gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix phpmyadmin-security#254 CSRF allowing password reset

Browse Source 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
This commit is contained in:
Madhura Jayaratne 2018-07-22 15:04:22 +10:00 committed by Maurício Meneghini Fauth
parent 6c03ebad38
commit 7d3f203131
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
user_password.php
View File

@ -43,11 +43,11 @@ if ($cfg['Server']['auth_type'] == 'config' || ! $cfg['ShowChgPassword']) {
* If the "change password" form has been submitted, checks for valid values
* and submit the query or logout
*/
if (isset($_REQUEST['nopass'])) {
if ($_REQUEST['nopass'] == '1') {
if (isset($_POST['nopass'])) {
if ($_POST['nopass'] == '1') {
$password = '';
} else {
$password = $_REQUEST['pma_pw'];
$password = $_POST['pma_pw'];
}
$change_password_message = $userPassword->setChangePasswordMsg();
$msg = $change_password_message['msg'];