Attack
Forum Üyesi
- Katılım
- 4 Şub 2023
- Mesajlar
- 2,618
- Puanları
- 0
xf_user cookie has urlencoded comma value stored (i.e. 'n%2Cnnnnnnnnn...' instead of just 'n,nnnnnn....'), thus making /api/auth/from-session failing when passing that value as is.
I had to look through the /api source code in order to understand what is wrong and why it did not like my valid xf_user cookie.
Would expect API to do urldecode() of remember_cookie param on its own before running all the checks, otherwise it just fails in...
I had to look through the /api source code in order to understand what is wrong and why it did not like my valid xf_user cookie.
Would expect API to do urldecode() of remember_cookie param on its own before running all the checks, otherwise it just fails in...
Misafirler için gizlenen link, görmek için
Giriş yap veya üye ol.
