[drupal-devel] [feature] Don't reset existing password on request, prevent DoS password reset abuse

[drumm]

 Project:      Drupal
 Version:      4.5.2
 Component:    user system
 Category:     feature requests
 Priority:     critical
 Assigned to:  Anonymous
 Reported by:  brlcad
 Updated by:   drumm
 Status:       patch

IMO the fix to this issue should remove sending the password
alltogether. Instead store a unique hash code and then send a URL with
that code which presents a page for entering the new password twice.
The same hash code system could be used for activating new accounts
without sending a password in email.


drumm



Previous comments:
------------------------------------------------------------------------

February 6, 2005 - 19:54 : brlcad

Attachment: http://drupal.org/files/issues/pass_alt.diff (6.12 KB)

This patch adds a field to the user table for storing an alternate
password.  When a password request is made, the alternate password is
set instead of clobbering the existing password.  This allows the user
to discard the regenerated password e-mail, preserving the existing
password.  
This also prevents abuse whereby any anonymous user can repeatedly
reset user passwords potentially entirely blocking access to a site,
e.g. a curl shell script that repeatedly posts a password reset request
for all accounts. 
Iff the alternate password is used for authentication, the alternate
password becomes the main password.  If the main password is set (e.g.
admin user form), the alternate password is unset.
The patch was made against DRUPAL-4-5-2.
Cheers!
Sean


-- 
View: http://drupal.org/node/16909
Edit: http://drupal.org/project/comments/add/16909