From 7d3f203131231d09a7485c38355f5cb546cbf897 Mon Sep 17 00:00:00 2001
From: Madhura Jayaratne <madhura.cj@gmail.com>
Date: Sun, 22 Jul 2018 15:04:22 +1000
Subject: [PATCH] Fix phpmyadmin-security#254 CSRF allowing password reset

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
---
 user_password.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/user_password.php b/user_password.php
index 945fc092f8..10663e9360 100644
--- a/user_password.php
+++ b/user_password.php
@@ -43,11 +43,11 @@ if ($cfg['Server']['auth_type'] == 'config' || ! $cfg['ShowChgPassword']) {
  * If the "change password" form has been submitted, checks for valid values
  * and submit the query or logout
  */
-if (isset($_REQUEST['nopass'])) {
-    if ($_REQUEST['nopass'] == '1') {
+if (isset($_POST['nopass'])) {
+    if ($_POST['nopass'] == '1') {
         $password = '';
     } else {
-        $password = $_REQUEST['pma_pw'];
+        $password = $_POST['pma_pw'];
     }
     $change_password_message = $userPassword->setChangePasswordMsg();
     $msg = $change_password_message['msg'];