From: Dave Lawrence <dlawrence@mozilla.com>
Date: Wed, 16 Oct 2013 16:25:10 +0000 (-0400)
Subject: Bug 906745 - In MySQL, tokens are not case-sensitive, reducing total entropy and... 
X-Git-Tag: bugzilla-4.0.11~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=940ea75ae91db0d1b3d8c99ae7fe365e2cf0b386;p=thirdparty%2Fbugzilla.git

Bug 906745 - In MySQL, tokens are not case-sensitive, reducing total entropy and allowing easier brute force
r=LpSolit,a=sgreen
---

diff --git a/token.cgi b/token.cgi
index 9e051bb399..65b0df8bf3 100755
--- a/token.cgi
+++ b/token.cgi
@@ -69,7 +69,7 @@ if ($token) {
   # Make sure the token exists in the database.
   my ($db_token, $tokentype) = $dbh->selectrow_array('SELECT token, tokentype FROM tokens
                                                        WHERE token = ?', undef, $token);
-  (defined $db_token && $db_token eq $token && $tokentype)
+  (defined $db_token && $db_token eq $token)
     || ThrowUserError("token_does_not_exist");
 
   # Make sure the token is the correct type for the action being taken.