psychon bcb0306393 Don't allow users to change their user name through spoofed webadmin requests ...

Since adding and editing users is handled pretty much the same way in webadmin,
you could change your user name when you sent a POST requests with some
arbitrary user field:

 echo "user=newuser&submitted=1" | \
 lynx -post_data -auth=user:pass http://localhost:55455/edituser

This was spotted by SilverLeo who seems to spend quite some time trying to make
ZNC break, which is a good thing. Thanks!

Oh and btw, the last commit (delete the pid file) is from SilverLeo.
I forgot to mention him in the commit msg. Sorry.


git-svn-id: https://znc.svn.sourceforge.net/svnroot/znc/trunk@949 726aef4b-f618-498e-8847-2d620e286838

2008-02-10 10:18:54 +00:00

..

webadmin/skins

chmod a-x graphiX's templates

2007-10-22 22:22:11 +00:00

autoattach.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

autoop.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

away.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

awaynick.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

chansaver.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

crypt.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

email.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

imapauth.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

kickrejoin.cpp

Don't use <> but "" for the includes in kickrejoin

2008-01-18 23:06:54 +00:00

Makefile.in

And again some makefile stuff (this time it's some new depend code)

2008-01-16 20:56:07 +00:00

modperl.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

modperl.pm

Changed DataPath to SavePath

2005-12-27 18:37:48 +00:00

nickserv.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

partyline.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

perform.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

raw.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

sample.cpp

Make it more clear that the sample module is loaded

2008-01-07 21:32:30 +00:00

saslauth.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

savebuff.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

schat.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

shell.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

simple_away.cpp

Update simple_away's copyright date

2008-01-30 10:28:15 +00:00

stickychan.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

watch.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

webadmin.cpp

Don't allow users to change their user name through spoofed webadmin requests

2008-02-10 10:18:54 +00:00