ConCen

Security issue: forum is revealing uploader's username when a new thread is opened for comments. First post always says 'Torrent uploaded by <username>' despite torrent being uploaded anonymously. This is visible, there are also owner_* and forum_* POST variables inside form which calls createthread.php, those can also be used to determine who the uploader is.

(09-26-2011 07:07 PM)Armilus Wrote: [ -> ]those can also be used to determine who the uploader is.

Well, their username.

Noted, I have an idea for a fix when we get to it.. if you open it up yourself (at least for me) it's denoted uploaded by tracker. So, in the meantime, put a comment on your own post, then edit the text where it says who it was upped by -- if that doesn't work report it and we'll delete the thread if you want to be totally anonymous.