Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SECURITY] Registration confirmation code exposed on response #410

Closed
0xMurage opened this issue Sep 29, 2021 · 4 comments
Closed

[SECURITY] Registration confirmation code exposed on response #410

0xMurage opened this issue Sep 29, 2021 · 4 comments

Comments

@0xMurage
Copy link

A request to create a user on the /users endpoint returns a verification code on the response.
This makes email verification pretty useless at the moment as I can register with any email account and get verified easily.

zc_core/user/user.go

Lines 97 to 99 in 6d57d93

respse := map[string]interface{}{
"InsertedID": res.InsertedID,
"verification_code": comfimationToken,

@0xMurage
Copy link
Author

I would have loved to create a fix for this but today is my first day interacting with Golang + just discovered this amazing project.

@Aminujb
Copy link
Collaborator

Aminujb commented Sep 29, 2021

We are working in a test environment and that is why it has been made so.

@0xMurage
Copy link
Author

Is there a way to toggle that off or am jumping the gun?

@Aminujb
Copy link
Collaborator

Aminujb commented Sep 29, 2021

I just told you it's a deliberate action and no we are not turning it off for now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants