OpenCart Vulnerability Discussion on GitHub

https://github.com/opencart/opencart/issues/12947

30 11 3 years ago

The project maintainer could certainly do with some humility and willingness to learn, or alternatively use a framework like Laravel which takes care of stuff like this.

People like this give PHP a terrible rap.

(Seems like there are other gems here at https://news.ycombinator.com/from?site=github.com/opencart)

realusername• 3 years ago

That's the first time I see such kind of replys from a large project on github, I'm certainly not going to use this one in the future, that's for sure.

Edit: and there's a lot of similar ones if you go into the closed issues

netsharc• 3 years ago

Hah, in one of the replies someone mentions a session hijacking issue https://github.com/opencart/opencart/issues/12939 but the guy's response was:

what a great hacker! this man should be put on a pedestal for as the worlds greatest hacker for using inspect element and copy and pasting his user_token var from the browser. now if he can only get it to work on a 3rd party who's cookie and user_token he wont know! lets not forget SSL.
fucking dickhead banned!

Wow mate, that issue mentions social engineering (Facebook has a big fat warning about SelfXSS if you open the browser's developer console), and you choose to ignore this part? Also, relying on other tech like SSL to hopefully keep the hole in your code from losing your users' money? Haaah.

It's GPL, anyone wanna fork it and call it DickheadCart?

tommy_axle2• 3 years ago

Either way the PR (https://github.com/opencart/opencart/pull/12949/files) should have been accepted. Clearly the [^a-zA-z0-9_] regex will not do what it appears to be intended to do without the delimiters.

richbell3• 3 years ago

It was eventually fixed in another PR, despite the maintainer's lengthy ranting.

https://github.com/opencart/opencart/pull/12951#issuecomment...

tommy_axle2• 3 years ago

Thanks, I didn't realize. The only thing with PR 12951 is that one of the invalid replacements covered on the other PR was missed (https://github.com/mhcwebdesign/opencart/blob/bc60f21aa2ece0...). Normally I'd just report it to the project but given the behavior and language observed surrounding this, why even bother.

Zetobal• 3 years ago

The worst part of it is the pseudo le memelord writing style in the first responses and the absolute insane amount of exclamation marks in the final one.

rs999gti• 3 years ago

He might have been on his phone for the first response.

richbell3• 3 years ago

If anyone is wondering why this is posted in a GitHub issue, the author attempted to disclose this privately but was ignored before finally receiving the response "ur a fucking tim.e waster!"

https://0xbro.red/disclosures/disclosed-vulnerabilities/open...

richbell3• 3 years ago

The maintainer is apparently infamous for lashing out against people trying to report potential vulnerabilities.

He had a similar attitude all the way back in 2014:

i'm closing this as its a waste of time.

https://github.com/opencart/opencart/issues/1269#issuecommen...

winrid• 3 years ago

That's neat, like a couple days after saying he would reopen it...

OpenCart Vulnerability Discussion on GitHub

Related Stories