https://bugzilla.wikimedia.org/show_bug.cgi?id=57579
--- Comment #4 from T. Gries <[email protected]> --- I found (and fixed locally in my test installations) this bug. Solution was: adding an additional check of the pre-login csrf token (which is injected in SpecialOpenIDLogin/ChooseName in SpecialChangePassword::execute(). So my patch changes that SpecialChangePassword (now) requires either the valid $wgUser( editToken) _or_ a valid preLogin-Token. (Chris: you were correct! I could not find back the tip you've sent me, otherwsie I would have added a pointer here.) A formal patch will follow. -- You are receiving this mail because: You are on the CC list for the bug. _______________________________________________ Wikibugs-l mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
