Update of /cvsroot/popfile/engine/UI
In directory sc8-pr-cvs1:/tmp/cvs-serv31325/UI
Modified Files:
HTML.pm
Log Message:
Fix nasty security problem with jump_to_message where it was possible with the right combination of things to get the session key when you shouldn't be able to, and bypass the password screen
Index: HTML.pm
===================================================================
RCS file: /cvsroot/popfile/engine/UI/HTML.pm,v
retrieving revision 1.159
retrieving revision 1.160
diff -C2 -d -r1.159 -r1.160
*** HTML.pm 23 May 2003 14:49:19 -0000 1.159
--- HTML.pm 23 May 2003 15:59:26 -0000 1.160
***************
*** 280,283 ****
--- 280,309 ----
}
+ # Check the password
+
+ if ( $url eq '/password' ) {
+ if ( $self->{form_}{password} eq $self->config_( 'password' ) ) {
+ change_session_key( $self );
+ delete $self->{form_}{password};
+ $self->{form_}{session} = $self->{session_key__};
+ if ( defined( $self->{form_}{redirect} ) ) {
+ $url = $self->{form_}{redirect};
+ } else {
+ $url = '/';
+ }
+ } else {
+ password_page( $self, $client, 1, '/' );
+ return 1;
+ }
+ }
+
+ # If there's a password defined then check to see if the user already knows the
+ # session key, if they don't then drop to the password screen
+
+ if ( ( (!defined($self->{form_}{session})) || ($self->{form_}{session} eq '' ) || ( $self->{form_}{session} ne $self->{session_key__} ) ) && ( $self->config_( 'password' ) ne '' ) ) {
+ password_page( $self, $client, 0, $url );
+ return 1;
+ }
+
if ( $url eq '/jump_to_message' ) {
my $found = 0;
***************
*** 326,353 ****
if ( $url =~ /(manual\/.+\.html)/ ) {
$self->http_file_( $client, $1, 'text/html' );
- return 1;
- }
-
- # Check the password
- if ( $url eq '/password' ) {
- if ( $self->{form_}{password} eq $self->config_( 'password' ) ) {
- change_session_key( $self );
- delete $self->{form_}{password};
- $self->{form_}{session} = $self->{session_key__};
- if ( defined( $self->{form_}{redirect} ) ) {
- $url = $self->{form_}{redirect};
- } else {
- $url = '/';
- }
- } else {
- password_page( $self, $client, 1, '/' );
- return 1;
- }
- }
-
- # If there's a password defined then check to see if the user already knows the
- # session key, if they don't then drop to the password screen
- if ( ( (!defined($self->{form_}{session})) || ($self->{form_}{session} eq '' ) || ( $self->{form_}{session} ne $self->{session_key__} ) ) && ( $self->config_( 'password' ) ne '' ) ) {
- password_page( $self, $client, 0, $url );
return 1;
}
--- 352,355 ----
|
