I found an interesting security bug today in some code at a client's site. (And unlike some other security holes, this was is real.) The problem was that the logon system was letting people in if they had an invalid logon. Users were correctly blocked at first, but as soon as they had an invalid logon, and then reloaded, they were let in. Why? Consider this code and make a guess before I show the answer:
<CFIF NOT ISDefined("Session.ProLoginOK")>
<CFLOCATION URL="login/login.cfm" ADDTOKEN="No">
<CFELSEIF Session.ProLoginOK IS "">
<CFLOCATION URL="login/login.cfm" ADDTOKEN="No">
</CFIF>
Figured it out? On an invalid login, the code set session.prologinok to "No". Since "No" defined the variable, and wasn't "", there was no forced logon template run.
Something to watch out for in your own code!
Archived Comments
Without not wishing to to be pedantic should the client not use 'structKeyExists'?
I am a late convert to SKE over isDefined. You will see most of my code (from my downloads) uses isDefined. I'm not trying to use SKE instead. In this case though I just fixed the client security problem.
Where does Session.ProLoginOk get set to 'No'? And how does it set the variable?
It was set in the validation. I assume the client was using it as a flag to show a msg ("Your logon was sucky...").
Oh - and I don't want to paste any more code from the client since - well, it's not my code. :)
Looks like Ray Horn has found some other security holes, oh and it looks like he sold "his" blog software for $1.5million! LOL...Funniest. Thing. Eva.
http://rayhorn.contentopia....
One note on that. While his first point is just.... wrong, his second point is almost right. I'm going to remove the email address when comments are sent out.
Security Issue?
Shouldn't that have been tested some how early in the development phases?
Jhey - of course. This was code definitely -not- written by myself or my company.
Lol .. I ran into one of these myself when a client clicked and it automatically logged him in during testing.
I learned my lesson!
As a side note - I just went to rabid lunatics site - wow ! - a true disgrace to web design. THIS IS A READ ONLY BLOG. Just laughable .. Im going to wash my hands now, I think I got some crap on my fingers just by clicking around.