| Index: trunk/extensions/CentralAuth/CentralAuthUser.php |
| — | — | @@ -401,13 +401,11 @@ |
| 402 | 402 | } elseif( $this->matchHashes( $passwords, $local['id'], $local['password'] ) ) { |
| 403 | 403 | // Matches the pre-authenticated password, yay! |
| 404 | 404 | $method = 'password'; |
| 405 | | - } elseif( isset( $passingMail[$local['email']] ) ) { |
| | 405 | + } elseif( $local['emailAuthenticated'] && isset( $passingMail[$local['email']] ) ) { |
| 406 | 406 | // Same e-mail as primary means we know they could |
| 407 | 407 | // reset their password, so we give them the account. |
| | 408 | + // Authenticated email addresses only to prevent merges with malicious users |
| 408 | 409 | $method = 'mail'; |
| 409 | | - } elseif( $local['editCount'] == 0 ) { |
| 410 | | - // Unused accounts are fair game for reclaiming |
| 411 | | - $method = 'empty'; |
| 412 | 410 | } else { |
| 413 | 411 | // Can't automatically resolve this account. |
| 414 | 412 | // |
| — | — | @@ -664,14 +662,26 @@ |
| 665 | 663 | if( $dbw->affectedRows() == 0 ) { |
| 666 | 664 | wfDebugLog( 'CentralAuth', |
| 667 | 665 | "Race condition? Already attached $this->mName@$dbname, just tried by '$method'" ); |
| 668 | | - } else { |
| 669 | | - wfDebugLog( 'CentralAuth', |
| 670 | | - "Attaching local user $this->mName@$dbname by '$method'" ); |
| | 666 | + return; |
| | 667 | + } |
| | 668 | + wfDebugLog( 'CentralAuth', |
| | 669 | + "Attaching local user $this->mName@$dbname by '$method'" ); |
| 671 | 670 | |
| 672 | | - global $wgDBname; |
| 673 | | - if( $dbname == $wgDBname ) { |
| 674 | | - $this->resetState(); |
| 675 | | - } |
| | 671 | + /** |
| | 672 | + * Reset credentials in the local user table, to avoid compromise of the |
| | 673 | + * merged account by a malicious zero-edit account. |
| | 674 | + */ |
| | 675 | + $dbl = self::getLocalDB( $dbname ); |
| | 676 | + $dbl->update( 'user', |
| | 677 | + array( |
| | 678 | + 'user_email' => $this->mEmail, |
| | 679 | + 'user_newpassword' => '', |
| | 680 | + 'user_')); |
| | 681 | + |
| | 682 | + |
| | 683 | + global $wgDBname; |
| | 684 | + if( $dbname == $wgDBname ) { |
| | 685 | + $this->resetState(); |
| 676 | 686 | } |
| 677 | 687 | } |
| 678 | 688 | |