Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.See:
https://www.drupal.org/SA-CORE-2015-001
http://cgit.drupalcode.org/drupal/commit/?id=b44056d2f8e8c71d35c85ec5c2f...
This issue is only for the access bypass issue involving password reset URLs.
There was some discussion in the security team about whether this actually affects Drupal 8 in any way, but we should find out. And probably at a minimum, port the tests from Drupal 7 to Drupal 8 to help see if it's possible to reproduce any security issue.
Credit for the D6/D7 version of this patch (the security release):
klausi, David_Rothstein, pwolanin, benjy
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | user-pass-rehash-2455079-3.patch | 13.28 KB | Berdir |
| #3 | user-pass-rehash-2455079-3-test-only.patch | 3.88 KB | Berdir |
Comments
Comment #1
David_Rothstein CreditAttribution: David_Rothstein commentedComment #2
effulgentsia CreditAttribution: effulgentsia at Acquia commentedTagging "D8 upgrade path" as well so that we don't release a supported upgrade path beta that has publicly known security exploits.
Comment #3
BerdirYeah, I hope nobody bet that Drupal 8 is not affected ;)
Left out the stuff about BC, I don't think we need that for 8, we need a change record for this, wondering if we can make it so that it also applies to 7.x. The API is still the same ;)
Comment #5
BerdirAh, there's already https://www.drupal.org/node/2455005, great. We can update that when this is committed with 8.x code examples, already referenced the issue.
Comment #6
larowlannew record
Comment #7
BerdirNote: The db_update() is not pretty and won't work with MongoDB, but I don't see a way to use the API for this. @larowlan and me agreed that we shouldn't hold up a critical on this, I notified @chx and we'll try to find a solution in a follow-up or so.
Comment #8
klausi+1 RTBC
Test case looks good, and I think it is important that we add the uid to the password reset HMAC, same as we did in D7. That way we avoid vulnerabilities when corrupt user data is migrated into a D8 database where password and last login timestamp are NULL.
Comment #9
chx CreditAttribution: chx at MongoDB commentedIt's a test. I already discussed with alexpott that we know that some issues #1518506: Normalize how case sensitivity is handled across database engines #2443679: PostgreSQL: Fix taxonomy\Tests\TermTest will fail on SQLite we need to add test method exclusions (I thought it'll be #301005: Add "expected fail" functionality to simpletest but after the discussion it won't be) per driver so there's no problem here.
Comment #10
alexpottCommitted 8e54eca and pushed to 8.0.x. Thanks!