Ticket #7790 (closed defect (bug): fixed)

Opened 4 months ago

Last modified 3 months ago

Log out actions should be protected against CSRF

Reported by: markjaquith Assigned to: markjaquith
Priority: normal Milestone: 2.7
Component: Security Version: 2.7
Severity: normal Keywords:
Cc:

Description

Anyone can log you out of any WordPress install using CSRF (i.e. pointing you to the /wp-login.php?action=logout for that blog). This can aid in phishing attempts, and can have unforeseen security ramifications.

Log out actions should have their intention validated via nonce with fallback to AYS.

Attachments

7790.001.diff (7.4 kB) - added by markjaquith on 09/25/08 05:44:34.
7790.002.diff (7.9 kB) - added by markjaquith on 09/25/08 06:09:59.
7790.003.diff (8.2 kB) - added by ionfish on 09/25/08 12:57:45.

Change History

09/25/08 05:44:34 changed by markjaquith

  • attachment 7790.001.diff added.

09/25/08 06:09:59 changed by markjaquith

  • attachment 7790.002.diff added.

09/25/08 06:10:59 changed by markjaquith

  • owner changed from anonymous to markjaquith.
  • status changed from new to assigned.

7790.002.diff introduces the wp_logout_url() and wp_login_url() functions to make themes simpler.

09/25/08 10:32:35 changed by ionfish

Adding a redirect parameter to those functions would be useful.

09/25/08 12:57:45 changed by ionfish

  • attachment 7790.003.diff added.

09/28/08 21:02:43 changed by westi

This looks like a really neat idea.

09/28/08 21:05:37 changed by westi

  • status changed from assigned to closed.
  • resolution set to fixed.

(In [9025]) Protect log out actions against CSRF. Props markjaquith and ionfish. Fixes #7790.