summaryrefslogtreecommitdiffstats
path: root/token.cgi
diff options
context:
space:
mode:
Diffstat (limited to 'token.cgi')
-rwxr-xr-xtoken.cgi7
1 files changed, 4 insertions, 3 deletions
diff --git a/token.cgi b/token.cgi
index 20870159a..901094be4 100755
--- a/token.cgi
+++ b/token.cgi
@@ -67,9 +67,10 @@ if ($token) {
trick_taint($token);
# Make sure the token exists in the database.
- my ($tokentype) = $dbh->selectrow_array('SELECT tokentype FROM tokens
- WHERE token = ?', undef, $token);
- $tokentype || ThrowUserError("token_does_not_exist");
+ my ($db_token, $tokentype) = $dbh->selectrow_array('SELECT token, tokentype FROM tokens
+ WHERE token = ?', undef, $token);
+ (defined $db_token && $db_token eq $token)
+ || ThrowUserError("token_does_not_exist");
# Make sure the token is the correct type for the action being taken.
if ( grep($action eq $_ , qw(cfmpw cxlpw chgpw)) && $tokentype ne 'password' ) {