HCS forums and tracker closing... by hcs at 1:38 AM EDT on August 26, 2011
....just kidding....
HCS, might you bother "fixing" this potential issue, despite no one "exploiting" it in the 6 or so years this forum has been running?
by hcs at 1:48 AM EDT on August 26, 2011
In the tradition of Ender's Game, spaces are fair game.
by hcs at 1:50 AM EDT on August 26, 2011
I still need to read the Ender's Game sometime.
by iloveyou at 7:50 AM EDT on August 26, 2011
HCS forums and tracker closing...
OMG ~ ....just kidding....^____^
by hc s at 10:44 AM EDT on August 26, 2011
Oh wow, is this really the exploit?

Edit: Nope dammit, hi guys.

edited 10:44 AM EDT August 26, 2011

Info for user " hcs":

Joined: August 26, 2011
Posts: 2, last posted August 26, 2011 1:50 AM EDT
oooooooooh I see.

edited 10:45 AM EDT August 26, 2011
by Yoshinkeru at 1:47 PM EDT on August 26, 2011
HA! You can't fool me, userid 873! userid 1 is the REAL hcs! >;D
by Hotcakes at 10:18 PM EDT on August 26, 2011
I'm seeing double! FOUR Krustys!
by Captain Ron at 10:46 PM EDT on August 26, 2011
I see what's going on here... I might be able to create the fix & submit it here. Here's the information on this:

[url=http://php.net/manual/en/function.trim.php]http://php.net/manual/en/function.trim.php[/usl]

Of course, this will make user names like mine (containing spaces) a thing of the past & would require underscores instead.

EDIT: Alright. I'm not sure if this will work, but here's my edit. I hope it can be implemented properly, hcs (I'm talking to the real hcs, not the impostor).

In the account registration form (starting from line 412 of the forum source, provided on this site):

<form action="<?php echo $my_path;?>?adduser2" method="POST">
<table>
<tr><td>User Name: <td><input type="text" name="uname" maxlength="31"></tr>
<tr><td>Password: <td><input type="password" name="pass" maxlength="31"></tr>
<tr><td>Verify Password: <td><input type="password" name="vpass" maxlength="31"></tr>
<tr><td align="center" colspan="2"><br><br>Please note that passwords are stored and transmitted unencrypted,<br>so don't use anything sensitive.
<br><br><input type="submit" value="Submit"></tr></table>

</form>
<?php

} else if (isset($_GET[adduser2])) {
// **** Add a user to the database

pageheader();

// check if user already exists
$query = mysqli_prepare($dbh,"SELECT idx FROM users WHERE uname = ?");
mysqli_stmt_bind_param($query,'s',$_POST[uname]);
mysqli_stmt_execute($query) or die (mysql_error($dbh));
mysqli_stmt_store_result($query);
$results = mysqli_stmt_num_rows($query);
mysqli_stmt_close($query);


Make the following changes:

<form action="<?php echo $my_path;?>?adduser2" method="POST">
<table>
<tr><td>User Name: <td><input type="text" name="regname" maxlength="31"></tr>
<tr><td>Password: <td><input type="password" name="pass" maxlength="31"></tr>
<tr><td>Verify Password: <td><input type="password" name="vpass" maxlength="31"></tr>
<tr><td align="center" colspan="2"><br><br>Please note that passwords are stored and transmitted unencrypted,<br>so don't use anything sensitive.
<br><br><input type="submit" value="Submit"></tr></table>

</form>
<?php

} else if (isset($_GET[adduser2])) {
// **** Add a user to the database

pageheader();

// check if user already exists
$uname = trim($regname);
$query = mysqli_prepare($dbh,"SELECT idx FROM users WHERE uname = ?");
mysqli_stmt_bind_param($query,'s',$_POST[uname]);
mysqli_stmt_execute($query) or die (mysql_error($dbh));
mysqli_stmt_store_result($query);
$results = mysqli_stmt_num_rows($query);
mysqli_stmt_close($query);


The edit should take the user's provided name, pass it to the variable "regname" & trim all breaking/non-breaking spaces from the beginning & end of the string. The result is then passed to the "uname" variable before being compared to any existing user in the database. This, at least, is how it's intended to work. I'll test it soon & report back (unless someone else will).

edited 12:06 AM EDT August 27, 2011
by hcs at 12:08 AM EDT on August 27, 2011
It should work fine with your name, trim only removes leading and trailing spaces.
There's nothing to prevent people from using invisible unicode, though.
It really doesn't bother me.


Go to Page 0

Search this thread

Show all threads

Reply to this thread:

User Name Tags:

bold: [b]bold[/b]
italics: [i]italics[/i]
emphasis: [em]emphasis[/em]
underline: [u]underline[/u]
small: [small]small[/small]
Link: [url=http://www.google.com]Link[/url]

[img=https://www.hcs64.com/images/mm1.png]
Password
Subject
Message

HCS Forum Index
Halley's Comet Software
forum source