passwordauth: prevent authentication bypass via multiple name parameters

[git.ikiwiki.info.git] / IkiWiki / Plugin / passwordauth.pm

diff --git a/IkiWiki/Plugin/passwordauth.pm b/IkiWiki/Plugin/passwordauth.pm
index 0cf2a26ea99380b6dd395824945bfcebd42c33b9..4e0d36ed42dc8c3610d8b0f63278bc51f1ae78b4 100644 (file)
--- a/IkiWiki/Plugin/passwordauth.pm
+++ b/IkiWiki/Plugin/passwordauth.pm
@@ -319,12 +319,13 @@ sub formbuilder (@) {
 
        if ($form->title eq "signin" || $form->title eq "register") {
                if (($form->submitted && $form->validate) || $do_register) {
+                       my $user_name = $form->field('name');
+
                        if ($form->submitted eq 'Login') {
-                               $session->param("name", $form->field("name"));
+                               $session->param("name", $user_name);
                                IkiWiki::cgi_postsignin($cgi, $session);
                        }
                        elsif ($form->submitted eq 'Create Account') {
-                               my $user_name=$form->field('name');
                                if (IkiWiki::userinfo_setall($user_name, {
                                        'email' => $form->field('email'),
                                        'regdate' => time})) {
@@ -338,7 +339,6 @@ sub formbuilder (@) {
                                }
                        }
                        elsif ($form->submitted eq 'Reset Password') {
-                               my $user_name=$form->field("name");
                                my $email=IkiWiki::userinfo_get($user_name, "email");
                                if (! length $email) {
                                        error(gettext("No email address, so cannot email password reset instructions."));