Reset password token is invalid

[SippieCup]

Ombi build Version:

V 3.0.2564

Update Branch:

Open Beta

Media Sever:

Plex

Media Server Version:

n/a

Operating System:

Ubuntu 17.10 Server

Ombi Applicable Logs (from /logs/ directory or the Admin page):

No logs applicable - no errrors thrown

Problem Description:

If someone requests a password reset, the token attached is invalid and they cannot reset the password

Reproduction Steps:

1. Request password reset
2. click link in email
3. try to reset password.

[tidusjar]

There is a time limit on the token, how long passed between requesting and trying to reset?

…

On Sat, 6 Jan 2018, 9:53 pm Andrew Sidhu, ***@***.***> wrote: Ombi build Version: V 3.0.2564 Update Branch: Open Beta Media Sever: Plex Media Server Version: n/a Operating System: Ubuntu 17.10 Server Ombi Applicable Logs (from /logs/ directory or the Admin page): No logs applicable - no errrors thrown Problem Description: If someone requests a password reset, the token attached is invalid and they cannot reset the password Reproduction Steps: 1. Request password reset 2. click link in email 3. try to reset password. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1865>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGVaLCeV5JV0Q-Rp_tuAFP-viM9E7vqiks5tH-tzgaJpZM4RVc8b> .

[SippieCup]

Was able to find the reason for it.

Token is generated with unsafe characters for url encoding. When a user clicks on a link that has click tracking attached to it (gmail.com, outlook, etc), the tracking platform URI encodes the string.

Example with Gmail:

Original Token: CfDJ8PWHjo1K53RHhluejJ6wsMCaYpR+3ktLNLIU0YJOUNjhWsSw7BcThdpJuek+Zu5HhnwEPatRKDpkTkp0e4qeonktlJuuonQep1i3xifEKd1RqBBX3eckvyT5/FYtW9Hxs3Hj8rtbf3HYE5cx5dWwb9SUfgYejl7SPmHwLIEhOhqg1f276qkRR4A5RuFfeyasg/42aMUCMyqpUWXXF0sTJkh/dc2b2FcKWce7aeURGaSlGFD8IGmaYZ3JlVTZPY84JQ==

clicking the link in gmail has it go through the google click tracking url which encodes the url:
https://www.google.com/url?hl=en&q=http://example.com/requests/token?token%3DCfDJ8PWHjo1K53RHhluejJ6wsMCaYpR%2B3ktLNLIU0YJOUNjhWsSw7BcThdpJuek%2BZu5HhnwEPatRKDpkTkp0e4qeonktlJuuonQep1i3xifEKd1RqBBX3eckvyT5/FYtW9Hxs3Hj8rtbf3HYE5cx5dWwb9SUfgYejl7SPmHwLIEhOhqg1f276qkRR4A5RuFfeyasg/42aMUCMyqpUWXXF0sTJkh/dc2b2FcKWce7aeURGaSlGFD8IGmaYZ3JlVTZPY84JQ%3D%3D&source=gmail&ust=**snip**&usg=**snip**

As you can see, the == at the end is now encoded to %3D%3D.

now when the redirect finishes and takes you to the destination of the link, it doesn't unencode the token string.. so you end up with the token: CfDJ8PWHjo1K53RHhluejJ6wsMCaYpR%2B3ktLNLIU0YJOUNjhWsSw7BcThdpJuek%2BZu5HhnwEPatRKDpkTkp0e4qeonktlJuuonQep1i3xifEKd1RqBBX3eckvyT5/FYtW9Hxs3Hj8rtbf3HYE5cx5dWwb9SUfgYejl7SPmHwLIEhOhqg1f276qkRR4A5RuFfeyasg/42aMUCMyqpUWXXF0sTJkh/dc2b2FcKWce7aeURGaSlGFD8IGmaYZ3JlVTZPY84JQ%3D%3D

which is invalid.

Solutions:

1. Use safe URL encoding characters

or

2. Recursively decode the token string until there are no encoded characters. - Must be recursive because if it goes through multiple tracking urls before the destination, then it'll be encoded n number of times and decoded once, leading to an invalid token.

#1 is an easier solution IMO.