CMS MADE SIMPLE FORGE

Frontend Users

 

[#12250] action.lostusername.php - Incorrect parameter handling, incorrect input fields

avatar
Created By: Lukas Blatter (nockenfell)
Date Submitted: Thu Jan 30 03:48:37 -0500 2020

Assigned To: Robert Campbell (calguy1000)
Version: 3.2
CMSMS Version: 2.2.13
Severity: Major
Resolution: None
State: Open
Summary:
action.lostusername.php - Incorrect parameter handling, incorrect input fields
Detailed Description:
The parameter for the default group ID is checked incorrectly. The function
cge_param::get_int() expects as third parameter an INT, an ARRAY is returned by
$this->GetDefaultGroups().

$gid = cge_param::get_int($params,'feu_gid',$this->GetDefaultGroups());

After fixing this line, the next problem is that the <input> fields has a
pattern="" Attribute. An empty pattern does not allow any input. -> Check if
there is a pattern before it is set in the input field.


History