View Issue Details

IDProjectCategoryView StatusLast Update
0016142mantisbtotherpublic2013-07-17 07:48
ReporterQuix0r Assigned Toatrol  
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionno change required 
PlatformDebianOSLinuxOS Version2.6.38.4
Product Version1.2.15 
Summary0016142: User registration accepts empty user name and/or email address
Description

I got an email from bug tracker with empty username and email address:


The following account has been created:

Username:
E-mail:
Remote IP address: xxx.xxx.xxx.xxx
http://bugs.my-site.exmaple

Do not reply to this message

I would like to see that registration attempts with one of the two required fields empty should be rejected. $g_allow_blank_email has not been touched in all configuration files (including config_inc.php).

TagsNo tags attached.

Relationships

related to 0012632 closeddregad Signup with empty username and e-mail is possible when display_errors[E_USER_ERROR] = 'inline' 
related to 0010966 closeddregad No Errors shown at all if error_reporting=0 configured at server 

Activities

atrol

atrol

2013-07-04 17:13

developer   ~0037384

Quix0r,

I was not able to reproduce your problem with a fresh install of the latest stable version of MantisBT (1.2.15 at the moment).

Please provide detailed, step-by-step instructions to reproduce the issue. Additional information listed below may also be useful:

  • Exact version of PHP, Database, Web server and Operating System
  • Relevant customizations (e.g. changes in config_inc.php, etc)
  • Installed plugins or custom functions ?
  • Was the MantisBT source code modified in any way ?
atrol

atrol

2013-07-04 17:17

developer   ~0037385

Maybe you changed setting $g_display_errors in a not recommended way

Quix0r

Quix0r

2013-07-04 17:27

reporter   ~0037387

Last edited: 2013-07-04 17:37

To answer your question and requests:

1) php --version:

PHP 5.4.4-14+deb7u2 (cli) (built: Jun 5 2013 07:56:44)
Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2012 Zend Technologies
with Xdebug v2.2.1, Copyright (c) 2002-2012, by Derick Rethans

mysql --version
mysql Ver 14.14 Distrib 5.5.31, for debian-linux-gnu (x86_64) using readline 6.2

Apache: 2.2.22-13 (according to package manager)

The package 'base-files': 7.1wheezy1

In config_inc.php: (excluding database config, of course)

$g_path = 'http://bugs.my-site.example/';
$g_max_failed_login_count = 3;
$g_administrator_email = 'foo@my-site.example';
$g_webmaster_email = $g_administrator_email;
$g_from_email = 'noreply@my-site.example';
$g_return_path_email = $g_administrator_email;
$g_notify_flags['new']['threshold_min'] = constant('DEVELOPER');
$g_notify_flags['new']['threshold_max'] = constant('DEVELOPER');
$g_notify_flags['new'] = array('bugnotes' => constant('ON'), 'monitor' => constant('ON'));
$g_email_receive_own = constant('ON');
$g_default_language = 'auto';
$g_window_title = 'My Bug-Tracker';
$g_show_footer_menu = constant('ON');
$g_show_project_menu_bar = constant('ON');
$g_status_percentage_legend = constant('ON');
$g_summary_category_include_project = constant('ON');
$g_enable_sponsorship = constant('ON');
$g_sponsorship_currency = '€';
$g_allow_file_upload = constant('ON');
$g_allow_anonymous_login = constant('ON');
$g_anonymous_account = 'anonymous';
$g_show_timer = constant('ON');
$g_show_queries_list = constant('OFF');
$g_display_errors = constant('OFF');
$g_relationship_graph_enable = constant('ON');

$g_password_confirm_hash_magic_string = 'xxxxxxxxxxx';

Quix0r

Quix0r

2013-07-04 17:31

reporter   ~0037388

I have now set the "users" access level to "viewer" and protected it from any changes so that it cannot be used and/or modified.

atrol

atrol

2013-07-04 17:55

developer   ~0037394

Last edited: 2013-07-04 18:00

I have no idea at the moment what is happening.
At line 291 of user_api.php we check that user names can not be empty

# username must consist of at least one character
if( is_blank( $p_username ) ) {
    return false;
}

At line 307 we trigger an error if the user name is invalid
if( !user_is_name_valid( $p_username ) ) {
trigger_error( ERROR_USER_NAME_INVALID, ERROR );
}

I see no way how to register a user without a name.
At least as long you didn't change our error handling, that's why I asked for $g_display_errors

Did you have a look at the error logs of web server, PHP and database?

Do you get other errors when working with MantisBT?
e.g. enter an issue without filling the summary field.
Is it possible?

Quix0r

Quix0r

2013-07-04 18:03

reporter   ~0037395

Did you trim $p_username and $p_email (I presume?) with e.g.:

// Make sure trailing/leading or all-spaces are trimmed away:
$p_username = trim($p_username);
$p_email = trim($p_email);

atrol

atrol

2013-07-04 18:12

developer   ~0037396

trim is used in is_blank checking
Why do you ask?

Please answer also my questions.

Quix0r

Quix0r

2013-07-04 18:44

reporter   ~0037397

Last edited: 2013-07-04 19:10

Ah, okay. :)

I have only set the above variables in config_inc.php, nothing is touched in config_defaults_inc.php. In error logs I only found one:


[Wed Jul 03 xx:xx:xx 2013] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/.../htdocs/http:

I can enter an issue without filling out summery line.

Quix0r

Quix0r

2013-07-04 19:11

reporter   ~0037398

If you need my php.ini (not regular settings) I can upload it here. But then this ticket should be better marked as private.

atrol

atrol

2013-07-05 02:31

developer   ~0037399

Last edited: 2013-07-05 02:33

Check your settings of error_reporting in php.ini
I am quite sure this is causing the problem.

Quix0r

Quix0r

2013-07-05 02:54

reporter   ~0037400

The php.ini says:

error_reporting = E_ALL | E_STRICT | E_DEPRECATED

atrol

atrol

2013-07-05 04:27

developer   ~0037403

Add the following line
die ("Detected empty user name");
before line
trigger_error( ERROR_USER_NAME_INVALID, ERROR );
in file user_api.php

Do you get the "Detected ...." message when trying to signup with an empty user name?

Quix0r

Quix0r

2013-07-05 08:32

reporter   ~0037406

Yes, it is being displayed.

atrol

atrol

2013-07-05 09:50

developer   ~0037408

I must have been blind and you did not read what I wrote at 0016142:0037385

Maybe you changed setting $g_display_errors in a not recommended way

Probably you did:
$g_display_errors = constant('OFF');

I looked for something like
$g_display_errors = array(
E_WARNING => 'inline',
E_NOTICE => 'none',
E_USER_ERROR => 'halt',
E_USER_WARNING => 'inline',
E_USER_NOTICE => 'none'
);

Remove the line
$g_display_errors = constant('OFF'); in your config_inc.php
and your issue should be fixed.

Quix0r

Quix0r

2013-07-05 13:54

reporter   ~0037409

"The username is invalid. Usernames may only contain Latin letters, numbers, spaces, hyphens, dots, plus signs and underscores."

Also working (tried to report empty issue):
"A necessary field "Summary" was empty. Please recheck your inputs."

Seems to work again. Thank you for your help. :)