/ 
Jifty-0.90409
/ Jifty::Plugin::Authentication::Password::Action::GeneratePasswordToken
Security Advisories (1)
CPANSA-Jifty-2011-01 (2011-03-17)

The path as passed in the fragment request data structure was used verbatim in the dispatcher and other locations. This possibly allowed requests to walk around ACLs by requesting '/some/safe/place/../../../dangerous' as a fragment.

NAME

Jifty::Plugin::Authentication::PasswordAction::GeneratePasswordToken - generate password token

arguments

We need the email of the user we're fetching a token for, so we can return the salt.

take_action

Generate a token and throw it back to the browser. Also, return the user's password salt in $self->result->content.