oqapi/webgui
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fixed a problem where a user could attempt to recover their password with a blank email account and screw up all the passwords for all the users that hadn't specified an email account.

Browse source
This commit is contained in:
JT Smith 2002-10-22 00:21:22 +00:00
parent 53d306ae5b
commit 40684441d2
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/WebGUI/Operation/Account.pm
View file

@ -507,6 +507,9 @@ sub www_recoverPassword {
#-------------------------------------------------------------------
sub www_recoverPasswordFinish {
my ($sth, $username, $encryptedPassword, $userId, $password, $flag, $message, $output);
if ($session{form}{email} eq "") {
return '<ul><li>'.WebGUI::International::get(743).'</li></ul>'.www_recoverPassword()
}
$sth = WebGUI::SQL->read("select users.username, users.userId from users, userProfileData
where users.userId=userProfileData.userId and userProfileData.fieldName='email'
and fieldData=".quote($session{form}{email}));