0015341: security - forgotpassword value not checked/eval'd

Create

Capture

Maintain

Audience

View Issue Details [ Jump to Notes ]

[ Print ]

Project

Category

View Status

Date Submitted

Last Update

0015341

phplist

Interface - Frontend

public

29-09-09 17:24

19-04-10 18:18

Reporter

dhartford

Priority

normal

Severity

major

Reproducibility

always

Status

resolved

Resolution

fixed

Platform

OS Version

Product Version

2.10.10

Target Version

2.10.12

Fixed in Version

2.10.12

Summary

0015341: security - forgotpassword value not checked/eval'd

Description

/lists/admin when entering value to send an email for 'forgot password', the value is not checked.

Fix included in additional info.

Additional Information

/lists/admin/index.php, under the if isset($_REQUEST["forgotpassword"])....

#====php 5.1.6 tested fix - filter_var only works on installs with php > 5.2

$parsedforgotpassword = $_REQUEST["forgotpassword"];

$email_regex = '^[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.([a-zA-Z]{2,4})$';

if(!eregi($email_regex, $parsedforgotpassword)){

   logEvent(sprintf('Invalid forgotpassword email entered from %s.', $_SERVER['REMOTE_ADDR']));

   $page="login";

   $msg="invalid email supplied";

}else{

....normal code....

} #end of email validation check

Notes
(0050928) michiel (administrator) 19-04-10 18:18	we already have the is_email function for that, so used that one

Relationships