View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0016142 | mantisbt | other | public | 2013-07-04 17:09 | 2013-07-17 07:48 |
Reporter | Quix0r | Assigned To | atrol | ||
Priority | normal | Severity | minor | Reproducibility | always |
Status | closed | Resolution | no change required | ||
Platform | Debian | OS | Linux | OS Version | 2.6.38.4 |
Product Version | 1.2.15 | ||||
Summary | 0016142: User registration accepts empty user name and/or email address | ||||
Description | I got an email from bug tracker with empty username and email address: The following account has been created: Username: Do not reply to this messageI would like to see that registration attempts with one of the two required fields empty should be rejected. $g_allow_blank_email has not been touched in all configuration files (including config_inc.php). | ||||
Tags | No tags attached. | ||||
Quix0r, I was not able to reproduce your problem with a fresh install of the latest stable version of MantisBT (1.2.15 at the moment). Please provide detailed, step-by-step instructions to reproduce the issue. Additional information listed below may also be useful:
|
|
Maybe you changed setting $g_display_errors in a not recommended way |
|
To answer your question and requests: 1) php --version:PHP 5.4.4-14+deb7u2 (cli) (built: Jun 5 2013 07:56:44)
|
|
I have now set the "users" access level to "viewer" and protected it from any changes so that it cannot be used and/or modified. |
|
I have no idea at the moment what is happening.
At line 307 we trigger an error if the user name is invalid I see no way how to register a user without a name. Did you have a look at the error logs of web server, PHP and database? Do you get other errors when working with MantisBT? |
|
Did you trim $p_username and $p_email (I presume?) with e.g.: // Make sure trailing/leading or all-spaces are trimmed away: |
|
trim is used in is_blank checking Please answer also my questions. |
|
Ah, okay. :) I have only set the above variables in config_inc.php, nothing is touched in config_defaults_inc.php. In error logs I only found one: [Wed Jul 03 xx:xx:xx 2013] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/.../htdocs/http:I can enter an issue without filling out summery line. |
|
If you need my php.ini (not regular settings) I can upload it here. But then this ticket should be better marked as private. |
|
Check your settings of error_reporting in php.ini |
|
The php.ini says: error_reporting = E_ALL | E_STRICT | E_DEPRECATED |
|
Add the following line Do you get the "Detected ...." message when trying to signup with an empty user name? |
|
Yes, it is being displayed. |
|
I must have been blind and you did not read what I wrote at 0016142:0037385
Probably you did: I looked for something like Remove the line |
|
"The username is invalid. Usernames may only contain Latin letters, numbers, spaces, hyphens, dots, plus signs and underscores." Also working (tried to report empty issue): "A necessary field "Summary" was empty. Please recheck your inputs." Seems to work again. Thank you for your help. :) |
|