Bug 508189: (CVE-2009-3166) [SECURITY] Logging in after changing your password would...

Patch by Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=mkanat

diff --git a/token.cgi b/token.cgi
index eaadee3e095c06c2345508e4518b83b1913de27b..2206f6f1978c6bf2ef5cb90773a521438eb3c5b1 100755 (executable)
--- a/token.cgi
+++ b/token.cgi
@@ -130,6 +130,8 @@ if ( $action eq 'chgpw' ) {
       || ThrowUserError("require_new_password");
 
     validate_password($password, $cgi->param('matchpassword'));
+    # Make sure that these never show up in the UI under any circumstances.
+    $cgi->delete('password', 'matchpassword');
 }
 
 ################################################################################
@@ -378,6 +380,8 @@ sub confirm_create_account {
 
     my $password = $cgi->param('passwd1') || '';
     validate_password($password, $cgi->param('passwd2') || '');
+    # Make sure that these never show up anywhere in the UI.
+    $cgi->delete('passwd1', 'passwd2');
 
     my $otheruser = Bugzilla::User->create({
         login_name => $login_name,