search

FAForever / website

FAForever's Website
http://www.faforever.com
MIT License
21 stars 37 forks source link

/account/password/confirmReset has no validation on token/username #515

Closed fcaps closed 12 months ago

fcaps commented 12 months ago

this is how the url is actually called: /account/password/confirmReset?username=minion&token=xxx, but you can call it without the parameters and the form will still show up.

at least i would have the input validated/escaped and some warning showing that the link is not correct. (and not showing the form)

fcaps commented 12 months ago

@beckpaul i'll look for an option to let you "assign" issues, have to ask the admin for some kind of contributor role.