3 ms·
Website is broken. I clicked register without putting anything into the fields, and I got a registered account with no user name and password. Now if you click
by abatilo 7y ago
Website is broken. I clicked register without putting anything into the fields, and I got a registered account with no user name and password. Now if you click login without anything put in, you get logged in to my account, and if I comment, the username is blank.
- thegurus 7y agoThank you for discovering this bug! We are (hot)fixing it. Had to delete your user though, please sign up again (with a normal username if possible :-D).
- underlines 7y agoDefine normal :) i now own the user " " with the password " " you might add trimming special characters and whitespace.
- thegurus 7y agohahaha you're right! we've just setup the ^[a-zA-Z0-9_.-]+$ regex for both username and password. Thanks for the pen-testing
- tomsmeding 7y agoDo you really want that regex for passwords also? Am I not allowed to put interesting characters in my password?
- bonyt 7y agoNot sure this is ideal either, it rejected the first password my password manager generated. Password should probably just be anything other than all whitespace, no? Maybe a length requirement.
- thegurus 7y agoSorry guys, do you like ^[A-Za-z0-9@#$%^&+=]+$ for your passwords?
- BlackLotus89 7y agoYou should not regex check your passwords at all. Just check !="" and maybe check the length There is no reason why you should limit symbols for passwords.
- jnbiche 7y agoThis times 1000. Why would you regex check your password? Check for empty string and length and be done with it.
- thegurus 7y agoYou are right. Django default auth backend handles this perfectly, but we wanted that functionality of login + signup in the same form, and that signup autofill in case login fail, so made our custom auth views and screw up some things (like username and password validation and going back to previous page after login)