Module: Remember Username

Re: Module: Remember Username

yupri — Tue, 17 Sep 2013 01:03:49 -0500

There is a security issue in the current version of the module.
(I purposely omit the details to not encourage its exploitation.)
If a cookie for this module is somehow set outside with some scripting in it, it allows session hijacking and the like.

To prevent this behavior something like this would do.

$username = trim($_COOKIE['phorum_mod_remember_username']);
$focus_field = 'password';
// If the cookie is forged. (It contains something other than a username.)
if(filter_var($username, FILTER_SANITIZE_STRING) != $username)
{
// Delete the forged cookie.
setcookie('phorum_mod_remember_username', '', time() - 3600, $PHORUM['session_path'], $PHORUM['session_domain']);
// Set an empty username.
$username = '';
// Focus on username field.
$focus_field = 'username';
}

// Replace the username with the remembered username.
$PHORUM['DATA']['LOGIN']['username'] = $username;

// Make the focus shift to the appropriate field.
$PHORUM['DATA']['FOCUS_TO_ID'] = $focus_field;

Re: Module: Remember Username

Thomas Seifert — Mon, 31 Jan 2011 00:30:41 -0600

Or use the browser functions to remember what you input into a form.

Re: Module: Remember Username

larry simpson — Sun, 30 Jan 2011 23:42:20 -0600

Re: Module: Remember Username

Maurice Makaay — Sun, 30 Jan 2011 23:33:49 -0600

By default, Phorum remembers the logon session. There should be no need for a "Remember me" option for the password. Like on the phorum.org website, you should see that you are still logged in after returning to the site.

Re: Module: Remember Username

larry simpson — Sun, 30 Jan 2011 21:02:00 -0600

hope this is right place to post this. Mine works fine but i need it to remember password too. can this be done?

Re: Module: Remember Username

Oliver Riesen-Mallmann — Wed, 21 May 2008 03:34:43 -0500

Hi Maurice,

Quote
Maurice Makaay
I think that this accidentally was the 5.1 compatible 1.0.0 package.
Please try if 1.1.0 fixes things for you.

Yes, it's working fine. Thanks.

Regards
Oliver

Re: Module: Remember Username

Maurice Makaay — Tue, 20 May 2008 09:52:36 -0500

I think that this accidentally was the 5.1 compatible 1.0.0 package.
Please try if 1.1.0 fixes things for you.

Re: Module: Remember Username

Oliver Riesen-Mallmann — Fri, 16 May 2008 09:17:32 -0500

Hi Maurice,

I installed your module. When it is enabled and I go to the login page (after logging out) I get immediately the "username/password was not found or is inactive" error message. My username is filled in but there shouldn't be thrown an error message even when I just entering that page...

Regards
Oliver

Module: Remember Username

Maurice Makaay — Sun, 05 Aug 2007 06:48:45 -0500

This module will store the Phorum username that was last used in a cookie.
When entering the login screen, the username will be automatically filled in, based on this cookie.

Changelog:
----------

2007-08-05 v1.1.0

    - Rewrite for Phorum 5.2.

2005-01-23 v1.0.0

    - Initial release