fixed security vulnerability allowing an attacker that knows the user…

…name to change the password without an activation key
little-apps · Sep 26, 2015 · 07ba827 · 07ba827
1 parent 616d89c
commit 07ba827
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/inc/class.securelogin.php b/inc/class.securelogin.php
@@ -213,6 +213,9 @@ public function change_password( $user, $pass, $pass2, $key ) {
         $pass = trim( $pass );
         $pass2 = trim( $pass2 );
         $key = strtolower( trim( $key ) );
+
+        if ( empty( $key ) )
+        	return __( "Activation key cannot be empty" );
 
         if ( !MySQL::getInstance()->select( "users", array( "UserName" => $user ), "", "0,1" ) )
             return __( "Username does not exist" );

diff --git a/login.php b/login.php
@@ -142,10 +142,10 @@
                 <!--  end message -->
 
 		<!--  start login-inner -->
-                <?php if ( ( isset( $_GET['action'] ) ) && $_GET['action'] == "resetPwd") : ?>		
+                <?php if ( ( isset( $_GET['action'] ) ) && $_GET['action'] == "resetPwd" && !empty( $_GET['key'] ) ) : ?>		
 		<div id="login-inner">
                     <form action="#" method="post">
-                        <input name="key" type="hidden" value="<?php echo ( ( isset( $_GET['key'] ) ) ? ( $_GET['key'] ) : ( '' ) ); ?>" />
+                        <input name="key" type="hidden" value="<?php echo $_GET['key']; ?>" />
                         <table border="0" cellpadding="0" cellspacing="0">
                             <tr>
                                 <th><?php _e ( 'Username' ); ?></th>