bugSamizdat - Bugs: bug #20491, users cannot change their...

 
 

bug #20491: users cannot change their passwords? (only generate random ones)

Submitter:  Boud Roukema <boud>
Submitted:  Sun 15 Jul 2007 11:13:48 PM UTC
   
 
Category:  None Severity:  5 - Blocker
Status:  Fixed Privacy:  Public
Assigned to:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 04 Nov 2007 01:22:54 PM UTC, comment #4: 
Boud Roukema <boud>
Group Member
Mon 20 Aug 2007 11:07:19 PM UTC, comment #3: 

seems to work

Boud Roukema <boud>
Group Member
Sat 18 Aug 2007 06:05:02 PM UTC, comment #2: 

Fixed in snapshot 2007-08-18.

The real cause of this bug was that CSRF protection code didn't handle the case when form action is different from the location where form is displayed, this is now fixed.

Dmitry Borodaenko <angdraug>
Group administrator
Fri 03 Aug 2007 08:26:27 PM UTC, comment #1: 

hi samizdat-devel,

Here's a hack which i think fixes the password change bug #20491
https://savannah.nongnu.org/bugs/?20491

The change in application_helper.rb - action_token_key is clearly
a hack - a better solution would be in member_controller, but
i didn't want to mess around with member_controller too much.

IMHO the problem is confusion in the 2-stage process of "change":

1. "index" method and @request.route = member - presents a form for
the user to change his/her password (or other member parameters) with
the

2. the "change" method and @request.route = member/change - checks the
data, checks for the action_token against cross-scripting attacks, and
then does the change

The problem in 070618-1 is that the action_confirmed? script
compares tokens from member and member/change and finds that something
is different and so rejects the attempted change.

The hack in application_helper.rb:

   def action_token_key
-    %{action_token/#{@session.login}#{@request.route}}
+    %{action_token/#{@session.login}#{@request.route}}.sub("/member/change","/member")
   end

is one way of hacking around this.


i've also made a change in member_controller, since despite the
recommendation to users to press the 'back' button, some users might
decide to log out after changing their password, without bothering to
use the back button since they see a logout prompt already.  In the
absence of this change, something goes wrong and seems to cause an
infinite URI redirect.  Hence the change in member_controller shifts
the feedback page to a separate method "changed_ok".


cheers
boud


(file #13575)

Boud Roukema <boud>
Group Member
Sun 15 Jul 2007 11:13:48 PM UTC, original submission:  

It seems to be impossible for a user to change his/her
password in version 070618-1.

It seems that this line in member_controller prevents a
user's password from being changed:

    @request.redirect unless action_confirmed?

i haven't yet had time to look at this in detail, but
commenting out this line made it possible to change
the password. Otherwise, the redirect occurs.

i put this as "important" since users will get annoyed if they
cannot change their passwords, and will find unconstructive ways
of getting around it (making "sock puppet" accounts with email
addresses that they do not regularly use, storing their samizdat-
generated password in a non-secure place, or giving up on samizdat), and are unlikely to delete the samizdat-generated
password from their email accounts...

In terms of usability, maybe this should go up to "blocker" status...

Boud Roukema <boud>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #13575:  070803_change_passwords_bug20491 added by boud (2KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by angdraug (Posted a comment)
  • -email is unavailable- added by boud (Submitted the item)
  •  

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2007-11-04 boud Open/ClosedOpen Closed
    2007-08-18 angdraug StatusWorks For Me Fixed
    2007-08-07 boud Severity4 - Important 5 - Blocker
    2007-08-03 boud Attached File- Added 070803_change_passwords_bug20491, #13575
        StatusNone Works For Me

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code