• 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
[Important] Bypass email validation

#1
Hello,

If i simply use this code to check an email in CI :

PHP Code:
$this->form_validation->set_rules('email''email''trim|required|valid_email'); 

I just to need to send a form with this input :

Code:
"><svg/onload=confirm(1)>"@x.y

and I can bypass email validation....

The solution is to fix valid_email from Form_validation.php and add :

PHP Code:
$email filter_var($emailFILTER_SANITIZE_EMAIL); 

You should fix it in CI 3.2 !
Reply


Messages In This Thread
[Important] Bypass email validation - by peter - 11-25-2018, 02:43 AM

Digg   Delicious   Reddit   Facebook   Twitter   StumbleUpon  


  Theme © 2014 iAndrew  
Powered By MyBB, © 2002-2020 MyBB Group.