[Oblivion Knight]

Originally Posted by Pseudomizer

I found out how they bypass our check for userid. They open 2 windows as a user who is not attending the event and sees the link "i want to attend to this event". Then he goes to the second window and logs out of the forum. The cookie is cleared. Then he goes back and clicks the link in the first window which is still there and oleeeeeeeee oleeeeeeeeee you have the user "unregistered user" attend the event. :-(

I also experienced this issue recently, I did the following..

In calendar.php, find:

	if ($_REQUEST['do'] == "attend")
	{
		$roll[$bbuserinfo['userid']] = $bbuserinfo['username'];	
	}
	else
	{
		unset($roll[$bbuserinfo['userid']]);	
	}

Replace it with:

	if ($_REQUEST['do'] == "attend")
	{
		if ($bbuserinfo[userid])
		{
			$roll[$bbuserinfo['userid']] = $bbuserinfo['username'];
		} else {
			print_no_permission();
		}	
	}
	else
	{
		if ($bbuserinfo[userid])
		{
			unset($roll[$bbuserinfo['userid']]);
		} else {
			print_no_permission();
		}	
	}

It seems to have worked, as I can no longer replicate the bug..


P.S This mod works flawlessly in 3.0.5.