vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   Modification Requests/Questions (Unpaid) (https://vborg.vbsupport.ru/forumdisplay.php?f=112)
-   -   E-mail System Problem - Need Fix (https://vborg.vbsupport.ru/showthread.php?t=37260)

AntiOnline 04-10-2002 04:06 PM

E-mail System Problem - Need Fix
 
Greetings All:

I'm having problems creating a hotfix for this, very serious, problem that my users found with vb:

http://www.antionline.com/showthread...hreadid=222304

Eventually the VB Developers will have to come up with a perminant solution in future versions, but for now, I'm just looking for a quick way to fix the problem.

Any ideas?

Admin 04-10-2002 06:42 PM

I can't recreate this "bug" locally. Are you sure your settings are set up correctly and that your user really did what he claims he did? Can you exploit that bug here?

AntiOnline 04-10-2002 07:46 PM

Greetings:

I was able to recreate it on my board.

It seems that vb.org doesn't do checking of addresses change in the profile? Or do you?

AntiOnline 04-10-2002 07:53 PM

Greetings:

The problem, to put it more clearly is this:

If i change my e-mail address by updating my profile, the system changes my usergroup to "users awaiting e-mail confirmation" and sends a confirmation e-mail that has a link that needs to be clicked by the user to authenticate that he indeed has access to that e-mail account.

If, however, a user changes their e-mail address, waits to receive the confirmation e-mail, changes their e-mail address again, and THEN clicks the confirmation link, the system is basically confirming the second address, when it reality it should be confirming the first. (if that makes sense)

* jp@antionline.com

* i change the address to

* webmaster@antionline.com

* get my confirmation e-mail

* change my address to president@whitehouse.gov

* click on the link in the confirmation e-mail

* my now fully verified e-mail address on the system is president@whitehouse.gov

now the user can subscribe themselves to a thousand threads or so, and spam the living hell out of president@whitehouse.gov from our website. not good.

now, for a fix. what I think needs to happen, is that any user that's in the "users awaiting e-mail confirmation group" shouldn't be allowed to update their profile until they're out of that group
(aka by confirming their address). but, i'm not sure if that's the best fix, and if it is, i haven't found an easy way to do it yet.


thoughts, ideas?

hypedave 04-10-2002 09:56 PM

whoa im running vb 2.2.5 and just created that problem again,
umm this aint good at all.

Admin 04-11-2002 10:18 AM

I still can't recreate this bug on my unhacked local board.

Looking at the code this shouldn't happen:
Code:

  if ($verifyemail and $email!=$bbuserinfo['email'] and $bbuserinfo['usergroupid']==2 or $bbuserinfo['usergroupid']==3) {
    $newemailaddress=1;

[high]    // delete old activation id
    $DB_site->query("DELETE FROM useractivation WHERE userid='$bbuserinfo[userid]' AND type=0");[/high]

                // make random number
                mt_srand ((double) microtime() * 1000000);
    $activateid=mt_rand(0,100000000);

    //save to DB
                $DB_site->query("INSERT INTO useractivation VALUES (NULL,'$bbuserinfo[userid]','".time()."','$activateid',0)");

    $username=unhtmlspecialchars($bbuserinfo['username']);
    $userid=$bbuserinfo['userid'];

    eval("\$message = \"".gettemplate("email_activateaccount_change",1,0)."\";");
    eval("\$subject = \"".gettemplate("emailsubject_activateaccount_change",1,0)."\";");

    mail ($email,$subject,$message,"From: \"$bbtitle Mailer\" <$webmasteremail>");

    $bbuserinfo['usergroupid'] = 3;
  } else {
    $newemailaddress=0;
  }

See, it deletes the activation ID whenever you change your email address.


All times are GMT. The time now is 12:34 AM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01069 seconds
  • Memory Usage 1,726KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)bbcode_code_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (6)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 

Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete