nemunaire/chldapasswd
1
0
Fork 0
Code Issues Pull requests Releases Activity

fix(security): add missing return after redirect in resetPassword handler

Browse source 
http.Redirect only sets response headers; without return, handler execution
continued with empty login/token strings, potentially causing unexpected
LDAP queries and information leakage.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
nemunaire 2026-03-06 14:40:45 +07:00
commit a2f368eb02
1 changed files with 1 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
reset.go
View file

@ -9,6 +9,7 @@ import (
func resetPassword(w http.ResponseWriter, r *http.Request) { func resetPassword(w http.ResponseWriter, r *http.Request) {
if len(r.URL.Query().Get("l")) == 0 || len(r.URL.Query().Get("t")) == 0 { if len(r.URL.Query().Get("l")) == 0 || len(r.URL.Query().Get("t")) == 0 {
http.Redirect(w, r, "lost", http.StatusFound) http.Redirect(w, r, "lost", http.StatusFound)
return
} }
base := map[string]interface{}{ base := map[string]interface{}{