From 1a0d11a4f21831ee68ccdb8bcc9605c8c0abd721 Mon Sep 17 00:00:00 2001 From: mdipierro Date: Sun, 8 Jun 2014 00:20:38 -0500 Subject: [PATCH] prevent_password_reset_attacks, thanks Steve Rawlinson --- VERSION | 2 +- gluon/tools.py | 18 +++++++++++++++--- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/VERSION b/VERSION index f5dc7710..b3addc5a 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -Version 2.9.5-trunk+timestamp.2014.06.07.23.52.05 +Version 2.9.5-trunk+timestamp.2014.06.08.00.19.41 diff --git a/gluon/tools.py b/gluon/tools.py index 964abcb9..fd3aade3 100644 --- a/gluon/tools.py +++ b/gluon/tools.py @@ -998,7 +998,8 @@ class Auth(object): retrieve_username_captcha=None, retrieve_password_captcha=None, captcha=None, - prevent_open_redirects=True, + prevent_open_redirect_attacks=True, + prevent_password_reset_attacks=True, expiration=3600, # one hour long_expiration=3600 * 30 * 24, # one month remember_me_form=True, @@ -2328,7 +2329,7 @@ class Auth(object): ### use session for federated login snext = self.get_vars_next() - if snext and self.settings.prevent_open_redirects: + if snext and self.settings.prevent_open_redirect_attacks: if not snext.split('/')[2] == request.env.http_host: snext = None @@ -3038,8 +3039,19 @@ class Auth(object): if next is DEFAULT: next = self.get_vars_next() or self.settings.reset_password_next - try: + + if self.settings.prevent_password_reset_attacks: + key = request.vars.key + if not key and len(request.args)>1: + key = request.args[-1] + if key: + session._reset_password_key = key + redirect(self.url(args='reset_password')) + else: + key = session._reset_password_key + else: key = request.vars.key or getarg(-1) + try: t0 = int(key.split('-')[0]) if time.time() - t0 > 60 * 60 * 24: raise Exception