Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Exploit. #27

Closed
ConniBug opened this issue Apr 15, 2021 · 2 comments
Closed

Exploit. #27

ConniBug opened this issue Apr 15, 2021 · 2 comments
Assignees
Labels
bug Something isn't working help wanted Extra attention is needed

Comments

@ConniBug
Copy link
Member

People are able to register the same phone number because we dont check for it here in MemberFunction.js

    var check = await Members.find({
        $or: [{ email: email }, { tag: tag }],
    });

But if we add the phone number check and make sure they dont use the same number during verification like this

    var check = await Members.find({
        $or: [{ email: email }, { tag: tag }, { phonenumber: phonenumber, phonenumber_verified: true }],
    });

So that if the number has been setup and verified they cant use the same number twice that should fix the issue

But if someone adds there phone number doesnt verify it but then someone else adds the number then verifys it, as someone else has already got that number on record but unverified issues could start to appear with verification, and im unsure how we want to handle this.

@ConniBug ConniBug added bug Something isn't working help wanted Extra attention is needed labels Apr 15, 2021
@ConniBug
Copy link
Member Author

We could 100% add a check that runs on verification of a number to check if anyone else has added that number but not verified it then remove it but that could be chocky and i feel like there are maybe better solutions

ConniBug pushed a commit that referenced this issue Apr 15, 2021
@ConniBug
Copy link
Member Author

Potential Fix
e2c4e2d

@ConniBug ConniBug pinned this issue Apr 15, 2021
@ConniBug ConniBug closed this as completed Feb 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working help wanted Extra attention is needed
Projects
None yet
Development

No branches or pull requests

2 participants