diff options
| author | lantw44 <lantw44.bbs@sony.tfcis.org> | 2017-10-06 14:38:57 +0800 |
|---|---|---|
| committer | BBS Administrator <bbs@sony.tfcis.org> | 2017-10-06 14:41:34 +0800 |
| commit | edeb82f1498d84db238228ad80110e71df1c0cdd (patch) | |
| tree | c5a57014415f7cff8432d0499df9bb2c029fcb14 | |
| parent | 6c4c34eea5ee6c99feecd41e92f9998f1150713b (diff) | |
| download | sonybbs-edeb82f1498d84db238228ad80110e71df1c0cdd.tar.gz sonybbs-edeb82f1498d84db238228ad80110e71df1c0cdd.tar.zst sonybbs-edeb82f1498d84db238228ad80110e71df1c0cdd.zip | |
禁止非站務帳號用「顯示使用者資料」功能查看原始 ID
原本的版本非帳務帳號雖然不能進入編輯使用者資料的頁面，但因為原始 ID 在檢查
權限之前就已經顯示了，所以任何人都可以利用這個功能的漏洞偷看原始 ID。
| -rw-r--r-- | maple/ulist.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/maple/ulist.c b/maple/ulist.c index c55fd19..d72ad73 100644 --- a/maple/ulist.c +++ b/maple/ulist.c @@ -925,14 +925,15 @@ ulist_edit(xo) /* Thor: iuWdݤέקϥΪ */ char* userid=ulist_pool[xo->pos]->userid; char* realid=ulist_pool[xo->pos]->realid; char buf[80]; - if(strcmp(userid,realid)){ - sprintf(buf,"ID vG%s %s",realid,userid); - vmsg(buf); - } if (!HAS_PERM(PERM_ALLACCT) || acct_load(&acct, ulist_pool[xo->pos]->realid) < 0) return XO_NONE; + if (strcmp(userid, realid)){ + sprintf(buf, "ID vG%s %s", realid, userid); + vmsg(buf); + } + vs_bar("ϥΪ̳]w"); acct_setup(&acct, 1); return ulist_head(xo); |