harukin/core
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

block channel removal for 48 hours after changing the account password, since the password is required to remove a channel. Somebody looking at an open session on somebody else's computer can simply change the password and then proceed to maliciously remove the channel. This change gives the owner 2 days to discover that something is wrong and recover his/her password and potentially save their channel from getting erased by the vandal. This is most likely to happen if a relationship has gone bad, or something incriminating was found in your private messages when you left your computer briefly unattended.

Browse Source
This commit is contained in:
friendica
2014-07-29 20:13:01 -07:00
parent c8829e7243
commit 35ed18967a
5 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod/settings.php
+2 -1
View File
@@ -202,10 +202,11 @@ function settings_post(&$a) {
if(! $errs) {
$salt = random_string(32);
$password_encoded = hash('whirlpool', $salt . $newpass);
$r = q("update account set account_salt = '%s', account_password = '%s'
$r = q("update account set account_salt = '%s', account_password = '%s', account_password_changed = '%s'
where account_id = %d limit 1",
dbesc($salt),
dbesc($password_encoded),
dbesc(datetime_convert()),
intval(get_account_id())
);
if($r)