Changeset 1497

Show
Ignore:
Timestamp:
02/19/08 23:09:45 (6 months ago)
Author:
Rickard
Message:

Fixed a password recovery vulnerability. Reported by Stefan Esser.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/upload/include/common.php

    r933 r1497  
    7171} 
    7272 
    73 // Seed the random number generator 
    74 mt_srand((double)microtime()*1000000); 
     73// Seed the random number generator (PHP <4.2.0 only) 
     74if (version_compare(PHP_VERSION, '4.2.0', '<')) 
     75        mt_srand((double)microtime()*1000000); 
    7576 
    7677// If a cookie name is not specified in config.php, we use the default (punbb_cookie) 

  • trunk/upload/include/functions.php

    r1494 r1497  
    4949                if (!isset($pun_user['id']) || md5($cookie_seed.$pun_user['password']) !== $cookie['password_hash']) 
    5050                { 
    51                         pun_setcookie(0, random_pass(8), $expire); 
     51                        pun_setcookie(1, md5(uniqid(rand(), true)), $expire); 
    5252                        set_default_user(); 
    5353 

  • trunk/upload/login.php

    r1356 r1497  
    9898                $db->query('UPDATE '.$db->prefix.'users SET last_visit='.$pun_user['logged'].' WHERE id='.$pun_user['id']) or error('Unable to update user visit data', __FILE__, __LINE__, $db->error()); 
    9999 
    100         pun_setcookie(1, random_pass(8), time() + 31536000); 
     100        pun_setcookie(1, md5(uniqid(rand(), true)), time() + 31536000); 
    101101 
    102102        redirect('index.php', $lang_login['Logout redirect']);