Simple Machines Community Forum

SMF Development => Bug Reports => Fixed or Bogus Bugs => Topic started by: Daretary on April 14, 2023, 12:22:38 AM

Title: Vulnerability in Notify email
Post by: Daretary on April 14, 2023, 12:22:38 AM
$txt['msg_quote_body'] = 'Hello {MEMBERNAME},

You have been quoted in the post titled "{CONTENTSUBJECT}" by {QUOTENAME}, you can see the post here:
{CONTENTLINK}

{REGARDS}';
QUOTENAME is not a Name, but a Username! That is, everyone sees my secret login!
$replacements = array(
                    'CONTENTSUBJECT' => $msgOptions['subject'],
                    'QUOTENAME' => $posterOptions['name'],
                    'MEMBERNAME' => $member_data['real_name'],
                    'CONTENTLINK' => $scripturl . '?msg=' . $msgOptions['id'],
                );
Must show real_name.
Title: Re: Vulnerability in Notify email
Post by: Daretary on April 14, 2023, 01:05:25 AM
For example, everything is fine here - shows Name in {POSTERNAME}
$txt['alert_unapproved_reply_body'] = 'A reply has been posted in \'{SUBJECT}\' by {POSTERNAME}.

You can see it at
{LINK}

{REGARDS}';
Title: Re: Vulnerability in Notify email
Post by: Aleksi "Lex" Kilpinen on April 14, 2023, 01:45:05 AM
Have not confirmed, do not have time to check right now - but if true, qualifies as a bug, so moved to bug reports.
Title: Re: Vulnerability in Notify email
Post by: DeadMan... on April 14, 2023, 04:55:01 AM
Even the notes in the file claims to use username.
However, it could be more a typo there than actual name.

/**
@additional_params: msg_quote
CONTENTSUBJECT: The post subject.
QUOTENAME:  The user name for the member creating the quote
MEMBERNAME:  The user name for the member being quoted
CONTENTLINK:  The post's link
@description: A notification email sent to the members who've been quoted in a post
 */
Title: Re: Vulnerability in Notify email
Post by: Aleksi "Lex" Kilpinen on April 14, 2023, 10:33:05 AM
Definitely should be display name, not username. There shouldn't really be any need to use username publicly in any situation, only the user and admin need to know IMO.
Title: Re: Vulnerability in Notify email
Post by: m4z on April 14, 2023, 02:33:18 PM
I think I've reported this before. Will try to find it later (on mobile right now).
Title: Re: Vulnerability in Notify email
Post by: shawnb61 on April 22, 2023, 05:55:36 PM
Confirmed, & logged here:
https://github.com/SimpleMachines/SMF/issues/7734
Title: Re: Vulnerability in Notify email
Post by: Aleksi "Lex" Kilpinen on December 31, 2023, 04:13:17 PM
Fix merged https://github.com/SimpleMachines/SMF/pull/7736
Title: Re: Vulnerability in Notify email
Post by: Aleksi "Lex" Kilpinen on June 26, 2025, 01:24:50 AM
I believe 2.1.5 fixed this.

Release notes
Email:
    Notification emails always use display names, never usernames.