diff options
| author | Joas Schilling <nickvergessen@gmx.de> | 2015-06-04 14:06:35 +0200 |
|---|---|---|
| committer | Joas Schilling <nickvergessen@gmx.de> | 2015-06-04 14:06:35 +0200 |
| commit | 6ca3a30576ae1bac68d5f4ef5dec286f000131ee (patch) | |
| tree | 0f2397a9f3cd6d47c8f338e06e792ed741c823c0 | |
| parent | db3782e4912e2945a546309dab38a4c00bd0f5c5 (diff) | |
| download | forums-6ca3a30576ae1bac68d5f4ef5dec286f000131ee.tar forums-6ca3a30576ae1bac68d5f4ef5dec286f000131ee.tar.gz forums-6ca3a30576ae1bac68d5f4ef5dec286f000131ee.tar.bz2 forums-6ca3a30576ae1bac68d5f4ef5dec286f000131ee.tar.xz forums-6ca3a30576ae1bac68d5f4ef5dec286f000131ee.zip | |
[ticket/sec-184] Do not output config passwords to the HTML page
SECURITY-184
| -rw-r--r-- | phpBB/includes/acp/acp_board.php | 9 | ||||
| -rw-r--r-- | phpBB/includes/functions_acp.php | 7 |
2 files changed, 14 insertions, 2 deletions
diff --git a/phpBB/includes/acp/acp_board.php b/phpBB/includes/acp/acp_board.php index a41a53226f..5247bb213d 100644 --- a/phpBB/includes/acp/acp_board.php +++ b/phpBB/includes/acp/acp_board.php @@ -500,7 +500,7 @@ class acp_board } // We go through the display_vars to make sure no one is trying to set variables he/she is not allowed to... - foreach ($display_vars['vars'] as $config_name => $null) + foreach ($display_vars['vars'] as $config_name => $data) { if (!isset($cfg_array[$config_name]) || strpos($config_name, 'legend') !== false) { @@ -532,6 +532,13 @@ class acp_board if ($submit) { + if (strpos($data['type'], 'password') === 0 && $config_value === '********') + { + // Do not update password fields if the content is ********, + // because that is the password replacement we use to not + // send the password to the output + continue; + } set_config($config_name, $config_value); if ($config_name == 'allow_quick_reply' && isset($_POST['allow_quick_reply_enable'])) diff --git a/phpBB/includes/functions_acp.php b/phpBB/includes/functions_acp.php index a53a54368e..d566336d26 100644 --- a/phpBB/includes/functions_acp.php +++ b/phpBB/includes/functions_acp.php @@ -245,8 +245,13 @@ function build_cfg_template($tpl_type, $key, &$new, $config_key, $vars) switch ($tpl_type[0]) { - case 'text': case 'password': + if ($new[$config_key] !== '') + { + // replace passwords with asterixes + $new[$config_key] = '********'; + } + case 'text': case 'url': case 'email': case 'color': |