diff options
Diffstat (limited to 'reset_password.cgi')
-rwxr-xr-x | reset_password.cgi | 133 |
1 files changed, 64 insertions, 69 deletions
diff --git a/reset_password.cgi b/reset_password.cgi index a79fea063..ab2226f1e 100755 --- a/reset_password.cgi +++ b/reset_password.cgi @@ -27,89 +27,84 @@ my $dbh = Bugzilla->dbh; my $prev_url = $cgi->param('prev_url'); my $prev_url_sig = $cgi->param('prev_url_sig'); my $sig_type = 'prev_url:' . $user->id; -my $prev_url_ok = check_hash_sig($sig_type, $prev_url_sig, $prev_url ); +my $prev_url_ok = check_hash_sig($sig_type, $prev_url_sig, $prev_url); unless ($prev_url_ok) { - open my $fh, '>', '/tmp/dump.pl' or die $!; - print $fh Dumper([$prev_url, $prev_url_sig]); - close $fh or die $!; + open my $fh, '>', '/tmp/dump.pl' or die $!; + print $fh Dumper([$prev_url, $prev_url_sig]); + close $fh or die $!; } unless ($user->password_change_required) { - ThrowUserError( - 'reset_password_denied', - { - prev_url_ok => $prev_url_ok, - prev_url => $prev_url, - } - ); + ThrowUserError('reset_password_denied', + {prev_url_ok => $prev_url_ok, prev_url => $prev_url,}); } if ($cgi->param('do_save')) { - my $token = $cgi->param('token'); - check_token_data($token, 'reset_password'); - - my $old_password = $cgi->param('old_password') // ''; - my $password_1 = $cgi->param('new_password1') // ''; - my $password_2 = $cgi->param('new_password2') // ''; - - # make sure passwords never show up in the UI - foreach my $field (qw( old_password new_password1 new_password2 )) { - $cgi->delete($field); - } - - # validation - my $old_crypt_password = $user->cryptpassword; - if (bz_crypt($old_password, $old_crypt_password) ne $old_crypt_password) { - ThrowUserError('old_password_incorrect'); - } - if ($password_1 eq '' || $password_2 eq '') { - ThrowUserError('new_password_missing'); - } - if ($old_password eq $password_1) { - ThrowUserError('new_password_same'); + my $token = $cgi->param('token'); + check_token_data($token, 'reset_password'); + + my $old_password = $cgi->param('old_password') // ''; + my $password_1 = $cgi->param('new_password1') // ''; + my $password_2 = $cgi->param('new_password2') // ''; + + # make sure passwords never show up in the UI + foreach my $field (qw( old_password new_password1 new_password2 )) { + $cgi->delete($field); + } + + # validation + my $old_crypt_password = $user->cryptpassword; + if (bz_crypt($old_password, $old_crypt_password) ne $old_crypt_password) { + ThrowUserError('old_password_incorrect'); + } + if ($password_1 eq '' || $password_2 eq '') { + ThrowUserError('new_password_missing'); + } + if ($old_password eq $password_1) { + ThrowUserError('new_password_same'); + } + + Bugzilla->assert_password_is_secure($password_1); + Bugzilla->assert_passwords_match($password_1, $password_2); + + # update + $dbh->bz_start_transaction; + $user->set_password($password_1); + $user->update({keep_session => 1, keep_tokens => 1}); + Bugzilla->logout(LOGOUT_KEEP_CURRENT); + delete_token($token); + $dbh->bz_commit_transaction; + + # done + print $cgi->header(); + $template->process( + 'account/reset-password.html.tmpl', + { + message => 'password_changed', + prev_url => $prev_url, + prev_url_ok => $prev_url_ok, + password_changed => 1 } - - Bugzilla->assert_password_is_secure($password_1); - Bugzilla->assert_passwords_match($password_1, $password_2); - - # update - $dbh->bz_start_transaction; - $user->set_password($password_1); - $user->update({ keep_session => 1, keep_tokens => 1 }); - Bugzilla->logout(LOGOUT_KEEP_CURRENT); - delete_token($token); - $dbh->bz_commit_transaction; - - # done - print $cgi->header(); - $template->process( - 'account/reset-password.html.tmpl', - { - message => 'password_changed', - prev_url => $prev_url, - prev_url_ok => $prev_url_ok, - password_changed => 1 - } - ) || ThrowTemplateError( $template->error() ); + ) || ThrowTemplateError($template->error()); } else { - my $token = issue_session_token('reset_password'); - - print $cgi->header(); - $template->process( - 'account/reset-password.html.tmpl', - { - token => $token, - prev_url => $prev_url, - prev_url_ok => $prev_url_ok, - prev_url_sig => $prev_url_sig, - sig_type => $sig_type, - } - ) || ThrowTemplateError( $template->error() ); + my $token = issue_session_token('reset_password'); + + print $cgi->header(); + $template->process( + 'account/reset-password.html.tmpl', + { + token => $token, + prev_url => $prev_url, + prev_url_ok => $prev_url_ok, + prev_url_sig => $prev_url_sig, + sig_type => $sig_type, + } + ) || ThrowTemplateError($template->error()); } |