#3 chpass should require old password

[Anonymous]

As part of my hack to fix the circular redirection bug, i wrote a bit of a hack to pass an extra param in the redir URL which causes chpass to short-circuit its own checking (which would include auth.inc.php3, find the password to be empty, and try to redirect back to chpass were it not for my hack). My fear is that someone who knew this param could add it to chpass and thus change the password without actually being authenticated as the admin.

Thoughts:

1. If the redir param is 1, it might make sense to double check that the admin password really is "".

2. I could add in code to require the old password but only if redir = 1 (which should only ever happen if the password is "", but if for some reason it wasn't the user could still change the pw PROVIDED they know the old pw).

3. However, once i've written the code to require the old password, why not put it in there anyway to protect against the admin leaving their computer unattended (w/o closing the browser) and some rogue user coming up and changing it?

[Philip Reed]

Logged In: YES
user_id=392466

oops. i wasn't logged in when i posted the preceding comment.