Hi,
I told the developers about a security problem with pop_pword.asp via email while v3.3.02 was the current release but this hasn't been fixed in v3.3.03 so I'm posting some fixes for the problem here.
Change line #68 of pop_pword.asp:strRecipients = "" & rs("M_EMAIL")
Richard Kinser recommended adding the following to line #45 of pop_pword.asp:if not IsValidString(Request.Form("Name")) then
Err_Msg = Err_Msg & "<li> You may not use any of these chars in your username !#$%^&*()=+{}[]|\;:/?<,> </li>"
end if
and for good measure you might as well add:if not IsValidString(Request.Form("email")) then
Err_Msg = Err_Msg & "<li> You may not use any of these chars in your email address !#$%^&*()=+{}[]|\;:/?<,> </li>"
end if
Forum Locked
Topic Locked
Posted - 20 August 2001 : 16:23:31
