[#45221] - [4.x] Security Hardening: Unset the activation token if the mail address changes
- Fixed in Code Base
- 3 Apr 2025
- Medium
- Build: 4.4-dev
- # 45221
- Diff
- SniperSister:4.4-email-change-hardening
User tests: Successful: Unsuccessful:
Summary of Changes
With this change we make sure the reset token is invalidated (set to an empty string) when the account email is changed. This ensures that only the owner of the currently set email address can perform reset or activation tasks.
Testing Instructions
- Create an new user.
- request an PW reset
- check that the mail got out
- login (without resetting the PW)
- change the email (Frontend or Backend)
- try to reset the PW with the reset token send to the old mail
Actual result BEFORE applying this Pull Request
Without this patch the old token still works.
Expected result AFTER applying this Pull Request
With this patch this is not possible any more as the token has been changed at the time the mail has been changed
Link to documentations
Please select:
-
Documentation link for docs.joomla.org:
-
No documentation changes for docs.joomla.org needed
-
Pull Request link for manual.joomla.org:
-
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Libraries |
| Labels |
Added:
PR-4.4-dev
|
||
@SniperSister is this an issues also on Joomla 5.2+ ?
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/45221.
works
I have tested this item ✅ successfully on 1514412
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/45221.
I have tested this item ✅ successfully on 1514412
I was able to reproduce the issue and to test that the patch fixes it. In addition I've successfully verified that password reset with the right email address still works as well as before.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/45221.
| Status | Pending | ⇒ | Ready to Commit |
RTC
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/45221.
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2025-04-03 12:33:25 |
| Closed_By | ⇒ | MacJoom | |
| Labels |
Added:
RTC
|
||
Thank you very much!
@SniperSister Should the description of "Before" changed with "After"?