Leahnaya/pokemon-showdown-client
1
0
Fork 0
mirror of https://github.com/smogon/pokemon-showdown-client.git synced 2026-08-28 06:01:11 -05:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Fix security vulnerability in register

Browse Source
This commit is contained in:
Guangcong Luo
2017-03-13 02:28:16 -04:00
parent dee5c3b311
commit a7b45d7430
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
lib/ntbb-session.lib.php
View File

@@ -636,6 +636,11 @@ class NTBBSession {
return false;
}
$res = $psdb->query("SELECT `userid` FROM `{$psdb->prefix}users` WHERE `userid` = ? LIMIT 1", [$user['userid']]);
if ($row = $psdb->fetch_assoc($res)) {
return false;
}
$psdb->query(
"INSERT INTO `{$psdb->prefix}users` (`userid`,`username`,`passwordhash`,`email`,`registertime`,`ip`) VALUES (?, ?, ?, ?, ?, ?)",
[$user['userid'], $user['username'], $user['passwordhash'], @$user['email'], $ctime, $this->getIp()]
@@ -646,8 +651,8 @@ class NTBBSession {
}
$user['usernum'] = $psdb->insert_id();
$user['loggedin'] = true;
$this->login($user['username'], $password);
if (!$curuser['loggedin']) return false;
return $user;
}