Matomo Issue #3733 - User change language should check for token (reported by Merlin Mayr)

@mattab opened this Issue on February 5th 2013 Member

Reported by email

I recently discovered an Cross Site Request Forgery-Flaw in the source code of the Piwik Code (Version 1.10.1). The flaw is located in the LanguagesManager-Plugin, here is the vulnerable part of code (Controller.php): public function saveLanguage()
The function does not check if the logged in user really wanted to change the language, there is no CSRF-Protection. It is possible to change the actual language, without having access to the Dashboard of Piwik, this could result in confused users, some users may think they got hacked and somebody else changed the current language.

we should add token_auth check to avoid CSRF on this.

@anonymous-matomo-user commented on February 5th 2013

In c2f670c4a59aa1c4142174365e076ee69a88d105: Fixes possible minor CSRF that potentially allowed attackers to
change a users language.

fixes #3733

@mattab commented on February 7th 2013 Member

In c8f11dd2631e5f0201f80f0aa8808486d8f593bd: Refs #3733 Installer was broken because there is not yet a token_auth during installer, disabling csrf protectionif piwik is not installed

This Issue was closed on February 7th 2013

User change language should check for token (reported by Merlin Mayr) #3733