external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Require current password when setting a new one

Browse source 
Prevent from easily taking over an account by changing the password with
a stolen session ID.

Fixes FS#65325.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
This commit is contained in:
Lukas Fleischer 2020-01-30 10:23:50 +01:00
parent eeaa1c3a32
commit daee20c694
4 changed files with 36 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

1
web/html/account.php
View file

@ -34,6 +34,7 @@ if ($action == "UpdateAccount") {
in_request("S"),
in_request("E"),
in_request("H"),
in_request("PO"),
in_request("P"),
in_request("C"),
in_request("R"),