If LoginToboggan is enabled and set to login using email addresses, then visiting the URL user/uid/validate/[encrypted email address] will log in the user that visits that URL as the user whose UID is visited!

Comments

icecreamyou’s picture

icecreamyou commented

Correction: it doesn't matter whether LoginToboggan is configured to accept email addresses or not.

mrgoltra’s picture

mrgoltra commented

ok I am interested on how you did this

can you post the steps?

icecreamyou’s picture

icecreamyou commented
Priority: Critical » Minor

I enabled page tracking on my site so I can see which pages each individual user goes to at http://music.babelup.com/user/[uid]/track/navigation. On that page for one user I found a link with this at the end: user/validate/[uid]/1209026024/7ba2ed809cff97a7cdedfa1138903586

I'm not sure how the user managed to get to that page to start with. The tracker description has a blank referrer slot. However, the previous page the user was visiting was the Invite page (from invite.module). This is perhaps significant because of this issue (integration of email validate with Invite - I patched Invite to call Email Validate with the code on that page). I really don't think this is related to the patch or invite itself though.

...and, uh... I can't reproduce the results that this user got. I'm going to mark this minor - it seemed critical at first but it seems to be pretty much impossible to duplicate. The user who did it is without a doubt human, so it wasn't just a bot that guessed correctly.

icecreamyou’s picture

icecreamyou commented
Status: Active » Closed (fixed)

I think this is a problem with core and/or LoginToboggan, not Email Verification. I think this happened when the user clicked the login link in the registry verfication email - it must have remained active for whatever reason.

:-/