Update user object before attempting sign-in.

This prevents leaking of user account phone number on a failed login attempt.
mysociety · Sep 6, 2018 · aaa0887 · aaa0887
1 parent 80cf37e
commit aaa0887
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,9 @@
 ## Releases
 
-* Unreleased
+* v2.3.5 (6th September 2018)
+    - Security:
+        - Update user object before attempting sign-in,
+          to prevent leak of user account phone number.
 
 * v2.3.4 (7th June 2018)
     - Bugfixes:

diff --git a/perllib/FixMyStreet/App/Controller/Report/New.pm b/perllib/FixMyStreet/App/Controller/Report/New.pm
@@ -805,6 +805,8 @@ sub process_user : Private {
 
     $c->stash->{phone_may_be_mobile} = $type eq 'phone' && $parsed->{may_be_mobile};
 
+    $c->forward('update_user', [ \%params ]);
+
     # The user is trying to sign in. We only care about username from the params.
     if ( $c->get_param('submit_sign_in') || $c->get_param('password_sign_in') ) {
         $c->stash->{tfa_data} = {
@@ -825,7 +827,6 @@ sub process_user : Private {
         return 1;
     }
 
-    $c->forward('update_user', [ \%params ]);
     if ($params{password_register}) {
         $c->forward('/auth/test_password', [ $params{password_register} ]);
         $report->user->password($params{password_register});