1894601 - Bugzilla should not use crypt to store hashed passwords in the database

Status: RESOLVED INVALID

(Bugzilla :: User Accounts, enhancement)

Description

[Chirag]

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624

I wrote bogus text in the current password box and changed my user name.
However, Bugzilla accepted the change.

Reproducible: Always

Steps to Reproduce:

1. Use bogus text as your current password.
2. Change your real name.
3. Submit
   Actual Results:
   Bugzilla makes the changes.

Expected Results:
Bugzilla should not make the change.

I think the bogus text I was using began with my actual password so if it was
foo, I enterered foobar.

This is a security issue so setting security flag. This is also a critical issue.

Comment 1

[Dave Miller [:justdave]]

The password entry on that form is only required if you change your email or the password itself. Changes to the real name field do not require a password entry, so the password field would be ignored if that's the only thing you change.

Comment 2

[Dave Miller [:justdave]]

The text on that page states "Your current password is required to confirm email address or password changes." There's no mention of real name there.

This bug will remain secured for 24 hours, to give you adequate time to change my mind in case I'm wrong, after which the security flag will be removed.