search

fausecteam / ctf-gameserver

FAUST Gameserver for attack-defense CTFs
https://ctf-gameserver.org
ISC License
61 stars 27 forks source link

Web: Editing a team removes its password #11

Closed F30 closed 3 years ago

F30 commented 6 years ago

When editing a team after initial registration, the password (and confirmation) field may be empty. In that case, the existing password should be kept. However, the password gets set to an empty one instead and teams can't log in afterwards.

I first noticed this at FAUST CTF 2018, but from looking at the code, I'd say it's always been this way.

F30 commented 6 years ago

OK, apparently you can't even trigger password reset if your password was lost this way :-(.