Re: Problems with Change Password
Craig Shelley <craig <at> microtron.org.uk>
2009-11-29 11:30:17 GMT
Temporarily fixed for now with...
Index: functions.php
===================================================================
--- functions.php (revision 13876)
+++ functions.php (working copy)
<at> <at> -22,6 +22,8 <at> <at>
{
global $cpw_pass_min_length, $cpw_pass_max_length;
+ // security token
+ sqgetGlobalVar('smtoken', $submitted_token, SQ_FORM, '');
// formdata
sqgetGlobalVar('cpw_curpass', $currentpw, SQ_POST);
sqgetGlobalVar('cpw_newpass', $newpw, SQ_POST);
<at> <at> -32,6 +34,9 <at> <at>
$msg = array();
+ // verify the security token first
+ sm_validate_security_token($submitted_token, 3600, TRUE);
+
if(!$newpw) {
$msg[] = _("You must type in a new password.");
}
<at> <at> -76,6 +81,7 <at> <at>
function cpw_do_change()
{
global $cpw_backend;
+ sqgetGlobalVar('smtoken', $submitted_token, SQ_FORM, '');
sqgetGlobalVar('cpw_curpass', $curpw, SQ_POST);
sqgetGlobalVar('cpw_newpass', $newpw, SQ_POST);
sqgetGlobalVar('base_uri', $base_uri, SQ_SESSION);
<at> <at> -84,6 +90,9 <at> <at>
sqgetGlobalVar('username', $username, SQ_SESSION);
require_once(SM_PATH .
'plugins/change_password/backend/'.$cpw_backend.'.php');
+
+ // verify the security token first
+ sm_validate_security_token($submitted_token, 3600, TRUE);
$msgs = do_hook('change_password_dochange',
$temp=array (
<at> <at> -105,7 +114,7 <at> <at>
/* make sure we write the session data before we redirect */
session_write_close();
- header('Location: '.SM_PATH.
'src/options.php?optmode=submit&optpage=change_password&plugin_change_password=1');
+ header('Location: '.SM_PATH. 'src/options.php');
exit;
}
Index: options.php
===================================================================
--- options.php (revision 13876)
+++ options.php (working copy)
<at> <at> -82,7 +82,7 <at> <at>
}
?><tr><td>
- <?php echo addForm($_SERVER['PHP_SELF'], 'post'); ?>
+ <?php echo addForm($_SERVER['PHP_SELF'], 'post') .
addHidden('smtoken', sm_generate_security_token()); ?>
<table>
<tr>
<th align="right"><?php echo _("Current Password:")?></th>
On Sun, 2009-11-29 at 01:05 +0000, Craig Shelley wrote:
> Hi,
>
> Error message: "This page request could not be verified and appears to
> have expired" is displayed immediately after a password change.
> The password successfully gets changed, but the error message is a bit
> alarming.
>
> This issue appeared at revision with SVN revision;
>
> r13817 | pdontthink | 2009-08-12 09:28:38 +0100 (Wed, 12 Aug 2009)
> Implemented security token system. (Secunia Advisory SA34627)
>
> Any ideas about how to work around this?
>
>
> Regards,
> Craig
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now. http://p.sf.net/sfu/bobj-july
> ----- squirrelmail-devel mailing list Posting guidelines:
http://squirrelmail.org/postingguidelines List address:
squirrelmail-devel <at> lists.sourceforge.net List archives:
http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change
options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel
------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel <at> lists.sourceforge.net
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel
RSS Feed