[geeklog-cvs] geeklog-1.3/public_html usersettings.php,1.49.2.1,1.49.2.1.2.1

[dhaun at geeklog.net]

Update of /usr/cvs/geeklog/geeklog-1.3/public_html
In directory geeklog_prod:/tmp/cvs-serv22078

Modified Files:
      Tag: geeklog_1_3_7sr2_1
	usersettings.php 
Log Message:
Added check for a random hash before accepting account changes.


Index: usersettings.php
===================================================================
RCS file: /usr/cvs/geeklog/geeklog-1.3/public_html/usersettings.php,v
retrieving revision 1.49.2.1
retrieving revision 1.49.2.1.2.1
diff -C2 -d -r1.49.2.1 -r1.49.2.1.2.1
*** usersettings.php	23 May 2003 11:43:47 -0000	1.49.2.1
--- usersettings.php	23 Jan 2004 22:00:01 -0000	1.49.2.1.2.1
***************
*** 6,17 ****
  // +---------------------------------------------------------------------------+
  // | usersettings.php                                                          |
- // | Geeklog user settings page.                                               |
  // |                                                                           |
  // +---------------------------------------------------------------------------+
! // | Copyright (C) 2000,2001 by the following authors:                         |
  // |                                                                           |
! // | Authors: Tony Bibbs       - tony at tonybibbs.com                            |
! // |          Mark Limburg     - mlimburg at users.sourceforge.net                |
! // |          Jason Wittenburg - jwhitten at securitygeeks.com                    |
  // +---------------------------------------------------------------------------+
  // |                                                                           |
--- 6,17 ----
  // +---------------------------------------------------------------------------+
  // | usersettings.php                                                          |
  // |                                                                           |
+ // | Geeklog user settings page.                                               |
  // +---------------------------------------------------------------------------+
! // | Copyright (C) 2000-2004 by the following authors:                         |
  // |                                                                           |
! // | Authors: Tony Bibbs        - tony at tonybibbs.com                           |
! // |          Mark Limburg      - mlimburg at users.sourceforge.net               |
! // |          Jason Whittenburg - jwhitten at securitygeeks.com                   |
  // +---------------------------------------------------------------------------+
  // |                                                                           |
***************
*** 117,120 ****
--- 117,126 ----
      $A = DB_fetchArray($result);
  
+     $reqid = substr (md5 (uniqid (rand (), 1)), 1, 16);
+     // the 'pwrequestid' field was only introduced in 1.3.8, so we have
+     // to use this (otherwise unused) field instead ...
+     DB_change ($_TABLES['userinfo'], 'userspace', "$reqid",
+                                      'uid', $_USER['uid']);
+ 
      $retval .= '<tr valign="top">' . LB
          . '<td align="right"><b>' . $LANG04[7] . ':</b><br><small>' . $LANG04[38] . '</small></td>'
***************
*** 126,130 ****
          . '</tr>' . LB
          . '<tr valign="top">' . LB
!         . '<td align="center" colspan="2"><input type="hidden" name="uid" value="' . $user . '">'
          . '<input type="hidden" name="mode" value="saveuser">'
          . '<input type="hidden" name="username" value="' . $_USER['username'] . '">'
--- 132,136 ----
          . '</tr>' . LB
          . '<tr valign="top">' . LB
!         . '<td align="center" colspan="2"><input type="hidden" name="uid" value="' . $reqid . '">'
          . '<input type="hidden" name="mode" value="saveuser">'
          . '<input type="hidden" name="username" value="' . $_USER['username'] . '">'
***************
*** 443,446 ****
--- 449,461 ----
      } 
  
+     $reqid = DB_getItem ($_TABLES['userinfo'], 'userspace',
+                          "uid = {$_USER['uid']}");
+     if ($reqid != $A['uid']) {
+         DB_change ($_TABLES['userinfo'], 'userspace', '',
+                                          'uid', $_USER['uid']);
+         COM_accessLog ("An attempt was made to illegally change the account information of user {$_USER['uid']}.");
+         return COM_refresh ($_CONF['site_url'] . '/index.php');
+     }
+ 
      if (!empty($A["passwd"])) {
          $passwd = md5($A["passwd"]);
***************
*** 553,557 ****
          DB_query("UPDATE {$_TABLES['users']} SET fullname='{$A["fullname"]}',email='{$A["email"]}',homepage='{$A["homepage"]}',sig='{$A["sig"]}',cookietimeout={$A["cooktime"]},photo='$filename' WHERE uid={$_USER['uid']}");
          DB_query("UPDATE {$_TABLES['userprefs']} SET emailstories='{$A["emailstories"]}' WHERE uid={$_USER['uid']}");
!         DB_query("UPDATE {$_TABLES['userinfo']} SET pgpkey='" . $A["pgpkey"] . "',about='{$A["about"]}' WHERE uid={$_USER['uid']}");
  
          if ($_US_VERBOSE) {
--- 568,572 ----
          DB_query("UPDATE {$_TABLES['users']} SET fullname='{$A["fullname"]}',email='{$A["email"]}',homepage='{$A["homepage"]}',sig='{$A["sig"]}',cookietimeout={$A["cooktime"]},photo='$filename' WHERE uid={$_USER['uid']}");
          DB_query("UPDATE {$_TABLES['userprefs']} SET emailstories='{$A["emailstories"]}' WHERE uid={$_USER['uid']}");
!         DB_query("UPDATE {$_TABLES['userinfo']} SET pgpkey='" . $A["pgpkey"] . "',about='{$A["about"]}',userspace='' WHERE uid={$_USER['uid']}");
  
          if ($_US_VERBOSE) {
***************
*** 689,693 ****
          $display .= '<br>' . $LANG04[71] . '<br><br>';
          $display .= COM_endBlock();
!     $display .= COM_siteFooter();
      } else {
          $display .= COM_refresh($_CONF['site_url'] . '/index.php');
--- 704,708 ----
          $display .= '<br>' . $LANG04[71] . '<br><br>';
          $display .= COM_endBlock();
!         $display .= COM_siteFooter();
      } else {
          $display .= COM_refresh($_CONF['site_url'] . '/index.php');