PDA

View Full Version : [fixed] Email a Page - Unregistered Users can appear to spoof Registered users


theflow
Mon 10th Sep '01, 11:55pm
This seems to be a problem, albeit a minor one.

If I am logged out, and I am browsing a thread, and I click "send email to friend", the username appears with the value "Unregistered" filled in. If I erase that and enter a username, such as theflow (or tubedogg or any registered name), and not enter any password, when I submit, the email gets sent with no error message.

By contrast, under similar conditions, in a forum that allows unregistered users to post messages, if a user in unregistered and hits "Reply", they get a username and password field to fill in. If they (intentionally or inadvertantly) enter a name of a Registered user, but they leave the password field blank, when they submit, they get an error message that says "you've entered the wrong password".

At the very least, this is inconsistent behavior. But to be clear, I checked, and even though I could "email a friend" using another person's Screen name and no password, in the email received by "friend", the username shows up within the email message as "Unregistered"

theflow
Fri 14th Sep '01, 3:54pm
Can someone at vB check this out please?

JamesUS
Fri 14th Sep '01, 5:23pm
Hmmm it seems you're right. Will move over to the bugs forum now.