Bug 508189: (CVE-2009-3166) [SECURITY] Logging in after changing your password…

Bug 508189: (CVE-2009-3166) [SECURITY] Logging in after changing your password would expose your new password in the URL Patch by Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=mkanat

Bug 508189: (CVE-2009-3166) [SECURITY] Logging in after changing your password…
7fda8c35 · mkanat%bugzilla.org · cb23c7f7 · 7fda8c35
Commit 7fda8c35 authored Sep 11, 2009 by mkanat%bugzilla.org
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 0 deletions

token.cgi token.cgi +4 -0

No files found.
--- a/token.cgi
+++ b/token.cgi
@@ -130,6 +130,8 @@ if ( $action eq 'chgpw' ) {
      || ThrowUserError("require_new_password");
    validate_password($password, $cgi->param('matchpassword'));
+    # Make sure that these never show up in the UI under any circumstances.
+    $cgi->delete('password', 'matchpassword');
 }
 ################################################################################
@@ -378,6 +380,8 @@ sub confirm_create_account {
    my $password = $cgi->param('passwd1') || '';
    validate_password($password, $cgi->param('passwd2') || '');
+    # Make sure that these never show up anywhere in the UI.
+    $cgi->delete('passwd1', 'passwd2');
    my $otheruser = Bugzilla::User->create({
        login_name => $login_name,