Django/django
11
0
Fork 0
Code Pull Requests Projects Releases Activity

[1.2.X] Fixed #14612 - Password reset page leaks valid user ids publicly.

Browse Source 
Thanks to PaulM for the report.

Backport of [14456] from trunk.

git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.2.X@14458 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Luke Plant 2010-11-04 12:39:27 +00:00
parent 74b566e81c
commit fca56e8450
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
django/contrib/auth/tests/views.py
View File

@ -82,6 +82,12 @@ class PasswordResetTest(AuthViewsTestCase):
self.assertEquals(response.status_code, 200) self.assertEquals(response.status_code, 200)
self.assert_("The password reset link was invalid" in response.content) self.assert_("The password reset link was invalid" in response.content)
def test_confirm_invalid_user(self):
# Ensure that we get a 200 response for a non-existant user, not a 404
response = self.client.get('/reset/123456-1-1/')
self.assertEquals(response.status_code, 200)
self.assert_("The password reset link was invalid" in response.content)
def test_confirm_invalid_post(self): def test_confirm_invalid_post(self):
# Same as test_confirm_invalid, but trying # Same as test_confirm_invalid, but trying
# to do a POST instead. # to do a POST instead.

8
django/contrib/auth/views.py
View File

@ -142,13 +142,13 @@ def password_reset_confirm(request, uidb36=None, token=None, template_name='regi
post_reset_redirect = reverse('django.contrib.auth.views.password_reset_complete') post_reset_redirect = reverse('django.contrib.auth.views.password_reset_complete')
try: try:
uid_int = base36_to_int(uidb36) uid_int = base36_to_int(uidb36)
except ValueError: user = User.objects.get(id=uid_int)
raise Http404 except (ValueError, User.DoesNotExist):
user = None
user = get_object_or_404(User, id=uid_int)
context_instance = RequestContext(request) context_instance = RequestContext(request)
if token_generator.check_token(user, token): if user is not None and token_generator.check_token(user, token):
context_instance['validlink'] = True context_instance['validlink'] = True
if request.method == 'POST': if request.method == 'POST':
form = set_password_form(user, request.POST) form = set_password_form(user, request.POST)