diff options
author | Alex Gaynor <alex.gaynor@gmail.com> | 2010-12-23 03:47:58 +0000 |
---|---|---|
committer | Alex Gaynor <alex.gaynor@gmail.com> | 2010-12-23 03:47:58 +0000 |
commit | 7f8dd9cbac074389af8d8fd235bf2cb657227b9a (patch) | |
tree | 80125b7e991a766f752c5b848bd6e77d0c0f1963 | |
parent | 17084839fd7e267da5729f2a27753322b9d415a0 (diff) | |
download | django-7f8dd9cbac074389af8d8fd235bf2cb657227b9a.tar.gz |
[1.1.X] Fix a security issue in the auth system. Disclosure and new release forthcoming.
git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.1.X@15036 bcc190cf-cafb-0310-a4f2-bffc1f526a37
-rw-r--r-- | django/contrib/auth/tests/tokens.py | 5 | ||||
-rw-r--r-- | django/contrib/auth/urls.py | 4 | ||||
-rw-r--r-- | django/utils/http.py | 7 |
3 files changed, 13 insertions, 3 deletions
diff --git a/django/contrib/auth/tests/tokens.py b/django/contrib/auth/tests/tokens.py index 03cc1e3c11..7a641fd818 100644 --- a/django/contrib/auth/tests/tokens.py +++ b/django/contrib/auth/tests/tokens.py @@ -34,4 +34,9 @@ True >>> p2.check_token(u, tk1) False +This will put a 14-digit base36 timestamp into the token, which is too large. +>>> tk1 = p0._make_token_with_timestamp(u, 175455491841851871349) +>>> p0.check_token(u, tk1) +False + """ diff --git a/django/contrib/auth/urls.py b/django/contrib/auth/urls.py index 4f8a102e66..42b4e8f212 100644 --- a/django/contrib/auth/urls.py +++ b/django/contrib/auth/urls.py @@ -1,4 +1,4 @@ -# These URLs are normally mapped to /admin/urls.py. This URLs file is +# These URLs are normally mapped to /admin/urls.py. This URLs file is # provided as a convenience to those who want to deploy these URLs elsewhere. # This file is also used to provide a reliable view deployment for test purposes. @@ -11,7 +11,7 @@ urlpatterns = patterns('', (r'^password_change/done/$', 'django.contrib.auth.views.password_change_done'), (r'^password_reset/$', 'django.contrib.auth.views.password_reset'), (r'^password_reset/done/$', 'django.contrib.auth.views.password_reset_done'), - (r'^reset/(?P<uidb36>[0-9A-Za-z]+)-(?P<token>.+)/$', 'django.contrib.auth.views.password_reset_confirm'), + (r'^reset/(?P<uidb36>[0-9A-Za-z]{1,13})-(?P<token>[0-9A-Za-z]{1,13}-[0-9A-Za-z]{1,20})/$', 'django.contrib.auth.views.password_reset_confirm'), (r'^reset/done/$', 'django.contrib.auth.views.password_reset_complete'), ) diff --git a/django/utils/http.py b/django/utils/http.py index f0b1af9c58..2fb60078e5 100644 --- a/django/utils/http.py +++ b/django/utils/http.py @@ -73,8 +73,13 @@ def http_date(epoch_seconds=None): def base36_to_int(s): """ - Convertd a base 36 string to an integer + Converts a base 36 string to an ``int``. To prevent + overconsumption of server resources, raises ``ValueError` if the + input is longer than 13 base36 digits (13 digits is sufficient to + base36-encode any 64-bit integer). """ + if len(s) > 13: + raise ValueError("Base36 input too large") return int(s, 36) def int_to_base36(i): |