Leahnaya/pokemon-showdown-client
1
0
Fork 0
mirror of https://github.com/smogon/pokemon-showdown-client.git synced 2026-09-13 14:29:25 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Don't sign assertions for invalid usernames

Browse Source
This commit is contained in:
Cathy J. Fitzpatrick
2013-02-10 20:08:31 -07:00
parent a6b7ad5977
commit 2ff3957c3b
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
action.php
View File

@@ -109,8 +109,15 @@ foreach ($reqs as $reqData) {
$challengekeyid = !isset($reqData['challengekeyid']) ? -1 : intval($reqData['challengekeyid']);
$challenge = !isset($reqData['challenge']) ? '' : $reqData['challenge'];
header('Content-type: text/plain; charset=utf-8');
if (empty($reqData['userid'])) $userid = $curuser['userid'];
else $userid = $users->userid($reqData['userid']);
if (empty($reqData['userid'])) {
$userid = $curuser['userid'];
if ($userid === 'guest') {
// Special error message for this case.
die(';');
}
} else {
$userid = $users->userid($reqData['userid']);
}
$serverhostname = htmlspecialchars($serverhostname); // Protect against theoretical IE6 XSS
die($users->getAssertion($userid, $serverhostname, null, $challengekeyid, $challenge));
break;