Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 906745 - In MySQL, tokens are not case-sensitive, reducing total entropy and allowing easier brute force

Browse Source 
r=LpSolit,a=glob


git-svn-id: svn://10.0.0.236/trunk@265056 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
bzrmirror%bugzilla.org
2013-10-16 16:57:35 +00:00
parent 4022e30c0b
commit e5338fb372
3 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
mozilla/webtools/bugzilla/.bzrrev
View File

@@ -1 +1 @@
8774
8775

22
mozilla/webtools/bugzilla/Bugzilla/Token.pm
View File

@@ -255,13 +255,18 @@ sub Cancel {
# Get information about the token being canceled.
trick_taint($token);
my ($issuedate, $tokentype, $eventdata, $userid) =
$dbh->selectrow_array('SELECT ' . $dbh->sql_date_format('issuedate') . ',
my ($db_token, $issuedate, $tokentype, $eventdata, $userid) =
$dbh->selectrow_array('SELECT token, ' . $dbh->sql_date_format('issuedate') . ',
tokentype, eventdata, userid
FROM tokens
WHERE token = ?',
undef, $token);
# Some DBs such as MySQL are case-insensitive by default so we do
# a quick comparison to make sure the tokens are indeed the same.
(defined $db_token && $db_token eq $token)
|| ThrowCodeError("cancel_token_does_not_exist");
# If we are canceling the creation of a new user account, then there
# is no entry in the 'profiles' table.
my $user = new Bugzilla::User($userid);
@@ -326,10 +331,17 @@ sub GetTokenData {
$token = clean_text($token);
trick_taint($token);
return $dbh->selectrow_array(
"SELECT userid, " . $dbh->sql_date_format('issuedate') . ", eventdata, tokentype
FROM tokens
my @token_data = $dbh->selectrow_array(
"SELECT token, userid, " . $dbh->sql_date_format('issuedate') . ", eventdata, tokentype
FROM tokens
WHERE token = ?", undef, $token);
# Some DBs such as MySQL are case-insensitive by default so we do
# a quick comparison to make sure the tokens are indeed the same.
my $db_token = shift @token_data;
return undef if (!defined $db_token || $db_token ne $token);
return @token_data;
}
# Deletes specified token

3
mozilla/webtools/bugzilla/template/en/default/global/code-error.html.tmpl
View File

@@ -352,6 +352,9 @@
[% ELSIF error == "token_generation_error" %]
Something is seriously wrong with the token generation system.
[% ELSIF error == "cancel_token_does_not_exist" %]
The token to be cancelled does not exist.
[% ELSIF error == "template_error" %]
[% template_error_msg FILTER html %]