Input Cleaning

[Kirk Y]

Okay, somebody save me from myself. I can't get my request to clean.

$pw = $vbulletin->userinfo[password];
$string = md5($pw);
$h =& $vbulletin->input->clean_gpc('r', 'h', TYPE_UINT);

if ($_REQUEST['do'] == 'unsub')
{
   if (md5($h) === $string)
   {
       echo 'correct';
   }
   else
   {
       echo 'incorrect';
   }
}

Now, if I go ahead and just use $_GET instead of cleaning, it works fine -- but it fails if I try to use the cleaned var. What am I missing here?

[Code Monkey]

PHP Code:

$pw = $vbulletin->userinfo[password];
$string = md5($pw);
$vbulletin->input->clean_array_gpc('r', array(
    'h' => TYPE_UINT
));

if ($_REQUEST['do'] == 'unsub')
{
    echo (md5($vbulletin->GPC['h']) === $string) ? 'correct' : 'incorrect';
} 


[Kirk Y]

Still fails incorrect. That's alright though, I'm just going to use $_GET -- it never touches SQL, so I don't see how it could be exploited.

[harmor19]

Why are are seeing if the hash is an integer? Shouldn't it be TYPE_STR?

PHP Code:

$pw = $vbulletin->userinfo[password];
$string = md5($pw);
$vbulletin->input->clean_array_gpc('r', array(
    'h' => TYPE_STR
));

if ($_REQUEST['do'] == 'unsub')
{
    echo (md5($vbulletin->GPC['h']) === $string) ? 'correct' : 'incorrect';
} 


[Kirk Y]

Ha ha... wow. Thanks Harmor, I'm feeling a wee bit stupid.

[harmor19]

Originally Posted by acidburn0520

Ha ha... wow. Thanks Harmor, I'm feeling a wee bit stupid.

Everybody has one of those days.
I gave you the idea and I fixed your code.
I want some credit


j/k
Good luck on your hack

[Kirk Y]

Ha ha, well I reminded you of your missing table prefixes!

Don't worry, I'll mention ya.

(small print though)

[Code Monkey]

There was more wrong than just that.

[Kirk Y]

What else is wrong? Because it's working fine now after changing the type.

[harmor19]

We love seeing you make an ass out of yourself.