Skip to content
This repository has been archived by the owner on Feb 26, 2023. It is now read-only.

Commit

Permalink
Replace trigger_error() with exit()
Browse files Browse the repository at this point in the history
trigger_error() does not exit the script and continues script execution
on the next line.  This can lead to incorrect behavior.

For example, if the REPLACE SQL statement in register.php fails for some
reason, the script will still send the user a registration email.
Because no record exists in the pending_validations table, all attempts
the user makes to validate their email will fail.  This was the exact
scenario we had when users would attempt to register using an IPv6
address.
  • Loading branch information
ssoloff authored and RoiEXLab committed Jan 17, 2018
1 parent c5f9c7d commit 116f737
Show file tree
Hide file tree
Showing 3 changed files with 5 additions and 5 deletions.
2 changes: 1 addition & 1 deletion src/register.php
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@
$sql = "REPLACE INTO pending_validations (email, validation_key, IP) VALUES (?, ?, 0)";
$sth = $dice->dbconn->prepare($sql);
$sth->bind_param('ss', $email, $validation);
$sth->execute() or trigger_error($dice->dbconn->error);
$sth->execute() or exit($dice->dbconn->error);
$sth->close();

// sending email
Expand Down
2 changes: 1 addition & 1 deletion src/unsubscribe.php
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@

$sth = $dice->dbconn->prepare("DELETE FROM dice_emails WHERE registered_email=?");
$sth->bind_param('s',$email);
$sth->execute() or trigger_error($dice->dbconn->error);
$sth->execute() or exit($dice->dbconn->error);

echo "Your email was successfully removed. You will no longer receive dice emails.";
}
Expand Down
6 changes: 3 additions & 3 deletions src/validate.php
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@

$sth = $dice->dbconn->prepare("SELECT COUNT(*) FROM pending_validations WHERE email=? AND validation_key=?");
$sth->bind_param('ss', $email, $validation);
$sth->execute() or trigger_error($dice->dbconn->error);
$sth->execute() or exit($dice->dbconn->error);
$sth->bind_result($entry_count);
$sth->fetch();
if ($entry_count === 0) {
Expand All @@ -29,12 +29,12 @@

$sth = $dice->dbconn->prepare("INSERT INTO dice_emails (registered_email) VALUES (?)");
$sth->bind_param('s', $email);
$sth->execute() or trigger_error($dice->dbconn->error);
$sth->execute() or exit($dice->dbconn->error);
$sth->close();

$sth = $dice->dbconn->prepare("DELETE FROM pending_validations WHERE email=?");
$sth->bind_param('s', $email);
$sth->execute() or trigger_error($dice->dbconn->error);
$sth->execute() or exit($dice->dbconn->error);
$sth->close();

echo "Registration was successful. You can now use the MARTI dice server.";
Expand Down

0 comments on commit 116f737

Please sign in to comment.