MantisBT: master 71ad8c6f

Diff Back to Repository
Author Committer Branch Timestamp Parent
dhx dhx master 2010-10-22 06:59 master c8961258
Affected Issues  0011351: User Real Name and E-Mail values deleted
Changeset

Fix 0011351: Real name and email should not be updated via GPC (LDAP)

When LDAP is being used for retrieving the user real name and/or email
address we should not provide any way for MantisBT forms to update these
fields manually via GPC parameters to account_update and
manage_user_update. Thus we don't need (and never wanted to) send hidden
fields with forms containing the current LDAP details. A user could
maliciously change these values by crafting their own HTTP POST queries
to the server.
mod - manage_user_edit_page.php Diff File
mod - account_page.php Diff File
mod - account_update.php Diff File
mod - manage_user_update.php Diff File