Guess why that's wrong? If you don't know and/or don't care, you really shouldn't be freelancing. It's certainly not the most critical vulnerability ever, but when file traversal prevention there would be so incredibly easy (just md5, sha1, base64_encode, etc the username) not even requiring any proper validation, it's really just silly and makes me wonder what else there might be elsewhere is in your code.
EDIT: Apologies if you do validation in users::add, I missed that key point when skimming the code but even so I suspect that you don't bearing in mind that you've already done some basic validation of fields in the form above.
u telling me that i been idiot , okay i am idiot if u were me and want the register add folder auto with the username how would u do that with the right way
u telling me that i been idiot , okay i am idiot if u were me and want the register add folder auto with the username how would u do that with the right way
Originally Posted by 46Bit
... file traversal prevention there would be so incredibly easy (just md5, sha1, base64_encode, etc the username) ...
Linear Mode
Forum Contains New Posts 
Forum Contains No New Posts 
Forum is Closed