Skip to content
Permalink
Browse files Browse the repository at this point in the history
Doublehash the token to prevent timing attacks
  • Loading branch information
LukasReschke committed Oct 14, 2012
1 parent c88cf5c commit 99cd922
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
4 changes: 2 additions & 2 deletions core/lostpassword/index.php
Expand Up @@ -13,8 +13,8 @@
// Someone lost their password:
if (isset($_POST['user'])) {
if (OC_User::userExists($_POST['user'])) {
$token = hash("sha256", $_POST['user'].OC_Util::generate_random_bytes(10));
OC_Preferences::setValue($_POST['user'], 'owncloud', 'lostpassword', $token);
$token = hash("sha256", OC_Util::generate_random_bytes(30).OC_Config::getValue('passwordsalt', ''));
OC_Preferences::setValue($_POST['user'], 'owncloud', 'lostpassword', hash("sha256", $token)); // Hash the token again to prevent timing attacks
$email = OC_Preferences::getValue($_POST['user'], 'settings', 'email', '');
if (!empty($email)) {
$link = OC_Helper::linkToAbsolute('core/lostpassword', 'resetpassword.php', array('user' => $_POST['user'], 'token' => $token));
Expand Down
2 changes: 1 addition & 1 deletion core/lostpassword/resetpassword.php
Expand Up @@ -10,7 +10,7 @@
require_once '../../lib/base.php';

// Someone wants to reset their password:
if(isset($_GET['token']) && isset($_GET['user']) && OC_Preferences::getValue($_GET['user'], 'owncloud', 'lostpassword') === $_GET['token']) {
if(isset($_GET['token']) && isset($_GET['user']) && OC_Preferences::getValue($_GET['user'], 'owncloud', 'lostpassword') === hash("sha256", $_GET['token'])) {
if (isset($_POST['password'])) {
if (OC_User::setPassword($_GET['user'], $_POST['password'])) {
OC_Preferences::deleteKey($_GET['user'], 'owncloud', 'lostpassword');
Expand Down

0 comments on commit 99cd922

Please sign in to comment.