OpenCart Vulnerability Discussion on GitHub | Hacker News Reader

OpenCart Vulnerability Discussion on GitHub

github.com

The project maintainer could certainly do with some humility and willingness to learn, or alternatively use a framework like Laravel which takes care of stuff like this.

People like this give PHP a terrible rap.

(Seems like there are other gems here at https://news.ycombinator.com/from?site=github.com/opencart)

That's the first time I see such kind of replys from a large project on github, I'm certainly not going to use this one in the future, that's for sure.

Edit: and there's a lot of similar ones if you go into the closed issues

Hah, in one of the replies someone mentions a session hijacking issue https://github.com/opencart/opencart/issues/12939 but the guy's response was:

> what a great hacker! this man should be put on a pedestal for as the worlds greatest hacker for using inspect element and copy and pasting his user_token var from the browser. now if he can only get it to work on a 3rd party who's cookie and user_token he wont know! lets not forget SSL.

> fucking dickhead banned!

Wow mate, that issue mentions social engineering (Facebook has a big fat warning about SelfXSS if you open the browser's developer console), and you choose to ignore this part? Also, relying on other tech like SSL to hopefully keep the hole in your code from losing your users' money? Haaah.

It's GPL, anyone wanna fork it and call it DickheadCart?

If anyone is wondering why this is posted in a GitHub issue, the author attempted to disclose this privately but was ignored before finally receiving the response "ur a fucking tim.e waster!"

https://0xbro.red/disclosures/disclosed-vulnerabilities/open...

The maintainer is apparently infamous for lashing out against people trying to report potential vulnerabilities.

He had a similar attitude all the way back in 2014:

> i'm closing this as its a waste of time.

https://github.com/opencart/opencart/issues/1269#issuecommen...

That's neat, like a couple days after saying he would reopen it...

Either way the PR (https://github.com/opencart/opencart/pull/12949/files) should have been accepted. Clearly the [^a-zA-z0-9_] regex will not do what it appears to be intended to do without the delimiters.

It was eventually fixed in another PR, despite the maintainer's lengthy ranting.

https://github.com/opencart/opencart/pull/12951#issuecomment...

Thanks, I didn't realize. The only thing with PR 12951 is that one of the invalid replacements covered on the other PR was missed (https://github.com/mhcwebdesign/opencart/blob/bc60f21aa2ece0...). Normally I'd just report it to the project but given the behavior and language observed surrounding this, why even bother.

The worst part of it is the pseudo le memelord writing style in the first responses and the absolute insane amount of exclamation marks in the final one.

He might have been on his phone for the first response.

Reply on news.ycombinator.com