Password Recovery CAPTCHA

[DawPi]

A bug has been discovered that will allow any input into the image verification (CAPTCHA) when using the password recovery form.

Bug powodujący możliwość odzyskania poprzez wpisanie jakichkolwiek znaków z grafiki CAPTCHA.

By to naprawić otwórz plik: sources/action_public/register.php

Znajdź:

if ($validate['lost_pass'] != 1)
			{
				$this->ipsclass->Error( array( 'LEVEL' => 1, 'MSG' => 'lp_no_pass' ) );
			}

			//-----------------------------------------
			// Test GD image
			//-----------------------------------------

			if ( $this->ipsclass->vars['bot_antispam'] != 0 AND $this->ipsclass->input['regid'] != "" )
			{
				$this->ipsclass->DB->simple_construct( array( 'select' => '*',
															  'from'   => 'reg_antispam',
															  'where'  => "regid='".trim($this->ipsclass->txt_alphanumerical_clean($this->ipsclass->input['regid']))."'"
													 )	  );

Zamień na:

if ($validate['lost_pass'] != 1)
			{
				$this->ipsclass->Error( array( 'LEVEL' => 1, 'MSG' => 'lp_no_pass' ) );
			}

			//-----------------------------------------
			// Test GD image
			//-----------------------------------------

			if ( $this->ipsclass->vars['bot_antispam'] )
			{

				if( $this->ipsclass->input['regid'] == '' )
				{
					$this->show_manual_form( 'lostpass', 'err_reg_code' );
					return;
				}

				$this->ipsclass->DB->simple_construct( array( 'select' => '*',
															  'from'   => 'reg_antispam',
															  'where'  => "regid='".trim($this->ipsclass->txt_alphanumerical_clean($this->ipsclass->input['regid']))."'"
													 )	  );

Zapisz i wyślij.