3 ms·
Reminds me of a bug where you could brute force an account by putting an array of passwords in the login form. It was some junky web interface to a spam applia
by bluedino 3y ago
Reminds me of a bug where you could brute force an account by putting an array of passwords in the login form.
It was some junky web interface to a spam appliance of all things, I'm not sure if it was intentional, or just some php rookie wrote the code.
One of our users discovered it when they had a (rare at the time) special character in their password.
- PufPufPuf 3y agoRuby on Rails accepts arrays as parameters to the ORM's ".where(...)", which means "OR" between the array values. So if the code does something like "User.where(name: name, password: password)", I could totally see this happening.