Hi,
with the module installed it is easy to find out if a user name is valid, which can be problematic.
The attached patch fixes this.
Any user name is accepted and if the user exists and has a question set, it is displayed.
If the user name does not exist (or no question is set for the user), a checksum over the user name is calculated and a question from the pool is selected for display.
The checksum prevents different questions being displayed on successive tries (which would also indicate to the attacker that the user does not exist).
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | password_reset-information-leak-D6-01.patch | 3.11 KB | sanduhrs |
| #1 | password_reset-information-leak-D5-01.patch | 3.14 KB | sanduhrs |
| password_reset-informationleak.diff | 2.64 KB | EmTeedee |
Comments
Comment #1
sanduhrsFrom my point of view the mentioned points are vital for a module like this.
* Reroled the patch, as it didn't apply form me.
* Replaced all strtolower() with drupal_strtolower() for the sake of UTF8
* Backported to D5, tested on both D5/D6
Attached are patches for D5/D6, please commit.
Comment #2
bojanz commentedPatch doesn't apply with -p0, you need to create a patch from the module root, not the drupal root.
Also, $chksum should be $checksum, per coding standard.
Comment #3
Zen commentedFixed in D6. For the time being, I'm not porting anything to D5.
Thanks :)
-K