Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disabling steamlogin disables normal login instead #954

Open
Dragonisser opened this issue Mar 13, 2024 · 1 comment
Open

Disabling steamlogin disables normal login instead #954

Dragonisser opened this issue Mar 13, 2024 · 1 comment

Comments

@Dragonisser
Copy link

What are the steps to reproduce this issue?

  1. Go into the sb++ database
  2. Open <prefix>_settings
  3. Set "config.enablesteamlogin" = 0

What happens?

Username/Pw login is disabled and only the steam login is shown

What were you expecting to happen?

The steam login is disabled

Any logs, error output, etc.?

https://github.com/sbpp/sourcebans-pp/blob/php81/web/themes/default/page_login.tpl#L8
https://github.com/sbpp/sourcebans-pp/blob/php81/web/themes/default/page_login.tpl#L28
https://github.com/sbpp/sourcebans-pp/blob/php81/web/themes/default/page_login.tpl#L32

Any other comments?

All those lines mention above are doing the opposite of what they should do. Instead of disabling the steam login button, they disable the user/pw fields, the forgot password and login button.

https://gist.github.com/Dragonisser/b8a30359bc25da590536bffec767b8f5

What versions of software are you using?

Operating System: WIndows 10
SourceBans++ Version: 1.8.0 (latest release which is named wrong)
PHP Version: php8.1
MySQL Version: 10.3.39-MariaDB-0ubuntu0.20.04.2
Link to your project:
Link to a phpinfo() output:

@Dragonisser Dragonisser changed the title Disable steamlogin disables normal login instead Disabling steamlogin disables normal login instead Mar 13, 2024
@Dragonisser
Copy link
Author

Dragonisser commented Mar 13, 2024

It appears as this is legacy code that was never changed. The webpanel setting "Enable normal login" is linked to the database entry mentioned above, hence why this whole template is build the other way around.

It would be great if there was a setting to allow both "Enable Steam Login" and "Enable Normal Login", since there has been several OICD exploits in the past. The template and possible handler behind would need to be overhauled.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant