| File inc/user.inc.php changed (mode: 100644) (index 9f33f58..c99646c) |
| ... |
... |
function rg_user_edit_high_level($db, &$rg) |
| 1999 |
1999 |
} |
} |
| 2000 |
2000 |
|
|
| 2001 |
2001 |
// We try to prevent bots to create accounts |
// We try to prevent bots to create accounts |
| 2002 |
|
$gen = rg_var_str('gen'); |
|
| 2003 |
|
if (empty($gen)) { |
|
| 2004 |
|
$diff = 0; |
|
| 2005 |
|
} else { |
|
| 2006 |
|
$xgen1 = substr($gen, 3); |
|
| 2007 |
|
$xgen2 = substr($gen, 0, 3); |
|
| 2008 |
|
$diff = ($gen1 - $xgen1) * 1000 + $gen2 - $xgen2; |
|
| 2009 |
|
} |
|
| 2010 |
|
if ($diff < 2000) { |
|
| 2011 |
|
rg_log('Bot tried to create account in ' . $diff . 'ms'); |
|
| 2012 |
|
$errmsg[] = 'invalid token; try again'; |
|
| 2013 |
|
break; |
|
|
2002 |
|
if ($rg['target_ui']['uid'] == 0) { |
|
2003 |
|
$gen = rg_var_str('gen'); |
|
2004 |
|
if (empty($gen)) { |
|
2005 |
|
$diff = 0; |
|
2006 |
|
} else { |
|
2007 |
|
$xgen1 = substr($gen, 3); |
|
2008 |
|
$xgen2 = substr($gen, 0, 3); |
|
2009 |
|
$diff = ($gen1 - $xgen1) * 1000 + $gen2 - $xgen2; |
|
2010 |
|
} |
|
2011 |
|
if ($diff < 2000) { |
|
2012 |
|
rg_log('Bot tried to create account in ' . $diff . 'ms'); |
|
2013 |
|
$errmsg[] = 'invalid token; try again'; |
|
2014 |
|
break; |
|
2015 |
|
} |
| 2014 |
2016 |
} |
} |
| 2015 |
2017 |
|
|
| 2016 |
2018 |
if ($ui['tos'] != 1) { |
if ($ui['tos'] != 1) { |
| File tests/http_create_account.php changed (mode: 100644) (index 422e31f..80e2fd1) |
| ... |
... |
if ($r === FALSE) { |
| 27 |
27 |
exit(1); |
exit(1); |
| 28 |
28 |
} |
} |
| 29 |
29 |
$good_token = $r['tokens']['user_edit_hl']; |
$good_token = $r['tokens']['user_edit_hl']; |
|
30 |
|
$gen = $r['inputs']['gen']; |
| 30 |
31 |
|
|
| 31 |
32 |
$uniq = rg_id(16); |
$uniq = rg_id(16); |
| 32 |
33 |
|
|
|
34 |
|
sleep(2); // bot protection |
| 33 |
35 |
rg_log('Adding an account without accepting tos...'); |
rg_log('Adding an account without accepting tos...'); |
| 34 |
36 |
$username = "http1-$uniq<xss>"; |
$username = "http1-$uniq<xss>"; |
| 35 |
37 |
$data = array( |
$data = array( |
| |
| ... |
... |
$data = array( |
| 42 |
44 |
"pass" => "cucurigu<xss>", |
"pass" => "cucurigu<xss>", |
| 43 |
45 |
"pass2" => "cucurigu<xss>", |
"pass2" => "cucurigu<xss>", |
| 44 |
46 |
"plan_id" => 9, |
"plan_id" => 9, |
| 45 |
|
"session_time" => 60 |
|
|
47 |
|
"session_time" => 60, |
|
48 |
|
'gen' => $gen |
| 46 |
49 |
); |
); |
| 47 |
50 |
$headers = array(); |
$headers = array(); |
| 48 |
51 |
$r = do_req($test_url . "/op/create_account?t=create_account", $data, $headers); |
$r = do_req($test_url . "/op/create_account?t=create_account", $data, $headers); |