381738 - SaveAccount() in userprefs.cgi doesn't check Bugzilla->user->authorizer->can_change_{password|email}

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect, P2)

Description

[Frédéric Buclin]

Even if the UI is fine and checks Bugzilla->user->authorizer->can_change_{password|email} correctly, you can still hack the URL to bypass these checks as SaveAccount() ignores them. This lets you change your email and password despite the Auth system says you cannot. Not a blocker, but would be fine to take for 3.0.1.

Comment 1

[Tiago Mello [:timello]]

Attachment: Checks if the email and the password can be changed.

Comment 2

[Frédéric Buclin]

Comment on attachment 272208 [details] [diff] [review]
Checks if the email and the password can be changed.

We usually put && and || at the beginning of lines, but that's a nit and can be fixed on checkin. r=LpSolit

Comment 3

[Frédéric Buclin]

tip:

Checking in userprefs.cgi;
/cvsroot/mozilla/webtools/bugzilla/userprefs.cgi,v  <--  userprefs.cgi
new revision: 1.114; previous revision: 1.113
done

3.0:

Checking in userprefs.cgi;
/cvsroot/mozilla/webtools/bugzilla/userprefs.cgi,v  <--  userprefs.cgi
new revision: 1.112.2.2; previous revision: 1.112.2.1
done