|
<content>{{velocity}} |
|
#set($email = "$!request.get('e')") |
|
#if($email == '' || !$services.csrf.isTokenValid($request.form_token)) |
|
{{translation key="xe.admin.forgotUsername.instructions"/}} |
|
|
|
{{html}} |
|
<form method="post" action="$doc.getURL()" class="xformInline"> |
|
<div> |
|
<label for="e">$services.localization.render('xe.admin.forgotUsername.email.label')</label> |
|
<input type="text" id="e" name="e"/> |
|
<input type="hidden" name="form_token" value="$services.csrf.getToken()"/> |
|
<span class="buttonwrapper"> |
|
<input type="submit" value="$services.localization.render('xe.admin.forgotUsername.submit')" class="button"/> |
|
</span> |
|
</div> |
|
</form> |
|
{{/html}} |
|
|
|
#else |
|
#set($query = $services.query.hql(", BaseObject obj, StringProperty prop where obj.name = doc.fullName and obj.className = 'XWiki.XWikiUsers' and prop.id.id = obj.id and prop.id.name = 'email' and LOWER(prop.value) = :email").bindValue('email', $email.toLowerCase())) |
|
#set($results = $query.execute()) |
|
## If local user does not exist check global user |
|
#if($results.size() == 0 && ${xcontext.database} != ${xcontext.mainWikiName}) |
|
#set($results = $query.setWiki("${xcontext.mainWikiName}").execute()) |
|
#end |
|
#set ($emailError = false) |
|
#if($results.size() != 0) |
|
## Send the email |
|
#set ($from = $services.mail.sender.configuration.fromAddress) |
|
#if ("$!from" == '') |
|
#set ($from = "no-reply@${request.serverName}") |
|
#end |
|
## The mail template use $usernames to display the results. |
|
#set ($usernames = $results) |
|
#set ($mailTemplateReference = $services.model.createDocumentReference('', 'XWiki', 'ForgotUsernameMailContent')) |
|
#set ($mailParameters = {'from' : $from, 'to' : $email, 'language' : $xcontext.locale}) |
|
#set ($message = $services.mail.sender.createMessage('template', $mailTemplateReference, $mailParameters)) |
|
#set ($discard = $message.setType('Forgot Username')) |
|
#macro (displayError $text) |
|
|
|
{{html}} |
|
<div class="xwikirenderingerror" title="Click to get more details about the error" style="cursor: pointer;"> |
|
$services.localization.render('xe.admin.forgotUsername.error.emailFailed') |
|
</div> |
|
<div class="xwikirenderingerrordescription hidden"> |
|
<pre>${text}</pre> |
|
</div> |
|
{{/html}} |
|
|
|
#set ($emailError = true) |
|
#end |
|
## Check for an error constructing the message! |
|
#if ($services.mail.sender.lastError) |
|
#displayError($exceptiontool.getStackTrace($services.mail.sender.lastError)) |
|
#else |
|
## Send the message and wait for it to be sent or for any error to be raised. |
|
#set ($mailResult = $services.mail.sender.send([$message], 'database')) |
|
## Check for errors during the send |
|
#if ($services.mail.sender.lastError) |
|
#displayError($exceptiontool.getStackTrace($services.mail.sender.lastError)) |
|
#else |
|
#set ($failedMailStatuses = $mailResult.statusResult.getAllErrors()) |
|
#if ($failedMailStatuses.hasNext()) |
|
#set ($mailStatus = $failedMailStatuses.next()) |
|
#displayError($mailStatus.errorDescription) |
|
#end |
|
#end |
|
#end |
|
#end |
|
## We always display a success message even if there's no user found to avoid disclosing information |
|
## about the users registered on the wiki. |
|
#if (!$emailError) |
|
{{success}} |
|
$services.localization.render('xe.admin.forgotUsername.emailSent', ["$email"]) |
|
|
|
{{html}} |
|
<div> |
|
<a href="$xwiki.getURL('XWiki.XWikiLogin', 'login')">$services.localization.render('xe.admin.forgotUsername.login')</a> |
|
</div> |
|
{{/html}} |
|
|
|
{{/success}} |
|
#end |
|
#end |
|
{{/velocity}}</content> |
Impact
It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tight to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests.
Patches
This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided:
Workarounds
It's possible to fix the problem without uprading by editing the ForgotUsername page in version below 13.x, to use the following code:
xwiki-platform/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml
Lines 39 to 123 in 69548c0
In version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really encouraged to upgrade the version here.
References
For more information
If you have any questions or comments about this advisory: