2.11.7: Remove JavaScript validation on password fields

webpwnized · Oct 20, 2023 · 1e54e8a · 1e54e8a
1 parent ea220fc
commit 1e54e8a
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 19 deletions.
diff --git a/edit-account-profile.php b/edit-account-profile.php
@@ -181,14 +181,12 @@ function onSubmitOfForm(/*HTMLFormElement*/ theForm){
 		try{
 			if(lValidateInput == "TRUE"){
 				var lUnsafeCharacters = /[`~!@#$%^&*()-_=+\[\]{}\\|;':",./<>?]/;
-				if (theForm.username.value.length > 15 || 
-					theForm.password.value.length > 15){
+				if (theForm.username.value.length > 15){
 						alert('Username too long. We dont want to allow too many characters.\n\nSomeone might have enough room to enter a hack attempt.');
 						return false;
 				};// end if
 
-				if (theForm.username.value.search(lUnsafeCharacters) > -1 || 
-					theForm.password.value.search(lUnsafeCharacters) > -1){
+				if (theForm.username.value.search(lUnsafeCharacters) > -1){
 						alert('Dangerous characters detected. We can\'t allow these. This all powerful blacklist will stop such attempts.\n\nMuch like padlocks, filtering cannot be defeated.\n\nBlacklisting is l33t like l33tspeak.');
 						return false;
 				};// end if

diff --git a/includes/constants.php b/includes/constants.php
@@ -2,7 +2,7 @@
 	/* ------------------------------------------
 	 * @VERSION
 	 * ------------------------------------------*/
-	$C_VERSION = "2.11.6";
+	$C_VERSION = "2.11.7";
 	$C_VERSION_STRING = "Version: " . $C_VERSION;
 	$C_MAX_HINT_LEVEL = 1;
 

diff --git a/login.php b/login.php
@@ -21,7 +21,7 @@
 	}// end try
 ?>
 
-<script type="text/javascript">
+<script type="text/javascript">
 <!--
 	<?php
 		if ($_SESSION["loggedin"]=="True") {
@@ -47,14 +47,12 @@ function onSubmitOfLoginForm(/*HTMLFormElement*/ theForm){
 		try{
 			if(lValidateInput == "TRUE"){
 				var lUnsafeCharacters = /[`~!@#$%^&*()-_=+\[\]{}\\|;':",./<>?]/;
-				if (theForm.username.value.length > 15 ||
-					theForm.password.value.length > 15){
+				if (theForm.username.value.length > 15){
 						alert('Username too long. We dont want to allow too many characters.\n\nSomeone might have enough room to enter a hack attempt.');
 						return false;
 				};// end if
 
-				if (theForm.username.value.search(lUnsafeCharacters) > -1 ||
-					theForm.password.value.search(lUnsafeCharacters) > -1){
+				if (theForm.username.value.search(lUnsafeCharacters) > -1){
 						alert('Dangerous characters detected. We can\'t allow these. This all powerful blacklist will stop such attempts.\n\nMuch like padlocks, filtering cannot be defeated.\n\nBlacklisting is l33t like l33tspeak.');
 						return false;
 				};// end if
@@ -65,7 +63,7 @@ function onSubmitOfLoginForm(/*HTMLFormElement*/ theForm){
 			alert("Error: " + e.message);
 		};// end catch
 	};// end function onSubmitOfLoginForm(/*HTMLFormElement*/ theForm)
-//-->
+//-->
 </script>
 
 <div class="page-title">Login</div>

diff --git a/user-info-xpath.php b/user-info-xpath.php
@@ -79,14 +79,12 @@ function onSubmitOfForm(/*HTMLFormElement*/ theForm){
 			var lUnsafeCharacters = /[`~!@#$%^&*()-_=+\[\]{}\\|;':",./<>?]/;
 
 			if(lValidateInput == "TRUE"){
-				if (theForm.username.value.length > 15 ||
-					theForm.password.value.length > 15){
+				if (theForm.username.value.length > 15){
 						alert('Username too long. We dont want to allow too many characters.\n\nSomeone might have enough room to enter a hack attempt.');
 						return false;
 				}// end if
 
-				if (theForm.username.value.search(lUnsafeCharacters) > -1 ||
-					theForm.password.value.search(lUnsafeCharacters) > -1){
+				if (theForm.username.value.search(lUnsafeCharacters) > -1){
 						alert('Dangerous characters detected. We can\'t allow these. This all powerful blacklist will stop such attempts.\n\nMuch like padlocks, filtering cannot be defeated.\n\nBlacklisting is l33t like l33tspeak.');
 						return false;
 				}// end if

diff --git a/user-info.php b/user-info.php
@@ -65,14 +65,12 @@ function onSubmitOfForm(/*HTMLFormElement*/ theForm){
 			var lUnsafeCharacters = /[`~!@#$%^&*()-_=+\[\]{}\\|;':",./<>?]/;
 
 			if(lValidateInput == "TRUE"){
-				if (theForm.username.value.length > 15 || 
-					theForm.password.value.length > 15){
+				if (theForm.username.value.length > 15){
 						alert('Username too long. We dont want to allow too many characters.\n\nSomeone might have enough room to enter a hack attempt.');
 						return false;
 				}// end if
 
-				if (theForm.username.value.search(lUnsafeCharacters) > -1 || 
-					theForm.password.value.search(lUnsafeCharacters) > -1){
+				if (theForm.username.value.search(lUnsafeCharacters) > -1){
 						alert('Dangerous characters detected. We can\'t allow these. This all powerful blacklist will stop such attempts.\n\nMuch like padlocks, filtering cannot be defeated.\n\nBlacklisting is l33t like l33tspeak.');
 						return false;
 				}// end if