Author Topic: Bug in mail validation for email changers <-> forgotten password  (Read 3741 times)

Nightborn

  • Administrator
  • Sr. Member
  • *****
  • Posts: 320
  • Karma: +20/-0
    • View Profile
    • Shinobilegends
Okay, I overlooked something.


When you have the setup:

email necessary
email needs validation
you let players change the email
and require validation
and sent to the OLD account email OR the NEW account email

then you can bypass the validation which needs to be clicked on in the mail by simply requesting a forgotten password. that will overwrite the email request ID and you can basically do the following:

capture a password
get into an account, request a change of email
change the password

then ONCE the old old owner cannot get in, requests a forgotten password
CLICKS the link --> he changes the email address to the new, fraudulent one.

I have fixed this, but you need to copy the files:

create.php
prefs.php

from the now updated archive to your version

AND

generate a new field in the accounts table:

name: forgottenpassword
type: varchar(32)
default: ''

or else you'll get error messages.
It should be fixed, but it won't be easy and it won't be fast. If you want
to help - wonderful. But keep in mind that it will take months of wading
through the ugliest code we have in the tree. If you've got a weak stomach -
stay out. I've been there and it's not a nice place.

   - Al Viro

Nightborn

  • Administrator
  • Sr. Member
  • *****
  • Posts: 320
  • Karma: +20/-0
    • View Profile
    • Shinobilegends
Re: Bug in mail validation for email changers <-> forgotten password
« Reply #1 on: July 13, 2008, 07:00:43 am »
Please download anew and replace the dragon.php

 ::) if you do a DK, the email request field gets reset ... I forgot to include it there...

not that this also affects the circulum vitae, you need to make the two new fields persistent in the CV editor.
It should be fixed, but it won't be easy and it won't be fast. If you want
to help - wonderful. But keep in mind that it will take months of wading
through the ugliest code we have in the tree. If you've got a weak stomach -
stay out. I've been there and it's not a nice place.

   - Al Viro