Cavemanon/piratepoet
7
Fork 0
Code Pull Requests Actions Releases 16 Activity

Always use length of database link_token for token validation

Browse Source 
[MAILPOET-2364]
This commit is contained in:
Rostislav Wolny
2019-09-17 14:32:45 +02:00
committed by Jack Kitterhing
parent 2b02d22232
commit 09db91bc33
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/Models/Subscriber.php
View File

@ -138,10 +138,12 @@ class Subscriber extends Model {
}
function verifyToken($token) {
$database_token = $this->getLinkToken();
$request_token = substr($token, 0, strlen($database_token));
return call_user_func(
'hash_equals',
$this->getLinkToken(),
$token
$database_token,
$request_token
);
}

13
tests/integration/Models/SubscriberTest.php
View File

@ -686,6 +686,18 @@ class SubscriberTest extends \MailPoetTest {
expect($subscriber->verifyToken('faketoken'))->false();
}
function testItVerifiesOldVersionOfSubscriberToken() {
$subscriber = Subscriber::createOrUpdate([
'email' => $this->test_data['email'],
]);
$subscriber->link_token = 'abcdef';
$token = $subscriber->getLinkToken();
expect($subscriber->verifyToken($token))->true();
expect($subscriber->verifyToken('abcdefghijk'))->true();
expect($subscriber->verifyToken('faketoken'))->false();
expect($subscriber->verifyToken('fake'))->false();
}
function testItBulkDeletesSubscribers() {
$segment = Segment::createOrUpdate(
[
@ -823,6 +835,7 @@ class SubscriberTest extends \MailPoetTest {
expect($values['last_name'])->equals('');
expect($values['status'])->equals(Subscriber::STATUS_UNCONFIRMED);
expect(strlen($values['unsubscribe_token']))->equals(15);
expect(strlen($values['link_token']))->equals(32);
}
function testItSetsDefaultStatusDependingOnSingupConfirmationOption() {