Skip to content

Commit

Permalink
Update password_reminder.php
Browse files Browse the repository at this point in the history
This is to prevent the logic vulnerability, pretty serious bug tbh. The $_SESSION array gets re-written between setting and checking and so your logic fails and an attacker can update anyones password...
  • Loading branch information
Steven Seeley committed Mar 19, 2016
1 parent e2cc51d commit d74f117
Showing 1 changed file with 1 addition and 2 deletions.
3 changes: 1 addition & 2 deletions password_reminder.php
Expand Up @@ -96,7 +96,6 @@

if ($_REQUEST['h'] != $hash_bit) {
$msg->addError('INVALID_LINK');
$savant->display('password_reminder_feedback.tmpl.php');
} else if (($_REQUEST['h'] == $hash_bit) && !isset($_POST['form_change'])) {
$savant->assign('id', $_REQUEST['id']);
$savant->assign('g', $_REQUEST['g']);
Expand Down Expand Up @@ -178,4 +177,4 @@
}


?>
?>

0 comments on commit d74f117

Please sign in to comment.