cram_nonce.valid needs to be checked when authenticating to prevent spoofing. For this same reason, cram_cron() shouldn't delete non-expired nonces even if they're no longer valid.

Untested fixes attached.

CommentFileSizeAuthor
cram.d5.valid_checking.patch1.08 KBFreso
cram.d6.valid_checking.patch1.29 KBFreso

Comments

selmanj’s picture

selmanj commented
Status: Needs review » Fixed

This is definitely critical, and I wish I had noticed this. Nice catch on the cron line too (took me a few moments to see why that needed to be changed).

Both patches committed. Thanks!

Anonymous’s picture

Anonymous (not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.