svn: /web/php-master/trunk/manage/ users.php

bjori Wed, 23 Mar 2011 13:14:12 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=309598 Log: Only allow password changes via https Changed paths: U web/php-master/trunk/manage/users.php Modified: web/php-master/trunk/manage/users.php =================================================================== --- web/php-master/trunk/manage/users.php 2011-03-23 12:46:19 UTC (rev 309597) +++ web/php-master/trunk/manage/users.php 2011-03-23 13:14:12 UTC (rev 309598) @@ -148,11 +148,19 @@ . ",greylist=$greylist" . ($in[passwd] ? ",pchanged=" . time() : "") . " WHERE userid=$id"; - db_query($query); if ($in[passwd]) { - // Kill the session data after updates :) - $_SERVER["credentials"] = array(); + if (!isset($_SERVER["HTTPS"]) || $_SERVER["HTTPS"] != "on") { + warn("Did you actually try to change your password without using https? - Thats not gonna fly"); + } + else { + // Kill the session data after updates :) + $_SERVER["credentials"] = array(); + db_query($query); + } + } else { + db_query($query); } + if(strlen($in['purpose'])) { $purpose = addslashes($in['purpose']); $query = "INSERT INTO users_note (userid, note, entered) VALUES ($id, '$purpose', NOW())";