Changeset 3352:bb06343f4247

Timestamp:

10/05/16 08:11:10 (9 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

2.10

Message:

Fix CVE-2016-7903: Dotclear <= 2.10.2 Password Reset Address Spoof / addresses #2210 — Thank's Hongkun Zeng for report

File:

• admin/auth.php (modified) (1 diff)

admin/auth.php

@@ -29 +29 @@
 }
 
-$page_url = http::getHost().$_SERVER['REQUEST_URI'];
+if (defined('DC_ADMIN_URL')) {
+     $page_url = DC_ADMIN_URL.$core->adminurl->get('admin.auth');
+} else {
+     $page_url = http::getHost().$_SERVER['REQUEST_URI'];
+}
 
 $change_pwd = $core->auth->allowPassChange() && isset($_POST['new_pwd']) && isset($_POST['new_pwd_c']) && isset($_POST['login_data']);