Simon McVittie f357856448 passwordauth: prevent authentication bypass via multiple name parameters ... Calling CGI::FormBuilder::field with a name argument in list context returns zero or more user-specified values of the named field, even if that field was not declared as supporting multiple values. Passing the result of field as a function parameter counts as list context. This is the same bad behaviour that is now discouraged for CGI::param. In this case we pass the multiple values to CGI::Session::param. That accessor has six possible calling conventions, of which four are documented. If an attacker passes (2*n + 1) values for the 'name' field, for example name=a&name=b&name=c, we end up in one of the undocumented calling conventions for param: # equivalent to: (name => 'a', b => 'c') $session->param('name', 'a', 'b', 'c') and the 'b' session parameter is unexpectedly set to an attacker-specified value. In particular, if an attacker "bob" specifies name=bob&name=name&name=alice, then authentication is carried out for "bob" but the CGI::Session ends up containing {name => 'alice'}, an authentication bypass vulnerability. This vulnerability is tracked as OVE-20170111-0001. (cherry picked from commit e909eb93f4530a175d622360a8433e833ecf0254)		2017-01-11 18:11:06 +00:00
..
404.pm	add missing getsetup hook	2010-07-13 15:23:44 -04:00
aggregate.pm	Silence "used only once: possible typo" warnings for variables that are part of modules' APIs	2016-01-19 11:24:18 +00:00
amazon_s3.pm	prune: do not prune beyond an optional base directory, and add a test	2012-04-07 17:52:29 +01:00
anonok.pm	…
attachment.pm	Force CGI::FormBuilder->field to scalar context where necessary	2016-12-28 21:32:12 +00:00
autoindex.pm	Silence "used only once: possible typo" warnings for variables that are part of modules' APIs	2016-01-19 11:24:18 +00:00
blogspam.pm	Update blogspam to the 2.0 API.	2015-01-02 13:55:10 -05:00
brokenlinks.pm	brokenlinks: sort the pages that link to the missing page, for better reproducibility	2015-06-09 22:28:31 +01:00
bzr.pm	cloak user PII when making commits etc, and let cloaked PII be used in banned_users	2015-05-14 11:58:21 -04:00
calendar.pm	Silence "used only once: possible typo" warnings for variables that are part of modules' APIs	2016-01-19 11:24:18 +00:00
camelcase.pm	…
color.pm	remove unnecessary and troublesome filter calls	2010-07-04 15:06:48 -04:00
comments.pm	Use rel=nofollow microformat for dynamic (CGI-related) URLs	2017-01-09 13:07:24 +00:00
conditional.pm	In all=no conditionals, depend on the influences, not the test pagespec	2014-03-03 11:30:36 +00:00
creole.pm	…
cutpaste.pm	cutpaste: Fix bug that occured in some cases involving inlines when text was pasted on a page before being cut.	2010-09-15 16:24:50 -04:00
cvs.pm	Update my surname to its new legal spelling.	2016-09-14 14:28:01 -04:00
darcs.pm	cloak user PII when making commits etc, and let cloaked PII be used in banned_users	2015-05-14 11:58:21 -04:00
date.pm	…
ddate.pm	…
editdiff.pm	…
editpage.pm	Force CGI::FormBuilder->field to scalar context where necessary	2016-12-28 21:32:12 +00:00
edittemplate.pm	edittemplate: use unambiguous RFC 3339 datestamps	2014-09-01 09:01:07 +01:00
emailauth.pm	emailauth: Added emailauth_sender config.	2015-10-02 11:49:47 -04:00
embed.pm	…
external.pm	external: Disable RPC::XML's "smart" encoding, which sent ints for strings that contained only a number, fixing a longstanding crash of the rst plugin.	2010-09-14 15:37:45 -04:00
favicon.pm	…
filecheck.pm	filecheck: accept MIME types that don't contain ';'	2014-09-10 09:00:20 +01:00
flattr.pm	Revert "insert flattr javascript via sanitize, not format hook"	2010-08-12 18:18:35 -04:00
format.pm	txt: Fix display when used inside a format directive.	2010-10-25 22:37:34 -04:00
fortune.pm	…
getsource.pm	use cgitemplate, remove misctemplate	2011-01-05 17:15:38 -04:00
git.pm	git: don't redundantly pass "--" to git_sha1	2017-01-09 13:58:58 +00:00
goodstuff.pm	…
google.pm	…
goto.pm	Make sure we do not pass multiple CGI parameters in function calls	2014-10-16 22:24:47 +01:00
graphviz.pm	graphviz: Handle self-links.	2012-04-18 15:36:27 -04:00
haiku.pm	haiku: if deterministic build is requested, return a hard-coded haiku	2015-06-09 22:30:43 +01:00
headinganchors.pm	apply Changaco's patch to make headinganchors more like mediawiki's	2011-06-21 15:22:36 -04:00
highlight.pm	Silence "used only once: possible typo" warnings for variables that are part of modules' APIs	2016-01-19 11:24:18 +00:00
hnb.pm	hnb: Fixed broken use of mkstemp that had caused dangling temp files, and prevented actually rendering hnb files.	2010-06-27 13:49:51 -04:00
html.pm	…
htmlbalance.pm	htmlbalance: be compatible with HTML::Tree 4.0	2010-09-26 22:33:54 +01:00
htmlscrubber.pm	htmlscrubber: Allow the URI schemes of major VCS's.	2013-01-05 17:25:47 -04:00
htmltidy.pm	htmltidy: Avoid breaking the sidebar when websetup is running.	2011-02-03 12:49:13 -04:00
httpauth.pm	httpauth: When it's the only auth method, avoid a pointless and confusing signin form, and just right to the httpauthurl.	2012-04-04 12:58:36 -04:00
img.pm	Detect image type from .JPG just like .jpg (etc.).	2016-05-08 18:31:02 -04:00
inline.pm	inline: Prevent creating a file named ".mdwn" when the postform is submitted with an empty title.	2016-09-21 13:51:42 -04:00
link.pm	link: Fix renaming wikilinks that contain embedded urls.	2012-04-18 15:15:11 -04:00
linkmap.pm	display the pagetitle() in linkmaps	2012-03-15 14:38:42 +01:00
listdirectives.pm	needsbuild hook interface changed; the hooks should now return the modified array of things that need built. (Backwards compatability code keeps plugins using the old interface working.)	2010-09-07 12:08:59 -04:00
localstyle.pm	…
lockedit.pm	…
loginselector.pm	loginselector: When only openid and emailauth are enabled, but passwordauth is not, avoid showing a "Other" box which opens an empty form.	2016-03-02 16:35:16 -04:00
map.pm	map: postprocess to collapse useless </ul><ul> sequences	2013-02-24 13:10:24 +00:00
mdwn.pm	Process .md like .mdwn, but disallow web creation.	2016-03-08 14:31:15 -05:00
mercurial.pm	cloak user PII when making commits etc, and let cloaked PII be used in banned_users	2015-05-14 11:58:21 -04:00
meta.pm	Fix [[!meta name=foo]] by closing the open quote.	2015-08-22 22:34:53 -04:00
mirrorlist.pm	Always produce HTML5 doctype and new attributes, but not new elements	2014-10-16 11:04:53 +01:00
moderatedcomments.pm	…
monotone.pm	cloak user PII when making commits etc, and let cloaked PII be used in banned_users	2015-05-14 11:58:21 -04:00
more.pm	more: Add pages parameter to limit where the more is displayed. (thanks, dark)	2010-11-16 15:00:04 -04:00
norcs.pm	Add a second parameter to the rcs_diff hook, and avoid bloating memory reading in enormous commits.	2010-12-29 19:58:49 -04:00
notifyemail.pm	Force CGI::FormBuilder->field to scalar context where necessary	2016-12-28 21:32:12 +00:00
opendiscussion.pm	opendiscussion: don't allow editing discussionpage if discussion is disabled	2013-01-02 18:05:33 +00:00
openid.pm	Do not directly enable emailauth by default, only indirectly via openid	2015-05-27 08:52:01 +01:00
orphans.pm	…
osm.pm	osm: Escape name parameter. Closes: #731797	2014-01-15 15:53:51 -04:00
otl.pm	…
pagecount.pm	…
pagestats.pm	Make pagestats output more deterministic.	2016-12-19 18:21:07 +00:00
pagetemplate.pm	…
parentlinks.pm	indent	2010-12-25 13:23:23 -04:00
passwordauth.pm	passwordauth: prevent authentication bypass via multiple name parameters	2017-01-11 18:11:06 +00:00
pingee.pm	…
pinger.pm	Bug#737121: ikiwiki: [PATCH] Implement configuration option to set the user agent string for outbound HTTP requests	2014-02-01 16:53:33 -04:00
po.pm	Force CGI::FormBuilder->field to scalar context where necessary	2016-12-28 21:32:12 +00:00
poll.pm	Make sure we do not pass multiple CGI parameters in function calls	2014-10-16 22:24:47 +01:00
polygen.pm	polygen: if deterministic build is requested, use a well-known random seed	2015-06-09 22:30:44 +01:00
postsparkline.pm	…
prettydate.pm	revert change to prettydate	2012-02-02 22:27:55 -04:00
progress.pm	…
rawhtml.pm	…
recentchanges.pm	Do not pass ignored sid parameter to checksessionexpiry	2014-10-12 18:03:57 +01:00
recentchangesdiff.pm	include manually the toggle js code	2012-07-19 10:32:02 -04:00
relativedate.pm	Use local paths when including Javascript	2010-11-23 00:06:07 +00:00
remove.pm	Silence "used only once: possible typo" warnings for variables that are part of modules' APIs	2016-01-19 11:24:18 +00:00
rename.pm	Force CGI::FormBuilder->field to scalar context where necessary	2016-12-28 21:32:12 +00:00
repolist.pm	…
rsync.pm	Added a "changes" hook. Renamed the "change" hook to "rendered", but	2012-03-28 18:43:07 -04:00
search.pm	Fix typo.	2016-02-20 22:00:54 -05:00
shortcut.pm	shortcut: Support Wikipedia's form of url-encoding for unicode characters	2012-03-03 11:27:59 -04:00
sidebar.pm	Revert po vs. template kludges.	2010-07-11 11:03:41 +02:00
signinedit.pm	…
skeleton.pm.example	remove misc section	2012-03-28 20:36:25 -04:00
smiley.pm	smiley: warn instead of error for missing smileys	2010-08-13 17:58:21 -04:00
sortnaturally.pm	Add path and path_natural sort orders	2011-12-06 14:26:27 -04:00
sparkline.pm	Use Digest::SHA built into perl rather than external Digest::SHA1 to simplify dependencies. Closes: #591040	2010-07-31 15:54:25 -04:00
svn.pm	cloak user PII when making commits etc, and let cloaked PII be used in banned_users	2015-05-14 11:58:21 -04:00
table.pm	call preprocess in scan mode hooks before scan hooks	2010-08-30 15:06:58 -04:00
tag.pm	Silence "used only once: possible typo" warnings for variables that are part of modules' APIs	2016-01-19 11:24:18 +00:00
template.pm	protect $@ whenever a block using $@ is non-trivial	2014-02-21 17:06:36 +00:00
templatebody.pm	Add templatebody plugin and directive, and enable it by default	2014-03-05 10:42:19 +00:00
testpagespec.pm	…
teximg.pm	Squelch regex deprecation warnings from Perl 5.22.	2015-06-14 21:35:51 -04:00
textile.pm	…
theme.pm	theme: Now <TMPL_IF THEME_$NAME> can be used in all templates when a theme is enabled.	2013-05-16 22:20:56 -04:00
tla.pm	cloak user PII when making commits etc, and let cloaked PII be used in banned_users	2015-05-14 11:58:21 -04:00
toc.pm	…
toggle.pm	Use local paths when including Javascript	2010-11-23 00:06:07 +00:00
trail.pm	trail: don't generate a costly dependency when forcing sort order	2014-07-11 22:08:08 +01:00
transient.pm	prune: do not prune beyond an optional base directory, and add a test	2012-04-07 17:52:29 +01:00
txt.pm	txt: Fix display when used inside a format directive.	2010-10-25 22:37:34 -04:00
typography.pm	…
underlay.pm	Add missing plugin section, and deal with missing sections with a warning.	2013-03-04 13:03:34 -04:00
userlist.pm	encode html	2011-06-09 10:46:09 -04:00
version.pm	needsbuild hook interface changed; the hooks should now return the modified array of things that need built. (Backwards compatability code keeps plugins using the old interface working.)	2010-09-07 12:08:59 -04:00
websetup.pm	Standardize on --long-option instead of -long-option	2015-03-01 16:15:01 +00:00
wikitext.pm	…
wmd.pm	Use local paths when including Javascript	2010-11-23 00:06:07 +00:00