Removed sectoken

This token is completly useless since an attacker can easily extract it
from the page.

diff --git a/core/templates/login.php b/core/templates/login.php
index 2c9b766aa4de82ebebe0faba77d1375af252520e..bedff4453b0fb8282297d58ea13948cf42ee18fd 100644 (file)
--- a/core/templates/login.php
+++ b/core/templates/login.php
@@ -12,7 +12,6 @@
                <p class="infield">
                        <label for="password" class="infield"><?php echo $l->t( 'Password' ); ?></label>
                        <input type="password" name="password" id="password" value="" required<?php echo $_['user_autofocus']?'':' autofocus'; ?> />
-                       <input type="hidden" name="sectoken" id="sectoken" value="<?php echo($_['sectoken']); ?>"  />
                </p>
                <input type="checkbox" name="remember_login" value="1" id="remember_login" /><label for="remember_login"><?php echo $l->t('remember'); ?></label>
                <input type="submit" id="submit" class="login" value="<?php echo $l->t( 'Log in' ); ?>" />

diff --git a/lib/base.php b/lib/base.php
index 5a2decc6f63f8bb9f5a844820a760770e40b5230..b89859ab2dd13387ed0b22393ead1fd5cd4677d8 100644 (file)
--- a/lib/base.php
+++ b/lib/base.php
@@ -528,11 +528,7 @@ class OC{
        }
 
        protected static function tryFormLogin() {
-               if(!isset($_POST["user"])
-               || !isset($_POST['password'])
-               || !isset($_SESSION['sectoken'])
-               || !isset($_POST['sectoken'])
-               || ($_SESSION['sectoken']!=$_POST['sectoken']) ) {
+               if(!isset($_POST["user"]) || !isset($_POST['password'])) {
                        return false;
                }
 

diff --git a/lib/util.php b/lib/util.php
index 15e6f2824e5873854866ace512bcf15d338a8885..29ab2c34e966296d490b91a95e1f4e0da9c74b24 100755 (executable)
--- a/lib/util.php
+++ b/lib/util.php
@@ -314,9 +314,6 @@ class OC_Util {
                        $parameters["username"] = '';
                        $parameters['user_autofocus'] = true;
                }
-               $sectoken=rand(1000000,9999999);
-               $_SESSION['sectoken']=$sectoken;
-               $parameters["sectoken"] = $sectoken;
                if (isset($_REQUEST['redirect_url'])) {
                        $redirect_url = OC_Util::sanitizeHTML($_REQUEST['redirect_url']);
                } else {