General discussion • ?code

web/inc/secure_login.php

i just looked at this file.

The bug may be causing false positives or false negatives, leading to unexpected behavior or blocking legitimate requests.

Upon reviewing the code, I have identified a potential bug in the prevent_post_csrf function. In the line $_SERVER['HTTP_PORT'] = '';, it should be $_SERVER['SERVER_PORT'] = '';. This typo may be causing issues when checking the server port in the CSRF prevention logic.
Solution

To fix the bug, replace the line $_SERVER['HTTP_PORT'] = ''; with $_SERVER['SERVER_PORT'] = ''; in the prevent_post_csrf function.

i could be way off track?

Statistics: Posted by gathlete — Sun Jan 07, 2024 11:12 am

---