makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-07-25 03:18:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/sec-184] Do not output config passwords to the HTML page

Browse source 
SECURITY-184
This commit is contained in:
Joas Schilling 2015-06-04 14:06:35 +02:00
parent db3782e491
commit 6ca3a30576
2 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
phpBB/includes/acp/acp_board.php
View file

@ -500,7 +500,7 @@ class acp_board
}
// We go through the display_vars to make sure no one is trying to set variables he/she is not allowed to...
foreach ($display_vars['vars'] as $config_name => $null)
foreach ($display_vars['vars'] as $config_name => $data)
{
if (!isset($cfg_array[$config_name]) || strpos($config_name, 'legend') !== false)
{
@ -532,6 +532,13 @@ class acp_board
if ($submit)
{
if (strpos($data['type'], 'password') === 0 && $config_value === '********')
{
// Do not update password fields if the content is ********,
// because that is the password replacement we use to not
// send the password to the output
continue;
}
set_config($config_name, $config_value);
if ($config_name == 'allow_quick_reply' && isset($_POST['allow_quick_reply_enable']))

7
phpBB/includes/functions_acp.php
View file

@ -245,8 +245,13 @@ function build_cfg_template($tpl_type, $key, &$new, $config_key, $vars)
switch ($tpl_type[0])
{
case 'text':
case 'password':
if ($new[$config_key] !== '')
{
// replace passwords with asterixes
$new[$config_key] = '********';
}
case 'text':
case 'url':
case 'email':
case 'color':