12-04-2001 08:17									#1
	Password appears in the location field Support Apolyton, buy Galactic Civilizations: Deluxe Edition

It happens only when logging in directly in the Private Messages Inbox before posting or doing anything else.

I didn't used to do this, but once did and was quite surprised to discover this. So I made a few experiments, and apparently the cookie remembers the session if you posted so the password does not appear.

But it does appear in simple text if you haven't logged in before.

http://www.apolyton.net/cgi-bin/ubb/privateview.cgi?user=Sirotnikov&pass=my_actual_password

This could show the password to people around you, and if you're meeting someone aware of this forums in your house or an internet caf`e your password could be revealed.

So could you pretty please change the form method of the private messages login page to POST instead of GET?

	12-04-2001 08:33									#2
	Full PM-box? Change here!

hey I tried getting into your account with the password: my_actual_password and it didn't work

this has been know, but I guess they don't care. they never fixed it. but it doesn't do it for me.

	12-04-2001 13:00									#3
	Support Apolyton, buy Call to Power 2

we are aware of the issue since we added the feature. fixing it would require a total rewrite of the functions and it's not on the top of our priorities. if you dont feel safe, dont use it...


btw, it's not just the login page(which i changed to post), but it's also the reply buttons, etc....

	13-04-2001 09:44									#4
	Support Apolyton buy from Amazon

Well I met this problem most ly in Netscape. Explorer seems to remember my identity. I just wanted to make sure people are aware of this small glitch.

Thanks for the fast reply.

Oh, and dissident, did you really expect me to write REW67sd5X is my password?

	13-04-2001 09:56									#5
	Support Apolyton, buy Civilization: The Boardgame

Cool! I tried it again with NS and it doesn't show the password anymore. Thanks

	13-04-2001 00:36									#6
	Get a bigger avatar today!

<center><table width=80%><tr><td><font color=000080 face="Verdana" size=2><font size="1">quote:
<img src=/forums/"/images/blue1.gif" width=100% height=1>
</font><font size=1>Originally posted by Sirotnikov on 04-12-2001 12:44 PM</font>

Oh, and dissident, did you really expect me to write REW67sd5X is my password?
<img src=/forums/"/images/blue1.gif" width=100% height=1></font></td></tr></table></center>

I tried that. No results.

	14-04-2001 02:40									#7
	Increase the size of your Attachments

Remember, Siro, that unlike PHP (where you'd have a small included function in which all you would need to change was the word "GET" to the word "POST" a few times), CGI has completely illogical and confusing parsing functions for the things PHP does automatically, like assign GET and POST variables to named strings.