search

a6smile / editease

Automatically exported from code.google.com/p/editease
0 stars 0 forks source link

editEase logs in with any username/password! #22

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1. Normal installation
2. Changed the values of default user/password in config.php
3. tried to login

What is the expected output? What do you see instead?

A login deny action, instead it logged me in.

What version of the product are you using? On what operating system?

Windows XP 2P2, tested it on:
Chrome 13.0.782.215 m
FireFox 5.0

Please provide any additional information below.

I have integrated editEase on my site, done a normal installation, changed the 
paths config.php to reflect on my installation and changed the default values 
of user/password login, if you type the correct username and a false password 
it wont log you in, if you provide another username and any password it logs 
you in easily!

if it might help, i have also other jquery plugins on my page:
jquery-1.4.2.min.js
jquery.easing.1.3.min.js

Original issue reported on code.google.com by sub7...@gmail.com on 7 Sep 2011 at 11:56

GoogleCodeExporter commented 9 years ago 
AH!, had the same problem. Think I fixed it.

It's a setting with error reporting within the php.ini file of the php server.
So find your php.ini file on the server.

open in a text editor like notepad; find the line:

error_reporting = E_ALL 

change it to:

error_reporting = E_ALL & ~E_NOTICE

or for a production server:

error_reporting = E_ALL & ~E_DEPRECATED & ~E_NOTICE

either one will work.

Original comment by cub...@gmail.com on 16 Sep 2011 at 5:57

GoogleCodeExporter commented 9 years ago 
Thank  cub...@gmail.com

Do you have any idea how can I change the login method to make it through mysql 
authentication? or do you have any suggestions how i can improve the security 
of the script?

Original comment by sub7...@gmail.com on 18 Sep 2011 at 2:08