VladPolskiy/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2025-07-20 16:48:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bugs in password change API

Browse Source
This commit is contained in:
Jamie Cameron
2021-08-01 14:41:30 -07:00
parent 5b0bc3c30f
commit b19d4fc005
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
passwd/change_passwd.cgi
View File

@ -2,6 +2,7 @@
# Change a user's password knowing the old one. For user only via anonymous # Change a user's password knowing the old one. For user only via anonymous
# API calls. # API calls.
$trust_unknown_referers = 1;
require './passwd-lib.pl'; require './passwd-lib.pl';
&ReadParse(); &ReadParse();
print "Content-type: text/plain\n\n"; print "Content-type: text/plain\n\n";
@ -27,7 +28,7 @@ $user || &error_exit("User does not exist");
&useradmin::validate_password($in{'old'}, $user->{'pass'}) || &useradmin::validate_password($in{'old'}, $user->{'pass'}) ||
&error_exit("Incorrect password"); &error_exit("Incorrect password");
my $err = &useradmin::check_password_restrictions( my $err = &useradmin::check_password_restrictions(
$in{'pass'}, $in{'user'}, $user); $in{'new'}, $in{'user'}, $user);
&error_exit("Invalid password : $err") if ($err); &error_exit("Invalid password : $err") if ($err);
# Do the change # Do the change
@ -35,7 +36,7 @@ my $err = &useradmin::check_password_restrictions(
&clear_rate_limit($in{'user'}); &clear_rate_limit($in{'user'});
eval { eval {
local $main::error_must_die = 1; local $main::error_must_die = 1;
&change_password($user, $in{'pass'}, 1); &change_password($user, $in{'new'}, 1);
}; };
if ($@) { if ($@) {
&error_exit($@); &error_exit($@);

2
passwd/passwd-lib.pl
View File

@ -168,7 +168,7 @@ if ($rate{$key} > $rate_limit_max) {
$rv = "Too many failures for $key"; $rv = "Too many failures for $key";
} }
else { else {
sleep($rate{$key} ** 2); sleep(2 ** $rate{$key});
$rate{$key}++; $rate{$key}++;
} }
&write_file($rate_limit_file, \%rate); &write_file($rate_limit_file, \%rate);