From: Dave Lawrence <dlawrence@mozilla.com>
Date: Wed, 16 Oct 2013 16:16:27 +0000 (-0400)
Subject: Bug 907438 - In MySQL, login cookie checking is not case-sensitive, reducing total... 
X-Git-Tag: bugzilla-4.5.1~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e78f6c00cd7cb6291641dfbea3d1c201c0944d5a;p=thirdparty%2Fbugzilla.git

Bug 907438 - In MySQL, login cookie checking is not case-sensitive, reducing total entropy and allowing easier brute force
r=LpSolit,a=sgreen
---

diff --git a/Bugzilla/Auth/Login/Cookie.pm b/Bugzilla/Auth/Login/Cookie.pm
index 3068331ea9..d2f9e2f1ea 100644
--- a/Bugzilla/Auth/Login/Cookie.pm
+++ b/Bugzilla/Auth/Login/Cookie.pm
@@ -66,8 +66,8 @@ sub get_login_info {
         trick_taint($login_cookie);
         detaint_natural($user_id);
 
-        my $is_valid =
-          $dbh->selectrow_array('SELECT 1
+        my $db_cookie =
+          $dbh->selectrow_array('SELECT cookie
                                    FROM logincookies
                                   WHERE cookie = ?
                                         AND userid = ?
@@ -77,7 +77,7 @@ sub get_login_info {
         # If the cookie or token is valid, return a valid username.
         # If they were not valid and we are using a webservice, then
         # throw an error notifying the client.
-        if ($is_valid) {
+        if (defined $db_cookie && $login_cookie eq $db_cookie) {
             # If we logged in successfully, then update the lastused 
             # time on the login cookie
             $dbh->do("UPDATE logincookies SET lastused = NOW()