3s3s / opentrade

OpenTrade - Open Source Cryptocurrency Exchange
MIT License
399 stars 400 forks source link

Prevent successful validation Pin with a specially crafted Post-request #352

Closed wwwcase closed 4 years ago

wwwcase commented 4 years ago

undefined != undefined is false !!!! in login.js exports.VerifyPin = function(req, res) { var queryData = url.parse(req.url, true).query; if (!req.body || !req.body['pin'] || !req.body['pin'].length || !queryData.user || !emailChecker[queryData.user] ) return LoginError(req, res, 'ERROR: Bad PIN!');

const check = emailChecker[queryData.user];
delete emailChecker[queryData.user]; //if (check.pin != req.body['pin']) // not properly if ( !check.pin || !req.body['pin'] || (check.pin != req.body['pin']) ) // correctly return LoginError(req, res, 'ERROR: Not verified!');

Login(req, res, check.info); }