mainSavannah Administration - Support: sr #107268, Verification of account email...

 
 

sr #107268: Verification of account email changes is ineffective

Submitter:  Matt McCutchen <hashproduct>
Submitted:  Sat 13 Feb 2010 10:44:37 PM UTC
   
 
Category:  Savannah website Priority:  5 - Normal
Severity:  6 - Security Status:  Wont Do
Privacy:  Public Assigned to:  Beuc
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 14 Feb 2010 08:27:29 AM UTC, comment #2: 

I think you're mistaken.  Only the link sent to the new email is required to complete the change.  The link sent to the old email allows canceling the change.

Matt McCutchen <hashproduct>
Sun 14 Feb 2010 08:10:13 AM UTC, comment #1: 

Hi,

If we do that, you can't change your mail when the old one has been deleted.

So this is not a good idea.

Sylvain Beucler <Beuc>
Sat 13 Feb 2010 10:44:37 PM UTC, original submission:  

When I change my account email address via the "My Account Conf" page, Savannah sends a verification link to the new email address to make me prove that I control it:


You have requested a change of email address on Savannah.
Please visit the following URL to complete the email change:

https://savannah.gnu.org/my/admin/change.php?item=email&confirm_hash=0cdb6814142967ec&step=confirm
-- the Savannah team.


But Savannah sends the same link to my old email address, except for a query parameter at the end:


Someone, presumably you, has requested a change of email address on Savannah.
If it wasn't you, maybe someone is trying to steal your account...

Your current address is hashproduct+gnu@gmail.com, the supposedly new address
is matt@mattmccutchen.net.

If you did not request that change, please visit the following URL to discard
the email change and report the problem to us:

https://savannah.gnu.org/my/admin/change.php?item=email&confirm_hash=0cdb6814142967ec&step=discard

-- the Savannah team.


So I can complete the verification without actually controlling the new address!  Savannah should be changed to use different tokens in the two links.

Matt McCutchen <hashproduct>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by Beuc (Posted a comment)
  • -email is unavailable- added by hashproduct (Voted in favor of this item)
  • -email is unavailable- added by hashproduct (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-02-14 Beuc Open/ClosedOpen Closed
        Assigned toNone Beuc
        StatusNone Wont Do
    2010-02-13 hashproduct Carbon-Copy- Added hashproduct

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code