Project

General

Profile

Actions
Copy link

Feature #21660

closed

Secure the BE login 3 - The password change facility does not require the user’s current password.

Added by Nikolas Hagelstein over 14 years ago. Updated over 8 years ago.

Status:
Closed
Priority:
Could have
Assignee:
-
Category:
-
Target version:
8 LTS
Start date:
2009-11-24
Due date:
% Done:

0%

Estimated time:
PHP Version:
5.5
Tags:
Complexity:
Sprint Focus:

Description

Currently the password change facility does not require the user’s current password. Due to cross site request forgery an attacker an attacker can change a user’s password if the attacker can entice the user to submit a forged request.

Suggestion:
The current password should be requiered by the password change facillity.

(issue imported from #M12723)

Actions
Copy link
 #1

Updated by Marcus Krause over 14 years ago

FYI: Long time ago I made an effort (asking in mailinglist) to confirm a password change with the old password.
I'll remove number scheme from your other reports so that you cannot easily see that one report (this one) is hidden.

Actions
Copy link
 #2

Updated by Marcus Krause over 14 years ago

Actions
Copy link
 #3

Updated by Christian Kuhn over 12 years ago

  • Target version deleted (0)
  • TYPO3 Version set to 4.7
  • PHP Version changed from 4.3 to 5.3

This is not a critical security issue anymore since the User settings module is CSRF protected.

Security team decided to open this issue as usual feature that can be solved with future TYPO3 versions.

Actions
Copy link
 #4

Updated by Christian Kuhn over 12 years ago

  • Project changed from 1716 to TYPO3 Core
Actions
Copy link
 #5

Updated by Mathias Schreiber over 9 years ago

  • Tracker changed from Bug to Feature
  • Status changed from New to Accepted
  • Priority changed from Should have to Could have
  • Target version set to 7.0
  • PHP Version changed from 5.3 to 5.5
Actions
Copy link
 #6

Updated by Mathias Schreiber over 9 years ago

  • Target version changed from 7.0 to 7.1 (Cleanup)
Actions
Copy link
 #7

Updated by Benni Mack almost 9 years ago

  • Target version changed from 7.1 (Cleanup) to 7.4 (Backend)
Actions
Copy link
 #8

Updated by Susanne Moog almost 9 years ago

  • Target version changed from 7.4 (Backend) to 7.5
Actions
Copy link
 #9

Updated by Benni Mack over 8 years ago

  • Target version changed from 7.5 to 8 LTS
Actions
Copy link
 #10

Updated by Riccardo De Contardi over 8 years ago

  • Status changed from Accepted to Closed

I think I can close this as solved with #35807

If you think that this is the wrong decision, then please write to the mailing list typo3.teams.bugs with issue number and an explanation or open a new ticket and add a relation to this ticket number.

Actions
Copy link

Also available in: Atom PDF