shiftos-archive/Project-Unite
1
0
Fork 0
mirror of https://github.com/lempamo/Project-Unite.git synced 2025-02-02 13:07:34 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix massive security bug with display names

Browse source
This commit is contained in:
Michael 2017-04-10 18:44:29 -04:00
parent 147f266e68
commit 72feceb369
2 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
Project-Unite/Controllers/AccountController.cs
View file

@ -179,6 +179,16 @@ The addressed used to send this message is not a no-reply address. In fact, my n
{ {
if (ModelState.IsValid) if (ModelState.IsValid)
{ {
using(var temp = new ApplicationDbContext())
{
if(temp.Users.FirstOrDefault(x=>x.UserName==model.Username) != null)
{
ModelState.AddModelError("Your display name is already taken.");
return View(model);
}
}
var user = new ApplicationUser { UserName = model.Email, Email = model.Email, DisplayName = model.Username, Codepoints = 0, JoinedAt = DateTime.Now, MutedAt = DateTime.Now, BannedAt = DateTime.Now, LastLogin = DateTime.Now }; var user = new ApplicationUser { UserName = model.Email, Email = model.Email, DisplayName = model.Username, Codepoints = 0, JoinedAt = DateTime.Now, MutedAt = DateTime.Now, BannedAt = DateTime.Now, LastLogin = DateTime.Now };
var result = await UserManager.CreateAsync(user, model.Password); var result = await UserManager.CreateAsync(user, model.Password);
if (result.Succeeded) if (result.Succeeded)

6
Project-Unite/Views/Shared/_Layout.cshtml
View file

@ -11,6 +11,12 @@
<head> <head>
<meta charset="utf-8" /> <meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="viewport" content="width=device-width, initial-scale=1.0">
@if(ViewBag.PageDescription != null)
{
<meta name="description" content="@ViewBag.PageDescription" />
}
<title>@ViewBag.Title &bull; Project: Unite</title> <title>@ViewBag.Title &bull; Project: Unite</title>
@Styles.Render("~/Content/css") @Styles.Render("~/Content/css")
@Styles.Render("~/Content/bootstrap-theme.css") @Styles.Render("~/Content/bootstrap-theme.css")