php forum
php mysql forum
php mysql smarty
 
Topic Options
#37174 - 03/31/00 11:31 AM Email Password Hack
Parker Clack Offline
Member

Registered: 01/11/00
Posts: 98
Loc: Midwest Missouri

   Email Password Hack to Del.icio.us Add to del.icio.us
  Digg Email Password Hack Digg it
Some of the people that sign up on our board know that they can click on the "Forgot your password?" link and have their password emailed to them.

We check all registrations to our board as we require the use of real names instead of handles. We do not send them a password until we check out the username they sign up with.

Some people know that after they register they can go to the link to have their password emailed to them even though they might not have their username accepted.

So to get around this I have added the following code:

In Ubbmisc.cgi

Look for:

sub PWRequest {
# Find the right registration
&GetMemberListArray;
&GetEmails; # returns @EmailList array
$Found = "";

#lowercase the email input
$sendto = lc($in{'sendto'});
$CountIt = 0;
foreach $emailline(@EmailList) {
($theemail, $thenumber) = split(/??/, $emailline);
$theemail = lc("$theemail");

if ($theemail eq "$sendto") {
chomp($thenumber);
@thisprofile = &OpenProfile("$thenumber.cgi");
$YourName = "$thisprofile[0]";
$YourPassword = "$thisprofile[1]";
$CountIt = $CountIt + 1;
$Found = "yes";
}
}

if ($CountIt >= 2) {
&StandardHTML("<center>Sorry, we cannot process your request because more than one person is using that email address.</center>");
exit;
}

and replace it with:

sub PWRequest {
# Find the right registration
&GetMemberListArray;
&GetEmails; # returns @EmailList array
$Found = "";

#lowercase the email input
$sendto = lc($in{'sendto'});
$CountIt = 0;
foreach $emailline(@EmailList) {
($theemail, $thenumber) = split(/??/, $emailline);
$theemail = lc("$theemail");

if ($theemail eq "$sendto") {
chomp($thenumber);
@thisprofile = &OpenProfile("$thenumber.cgi");
$YourName = "$thisprofile[0]";
$YourPassword = "$thisprofile[1]";
$MessageCount = "$thisprofile[7]";
$CountIt = $CountIt + 1;
$Found = "yes";
}
}

if ($CountIt >= 2) {
&StandardHTML("<center>Sorry, we cannot process your request because more than one person is using that email address.</center>");
exit;
}

if ($MessageCount <=0) {
&StandardHTML("<center>Sorry, we cannot process your request because you have not posted a message yet!</center>");
exit;
}


The italisized lines being the ones to add to the original code.

Parker

Top


Top Posters Last 30 Days
AllenAyres 20
Gizmo 10
blaaskaak 2
S7ARBVCK 2
Iann128 1
Claus1 1
M4D 1
Who's Online
2 Registered (blaaskaak, GEN), 25 Guests and 7 Spiders online.
Key: Admin, Global Mod, Mod
Shout Box

Latest Posts
Security Patch released for all 7.x versions
by AllenAyres
Yesterday at 08:00 PM
What do you use to edit the files
by AllenAyres
Yesterday at 07:54 PM
Team UBBDev Rides Again!
by AllenAyres
Yesterday at 07:32 PM
Here I am! Rock me like a Hurricane!
by AllenAyres
Yesterday at 07:20 PM
BeyondCompare v3.00
by AllenAyres
Yesterday at 07:16 PM
[7.3.1] add search to showmembers page
by AllenAyres
Yesterday at 07:13 PM
Noob - need help, or a reality check!
by Gizmo
09/04/08 03:21 AM
New Mods
[7.3.1] add search to showmembers page
by blaaskaak
Yesterday at 04:50 AM
Installing FlashChat with 7.3
by Paug
08/23/08 12:14 AM
[7.3.x] ubb.links
by AllenAyres
06/20/08 11:50 PM
[7.2.1] - Naked shoutbox
by sirdude
08/17/07 10:36 PM
[7.x] Generic Page Outside of forum directory
by
01/14/07 10:58 PM
Newest Members
veedubb8, twentyseven, Claus1, welcomeback1, Paug
13327 Registered Users

 

 

 
fusionbb message board php hacks