilla-75b2accb3ad0c02aff7d1c5925456040abb130a8.tar.gz
bugzilla-75b2accb3ad0c02aff7d1c5925456040abb130a8.tar.xz
Bug 670868: (CVE-2011-2978) [SECURITY] Account preferences page trusts user-modifiable field for obtaining current e-mail address
r/a=LpSolit
-rwxr-xr-xuserprefs.cgi2
1 files changed, 1 insertions, 1 deletions
diff --git a/userprefs.cgi b/userprefs.cgi
index 009361324..f411326a2 100755
--- a/userprefs.cgi
+++ b/userprefs.cgi
@@ -85,7 +85,7 @@ sub SaveAccount {
my $pwd1 = $cgi->param('new_password1');
my $pwd2 = $cgi->param('new_password2');
- my $old_login_name = $cgi->param('old_login');
+ my $old_login_name = $user->login;
my $new_login_name = trim($cgi->param('new_login_name'));
if ($user->authorizer->can_change_password