Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 250897: Enforce a 10 minute waiting period between password reset attempts to prevent the user getting mailbombed if the form is submitted multiple times.

Browse Source 
Patch by Joel Peshkin <bugreport@peshkin.net>
r=kiko, a=justdave


git-svn-id: svn://10.0.0.236/trunk@164334 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
justdave%bugzilla.org 2004-10-25 07:12:22 +00:00
parent 60be1a1ddd
commit 45f8635565
2 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
mozilla/webtools/bugzilla/Bugzilla/Token.pm
View File

@ -116,11 +116,19 @@ sub IssuePasswordToken {
# Retrieve the user's ID from the database.
my $quotedloginname = &::SqlQuote($loginname);
&::SendSQL("SELECT userid FROM profiles WHERE login_name = $quotedloginname");
my ($userid) = &::FetchSQLData();
&::SendSQL("SELECT profiles.userid, tokens.issuedate FROM profiles
LEFT JOIN tokens
ON tokens.userid = profiles.userid
AND tokens.tokentype = 'password'
AND tokens.issuedate > DATE_SUB(NOW(), INTERVAL 10 MINUTE)
WHERE login_name = $quotedloginname");
my ($userid, $toosoon) = &::FetchSQLData();
if ($toosoon) {
ThrowUserError('too_soon_for_new_token');
};
my $token_ts = time();
my $issuedate = time2str("%Y-%m-%d %H:%M", $token_ts);
# Generate a unique token and insert it into the tokens table.
# We have to lock the tokens table before generating the token,
@ -130,7 +138,7 @@ sub IssuePasswordToken {
my $quotedtoken = &::SqlQuote($token);
my $quotedipaddr = &::SqlQuote($::ENV{'REMOTE_ADDR'});
&::SendSQL("INSERT INTO tokens ( userid , issuedate , token , tokentype , eventdata )
VALUES ( $userid , '$issuedate' , $quotedtoken , 'password' , $quotedipaddr )");
VALUES ( $userid , NOW() , $quotedtoken , 'password' , $quotedipaddr )");
&::SendSQL("UNLOCK TABLES");
# Mail the user the token along with instructions for using it.

5
mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl
View File

@ -895,6 +895,11 @@
The token you submitted does not exist, has expired, or has
been cancelled.
[% ELSIF error == "too_soon_for_new_token" %]
[% title = "Too Soon For New Token" %]
You have requested a password token too recently to request
another. Please wait a while and try again.
[% ELSIF error == "unknown_keyword" %]
[% title = "Unknown Keyword" %]
<code>[% keyword FILTER html %]</code> is not a known keyword.