Changeset - 8b47181750a8
Parent rev.
Child rev.
[Not reviewed]
stable
0 3 0
Mads Kiilerich - 6 years ago 2020-01-09 12:28:33
mads@kiilerich.com
Grafted from: d80802bd5eb6
login: fix incorrect CSRF rejection of "Reset Your Password" form (Issue #350)

htmlfill would remove the CSRF token from the form when substituting the query
parameters, causing password reset to break.

By default, htmlfill will clear all input fields that doesn't have a new
"default" value provided. It could be fixed by setting force_defaults to False
- see http://www.formencode.org/en/1.2-branch/modules/htmlfill.html . It could
also be fixed by providing the CSRF token in the defaults to be substituted in
the form.

Instead, refactor password_reset_confirmation to have more explicitly safe
handling of query parameters. Replace htmlfill with the usual template
variables.

The URLs are generated in kallithea/model/user.py send_reset_password_email()
and should only contain email, timestamp (integer as digit string) and a hex
token from get_reset_password_token() .
3 files changed with 8 insertions and 10 deletions:
kallithea/controllers/login.py
3
5
kallithea/templates/password_reset_confirmation.html
3
3
kallithea/tests/functional/test_login.py
2
2
0 comments (0 inline, 0 general)
kallithea/controllers/login.py
➞
Show inline comments
 
@@ -189,54 +189,52 @@ class LoginController(BaseController):
 
                redirect_link = UserModel().send_reset_password_email(form_result)
 
                h.flash(_('A password reset confirmation code has been sent'),
 
                            category='success')
 
                raise HTTPFound(location=redirect_link)
 

			




	
	
	
		
 
            except formencode.Invalid as errors:

			




	
	
	
		
 
                return htmlfill.render(

			




	
	
	
		
 
                    render('/password_reset.html'),

			




	
	
	
		
 
                    defaults=errors.value,

			




	
	
	
		
 
                    errors=errors.error_dict or {},

			




	
	
	
		
 
                    prefix_error=False,

			




	
	
	
		
 
                    encoding="UTF-8",

			




	
	
	
		
 
                    force_defaults=False)

			




	
	
	
		
 

			




	
	
	
		
 
        return render('/password_reset.html')

			




	
	
	
		
 

			




	
	
	
		
 
    def password_reset_confirmation(self):

			




	
	
	
		
 
        # This controller handles both GET and POST requests, though we

			




	
	
	
		
 
        # only ever perform the actual password change on POST (since

			




	
	
	
		
 
        # GET requests are not allowed to have side effects, and do not

			




	
	
	
		
 
        # receive automatic CSRF protection).

			




	
	
	
		
 

			




	
	
	
		
 
        # The template needs the email address outside of the form.

			




	
	
	
		
 
        c.email = request.params.get('email')

			




	
	
	
		
 

			




	
	
	
		
 
        c.timestamp = request.params.get('timestamp') or ''

			




	
	
	
		
 
        c.token = request.params.get('token') or ''

			




	
	
	
		
 
        if not request.POST:

			




	
	
	
		
 
            return htmlfill.render(

			




	
	
	
		
 
                render('/password_reset_confirmation.html'),

			




	
	
	
		
 
                defaults=dict(request.params),

			




	
	
	
		
 
                encoding='UTF-8')

			




	
	
	
		
 
            return render('/password_reset_confirmation.html')

			




	
	
	
		
 

			




	
	
	
		
 
        form = PasswordResetConfirmationForm()()

			




	
	
	
		
 
        try:

			




	
	
	
		
 
            form_result = form.to_python(dict(request.POST))

			




	
	
	
		
 
        except formencode.Invalid as errors:

			




	
	
	
		
 
            return htmlfill.render(

			




	
	
	
		
 
                render('/password_reset_confirmation.html'),

			




	
	
	
		
 
                defaults=errors.value,

			




	
	
	
		
 
                errors=errors.error_dict or {},

			




	
	
	
		
 
                prefix_error=False,

			




	
	
	
		
 
                encoding='UTF-8')

			




	
	
	
		
 

			




	
	
	
		
 
        if not UserModel().verify_reset_password_token(

			




	
	
	
		
 
            form_result['email'],

			




	
	
	
		
 
            form_result['timestamp'],

			




	
	
	
		
 
            form_result['token'],

			




	
	
	
		
 
        ):

			




	
	
	
		
 
            return htmlfill.render(

			




	
	
	
		
 
                render('/password_reset_confirmation.html'),

			




	
	
	
		
 
                defaults=form_result,

			




	
	
	
		
 
                errors={'token': _('Invalid password reset token')},

			




	
	
	
		
 
                prefix_error=False,

			




	
	
	
		
 
                encoding='UTF-8')

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    kallithea/templates/password_reset_confirmation.html
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
	
		
 
## -*- coding: utf-8 -*-

			




	
	
	
		
 
<%inherit file="base/root.html"/>

			




	
	
	
		
 

			




	
	
	
		
 
<%block name="title">

			




	
	
	
		
 
    ${_('Reset Your Password')}

			




	
	
	
		
 
</%block>

			




	
	
	
		
 

			




	
	
	
		
 
<%include file="/base/flash_msg.html"/>

			




	
	
	
		
 

			




	
	
	
		
 
<div class="container">

			




	
	
	
		
 
<div class="row">

			




	
	
	
		
 
<div class="centered-column">

			




	
	
	
		
 
<div id="register" class="panel panel-primary">

			




	
	
	
		
 
    <div class="panel-heading">

			




	
	
	
		
 
        %if c.site_name:

			




	
	
	
		
 
            <h5>${_('Reset Your Password to %s') % c.site_name}</h5>

			




	
	
	
		
 
        %else:

			




	
	
	
		
 
            <h5>${_('Reset Your Password')}</h5>

			




	
	
	
		
 
        %endif

			




	
	
	
		
 
    </div>

			




	
	
	
		
 
    <div class="panel-body">

			




	
	
	
		
 
        ${h.form(h.url('reset_password_confirmation'), method='post')}

			




	
	
	
		
 
        <p>${_('You are about to set a new password for the email address %s.') % c.email}</p>

			




	
	
	
		
 
        <p>${_('Note that you must use the same browser session for this as the one used to request the password reset.')}</p>

			




	
	
	
		
 
        ${h.hidden('email')}

			




	
	
	
		
 
        ${h.hidden('timestamp')}

			




	
	
	
		
 
        ${h.hidden('email', value=c.email)}

			




	
	
	
		
 
        ${h.hidden('timestamp', value=c.timestamp)}

			




	
	
	
		
 
        <div class="form">

			




	
	
	
		
 
                <div class="form-group">

			




	
	
	
		
 
                    <label class="control-label" for="token">${_('Code you received in the email')}:</label>

			




	
	
	
		
 
                    <div>

			




	
	
	
		
 
                        ${h.text('token', class_='form-control')}

			




	
	
	
		
 
                        ${h.text('token', value=c.token, class_='form-control')}

			




	
	
	
		
 
                    </div>

			




	
	
	
		
 
                </div>

			




	
	
	
		
 

			




	
	
	
		
 
                <div class="form-group">

			




	
	
	
		
 
                    <label class="control-label" for="password">${_('New Password')}:</label>

			




	
	
	
		
 
                    <div>

			




	
	
	
		
 
                        ${h.password('password',class_='form-control')}

			




	
	
	
		
 
                    </div>

			




	
	
	
		
 
                </div>

			




	
	
	
		
 

			




	
	
	
		
 
                <div class="form-group">

			




	
	
	
		
 
                    <label class="control-label" for="password_confirm">${_('Confirm New Password')}:</label>

			




	
	
	
		
 
                    <div>

			




	
	
	
		
 
                        ${h.password('password_confirm',class_='form-control')}

			




	
	
	
		
 
                    </div>

			




	
	
	
		
 
                </div>

			




	
	
	
		
 

			




	
	
	
		
 
                <div class="form-group">

			




	
	
	
		
 
                    <div class="buttons">

			




	
	
	
		
 
                        ${h.submit('send',_('Confirm'),class_="btn btn-default")}

			




	
	
	
		
 
                    </div>

			




	
	
	
		
 
                </div>

			




	
	
	
		
 
        </div>

			




	
	
	
		
 
        ${h.end_form()}

			




        

    


    
    

    

        

                

                    kallithea/tests/functional/test_login.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -438,54 +438,54 @@ class TestLoginController(TestController

			




	
	
	
		
 
        response = response.follow()

			




	
	
	
		
 

			




	
	
	
		
 
        # BAD TOKEN

			




	
	
	
		
 

			




	
	
	
		
 
        bad_token = "bad"

			




	
	
	
		
 

			




	
	
	
		
 
        response = self.app.post(url(controller='login',

			




	
	
	
		
 
                                     action='password_reset_confirmation'),

			




	
	
	
		
 
                                 {'email': email,

			




	
	
	
		
 
                                  'timestamp': timestamp,

			




	
	
	
		
 
                                  'password': "p@ssw0rd",

			




	
	
	
		
 
                                  'password_confirm': "p@ssw0rd",

			




	
	
	
		
 
                                  'token': bad_token,

			




	
	
	
		
 
                                  '_session_csrf_secret_token': self.session_csrf_secret_token(),

			




	
	
	
		
 
                                 })

			




	
	
	
		
 
        assert response.status == '200 OK'

			




	
	
	
		
 
        response.mustcontain('Invalid password reset token')

			




	
	
	
		
 

			




	
	
	
		
 
        # GOOD TOKEN

			




	
	
	
		
 

			




	
	
	
		
 
        response = self.app.get(confirmation_url)

			




	
	
	
		
 
        assert response.status == '200 OK'

			




	
	
	
		
 
        response.mustcontain("You are about to set a new password for the email address %s" % email)

			




	
	
	
		
 
        response.mustcontain('<form action="%s" method="post">' % url(controller='login', action='password_reset_confirmation'))

			




	
	
	
		
 
        response.mustcontain(no='value="%s"' % self.session_csrf_secret_token())  # BUG making actual password_reset_confirmation POST fail

			




	
	
	
		
 
        response.mustcontain('value="%s"' % self.session_csrf_secret_token())

			




	
	
	
		
 
        response.mustcontain('value="%s"' % token)

			




	
	
	
		
 
        response.mustcontain('value="%s"' % timestamp)

			




	
	
	
		
 
        response.mustcontain('value="username@example.com"')

			




	
	
	
		
 

			




	
	
	
		
 
        # fake a submit of that form (*with* csrf token)

			




	
	
	
		
 
        # fake a submit of that form

			




	
	
	
		
 
        response = self.app.post(url(controller='login',

			




	
	
	
		
 
                                     action='password_reset_confirmation'),

			




	
	
	
		
 
                                 {'email': email,

			




	
	
	
		
 
                                  'timestamp': timestamp,

			




	
	
	
		
 
                                  'password': "p@ssw0rd",

			




	
	
	
		
 
                                  'password_confirm': "p@ssw0rd",

			




	
	
	
		
 
                                  'token': token,

			




	
	
	
		
 
                                  '_session_csrf_secret_token': self.session_csrf_secret_token(),

			




	
	
	
		
 
                                 })

			




	
	
	
		
 
        assert response.status == '302 Found'

			




	
	
	
		
 
        self.checkSessionFlash(response, 'Successfully updated password')

			




	
	
	
		
 

			




	
	
	
		
 
        response = response.follow()

			




	
	
	
		
 

			




	
	
	
		
 
    #==========================================================================

			




	
	
	
		
 
    # API

			




	
	
	
		
 
    #==========================================================================

			




	
	
	
		
 

			




	
	
	
		
 
    def _api_key_test(self, api_key, status):

			




	
	
	
		
 
        """Verifies HTTP status code for accessing an auth-requiring page,

			




	
	
	
		
 
        using the given api_key URL parameter as well as using the API key

			




	
	
	
		
 
        with bearer authentication.

			




	
	
	
		
 

			




	
	
	
		
 
        If api_key is None, no api_key is passed at all. If api_key is True,

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.