Bug 705474 - CSRF vulnerability in createaccount.cgi allows possible unauthorized account creation e-mail request

[r=mkanat a=mkanat]

1 files changed, 5 insertions, 0 deletions

diff --git a/createaccount.cgi b/createaccount.cgi
index db0727add..2348d4e91 100755
--- a/createaccount.cgi
+++ b/createaccount.cgi
@@ -62,6 +62,11 @@ unless ($createexp) {
 my $login = $cgi->param('login');
 
 if (defined($login)) {
+    # Check the hash token to make sure this user actually submitted
+    # the create account form.
+    my $token = $cgi->param('token');
+    check_hash_token($token, ['create_account']);
+
     $login = Bugzilla::User->check_login_name_for_creation($login);
     $vars->{'login'} = $login;