CSF Messenger bug: CAPTCHA response gets truncated
Answered
First of all, I would like to thank you for your efforts in continuing the legacy of CSF.
We found a bug in CSF Messenger v1 that prevents clients from unblocking themselves: the GET request containing the CAPTCHA response is being truncated (it appears the response is now larger than before).
Below is a screenshot showing the evidence. At the top, you can see the test with the CAPTCHA code that CSF Messenger receives and logs in /var/log/lfd_messenger.log, and below that, the one that it is actually sent from the browser:
The reason this happens is that on line 451 of the file /usr/local/csf/lib/ConfigServer/Messenger.pm, the response received by the Messenger service is truncated to 2048 bytes:
Changing this value to something like 3072 or 4096 resolves the issue.
I hope you can apply this fix, as it is a simple change.
Thank you in advance,
Ignacio
-
Hey there! Let me reach out to the team that's handling CSF and I'll let you know what they have to say!
0 -
I've created case CPANEL-51724 with our team so they can look into this! Originally our plan was to only patch security vulnerabilities but this may be a small enough change without other consequences that we can take care of it.
I've linked this thread to the case so if I hear updates on my end I'll be sure to post.
0 -
Great thanks!
0 -
I confirmed that the team is going to adjust this as part of a future release, so it's happening!
0 -
Update - this has been resolved and will be fixed in a future release!
0 -
Nice! thanks Mr. Dinosaur.
0 -
You're very welcome :D
0
Please sign in to leave a comment.
Comments
8 comments