[FIXED][3] BUG vB2.2.9 - Bypassing Registration Adult/Coppa

[nuno]

Procedure:
1- Under CP » vBulletin Options » [User and registration options] » Use COPPA Registration system » Set it to Yes
2- Logout
3- Go to register.php and select After 12-04-1989
4- Copy link location
5- Log In
6- Go to CP again and set COPPA Registration system to No
7- Logout
8- Paste copied link into address bar
9- Hit Agree
10- Fill in your details and you got yourself a COPPA User.

[Scott MacVicar]

Originally posted by nuno
Procedure:
1- Under CP » vBulletin Options » [User and registration options] » Use COPPA Registration system » Set it to Yes
2- Logout
3- Go to register.php and select After 12-04-1989
4- Copy link location
5- Log In
6- Go to CP again and set COPPA Registration system to No
7- Logout
8- Paste copied link into address bar
9- Hit Agree
10- Fill in your details and you got yourself a COPPA User. Since COPPA users have restricted permissions this would be pretty useless.

[nuno]

So?
It's still a bug aint it? :confused:

[Chen]

Originally posted by nuno
So?
It's still a bug aint it? :confused: Yes, and it will not be overlooked. Moving to bugs...

[nuno]

Oh, ok. :(
Thanks anyways.

[Scott MacVicar]

Ok, I'm just in the process of sorting through the bugs forum, and I'm unable to reproduce this. I tried to reproduce this using your explanation.

I get the url which was
http://localhost/vb2/register.php?action=signup&who=coppa&url=http%3A%2F%2Flocalhost%2Fvb2%2Fusercp.php%3Fs% 3D694c24664589033c43e82b3b18c3d404

I then go into my acp and turn it off, logout and paste that in. I then go through the whole registration process but i get the regular register screen.

[Mystics]

It doesn't work if you just copy the URL ("4- Copy link location"), because of this code in the "signup"-function of register.php: if (!$usecoppa) {
$who="adult";
}It only works, if you are still on the screen with the Board COPPA Policy, while you deactivate the COPPA system. If you then click on Agree, you will get the COPPA register form. I think, nuno had this screen (with the Agree-Button) in his cache, and therefore it worked for him with just copying the URL.

Fix for the bug:

In register.php, find: if ($who=="adult") {
eval("dooutput(\"".gettemplate("registeradult")."\");");
} else {
eval("dooutput(\"".gettemplate("registercoppa")."\");");
}Insert above it: if (!$usecoppa) {
$who="adult";
}Mystics

[nuno]

Yup, Mystics got it right. :)

[Scott MacVicar]

Originally posted by nuno
Yup, Mystics got it right. :) still a bug that is very unlikely to exist in normal usage unless someone goes out of their way to intentionally do it.

[Kaizen]

still a bug that is very unlikely to exist in normal usage unless someone goes out of their way to intentionally do it.

nuno:rolleyes::)