diff options
| author | canyonknight <canyonknight@gmail.com> | 2012-11-29 16:54:29 -0500 |
|---|---|---|
| committer | Lukas Fleischer <archlinux@cryptocrack.de> | 2012-11-29 23:23:10 +0100 |
| commit | 87fe4701cd2e84c70c080eade1c2a0f1ffa3c6d9 (patch) | |
| tree | ad30778e7fcb34c6f71cf0ad7d9104f84e2a398e /web/html/account.php | |
| parent | e383205edabff92f7f7c7750cd0038774c823c6b (diff) | |
| download | aurweb-87fe4701cd2e84c70c080eade1c2a0f1ffa3c6d9.tar.xz | |
Fix account editing and hijacking vulnerability
Checks are in place to avoid users getting account editing forms
they shouldn't have access to. The appropriate checks before
editing the account in the backend are not in place.
This vulnerability allows a user to craft malicious POST data to
edit other user accounts, thereby allowing account hijacking.
Add a new flexible function can_edit_account() to determine if
a user has appropriate permissions. Run the permission check before
processing any account information in the backend.
Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Diffstat (limited to 'web/html/account.php')
| -rw-r--r-- | web/html/account.php | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/web/html/account.php b/web/html/account.php index 786ae02..cccdd76 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -73,9 +73,14 @@ if (isset($_COOKIE["AURSID"])) { } } elseif ($action == "UpdateAccount") { - # user is submitting their modifications to an existing account - # - if (check_token()) { + $uid = uid_from_sid($_COOKIE['AURSID']); + + /* Details for account being updated */ + $acctinfo = account_details(in_request('ID'), in_request('U')); + + /* Verify user permissions and that the request is a valid POST */ + if (can_edit_account($atype, $acctinfo, $uid) && check_token()) { + /* Update the details for the existing account */ process_account_form($atype, "edit", "UpdateAccount", in_request("U"), in_request("T"), in_request("S"), in_request("E"), in_request("P"), in_request("C"), |