Subj : emailval.js accepts incomplete email addresses
To   : All
From : Codefenix
Date : Thu Aug 29 2024 08:30:51

A new user stopped by early this morning. When validating the email address, they entered an incomplete one (e.g.: user-name@gmail).

The emailval.js script accepted this and logged the error:

  8/29  03:27:06a  Node 1 <user> !JavaScript  C:\sbbs\mods\emailval.js line 130: Error: Unroutable QWKnet "to_net_addr" (gmail) in recipient object

This allowed the user to bypass the email validation process and proceed to the main menu. Granted, they didn't have their default access level adjusted either.

I assume the system must be treating user.netmail values without a "." to the right of the "@" symbol as QWKnet addresses? 

In any case, I copied emailval.js script to /sbbs/mods, and added a check to the SendValidationEmail function to ensure that user.netmail values contain both a "@" and a ".":

if (user.netmail.indexOf(".") < 0 && user.netmail.indexOf("@") < 0) {
  console.print("\r\n'" + user.netmail + "' is not a valid email address!");
  console.pause();
  return;
}

This should screen out incomplete values, and prevent unwanted validation bypass attempts.
  
|01<|09co|03d|11e|15Ÿ|11e|03n|09ix|01>|07
 

....Ignorance is the mother of research.
---
 þ Synchronet þ -=[ ConstructiveChaos BBS | conchaos.synchro.net ]=-

.