Name Sync displays the last name received

[bstats]

Name Sync used to display only the first name/sub/email in the API response for a post. Now it only displays the last name/sub/email.

This allows malicious users to change the name/sub/email of any post simply by sending another request to sp.php.

Possible solutions:

• Have the server only allow one name/sub/email per post # (make the p column unique)
• Have the script disregard all but the first name/trip/sub/email that it receives from qp.php

[milkytiptoe]

Should be fixed.