Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.

View this topic in a long page with up to 500 replies per page Watch this topic Create new topic
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | ... | 36


2391 posts

Uber Geek
+1 received by user: 292
Inactive user


  Reply # 693898 1-Oct-2012 09:22 Send private message quote this post

Singned up and listed two $1 auctions. Signup process when OK and it accepted my mobile number.

Adding pictures to the auction does not seem to work. When I select them, they upload but dont seem to get added to the auction ...

Lets see what happens

gzt

4177 posts

Uber Geek
+1 received by user: 159

Subscriber

Reply # 693900 1-Oct-2012 09:25 Send private message quote this post

Password recovery mechanism is sending a plain text password. We all know what that means. Great.

BDFL
49169 posts

Uber Geek
+1 received by user: 4160

Administrator
Trusted
Geekzone
Subscriber

  Reply # 693903 1-Oct-2012 09:28 Send private message quote this post

Wow. Just wow. If there's a SQL injection vulnerability on Wheedle (and seriously, there must be one somewhere, with so bad development practices) that spells doom.





678 posts

Ultimate Geek
+1 received by user: 1


  Reply # 693905 1-Oct-2012 09:38 Send private message quote this post

look like to me they copy some stuff what trademe got. like jobs it looks the same thing to me




               The Biggest and the Best.

2438 posts

Uber Geek
+1 received by user: 218

Trusted
Subscriber

  Reply # 693912 1-Oct-2012 09:48 Send private message quote this post

freitasm: Wow. Just wow. If there's a SQL injection vulnerability on Wheedle (and seriously, there must be one somewhere, with so bad development practices) that spells doom.



I'll give you a hint.  If you add an apostrophe to any input, any input at all, it bounces you to the 404 not found page.  But not the ASP.NET 404 page, it redirects you to /Views/Shared/404.aspx - this indicates to me they are bouncing you based on the presence of the apostrophe, rather than cleaning or parameterising input.  You can't even search for something with an apostrophe in it!

(Edit: or a hyphen for that matter.   You can't search for anything with a hyphen in it.  Good lord this site fails on so many levels).

dpw

736 posts

Ultimate Geek
+1 received by user: 5

Trusted

  Reply # 693919 1-Oct-2012 09:55 Send private message quote this post

Kyanar:
freitasm: Wow. Just wow. If there's a SQL injection vulnerability on Wheedle (and seriously, there must be one somewhere, with so bad development practices) that spells doom.



I'll give you a hint.  If you add an apostrophe to any input, any input at all, it bounces you to the 404 not found page.  But not the ASP.NET 404 page, it redirects you to /Views/Shared/404.aspx - this indicates to me they are bouncing you based on the presence of the apostrophe, rather than cleaning or parameterising input.  You can't even search for something with an apostrophe in it!

(Edit: or a hyphen for that matter.   You can't search for anything with a hyphen in it.  Good lord this site fails on so many levels).


Well, in the search box near the top of the page it actually removes "special characters" onkeyup.

EDIT: and that function is part of a huge bunch of script on the page! In the middle of that bunch (those bunches?) there are chunks of commented out scripts. Obviously page speed is not a priority for these guys...




Android user, .NET developer, a semi-typical (not a gamer) geek, and a Bernese Mountain Dog nut!

http://savitarbernese.com

2438 posts

Uber Geek
+1 received by user: 218

Trusted
Subscriber

  Reply # 693929 1-Oct-2012 10:07 Send private message quote this post

dpw: Well, in the search box near the top of the page it actually removes "special characters" onkeyup.

EDIT: and that function is part of a huge bunch of script on the page! In the middle of that bunch (those bunches?) there are chunks of commented out scripts. Obviously page speed is not a priority for these guys...


Aw crud.  It only bounces you to the 404 not found page if there's one apostrophe.  If there's two apostrophes, the input is accepted.  Methinks that 404 not found page is also the default error page for... oh, I don't know... SqlException?

10690 posts

Uber Geek
+1 received by user: 390

Trusted
Subscriber

  Reply # 693933 1-Oct-2012 10:12 Send private message quote this post

Password length is 19 chars max, yet the field is 20 chars long.

Didnt like some characters in it.

Already looking like a failure at that point.

edit:

registered, took the confirmation number that I was emailed, and now everytime I log in I just get sent to

https://www.wheedle.co.nz/Views/Shared/404.aspx

and am not logged in.






Richard rich.ms

437 posts

Ultimate Geek
+1 received by user: 9
Inactive user


  Reply # 693940 1-Oct-2012 10:28 Send private message quote this post

I really hope that Wheedle read this page and actually hire some developers who know what they're doing (instead of truck drivers copying and pasting..??) There needs to be decent competition to TM and I was hoping this would be it Embarassed

2438 posts

Uber Geek
+1 received by user: 218

Trusted
Subscriber

  Reply # 693944 1-Oct-2012 10:31 Send private message quote this post

richms: Password length is 19 chars max, yet the field is 20 chars long.

Didnt like some characters in it.

Already looking like a failure at that point.

edit:

registered, took the confirmation number that I was emailed, and now everytime I log in I just get sent to

https://www.wheedle.co.nz/Views/Shared/404.aspx

and am not logged in.




Is there an apostrophe in your password?  If so, you're causing an SqlException when you log in.  Otherwise, you're causing some other kind of Exception.

6951 posts

Uber Geek
+1 received by user: 325

Trusted

  Reply # 693945 1-Oct-2012 10:34 Send private message quote this post

err ... fail of the year! haha - i share sam morgan's sentiments now!




Apologies for poor typing standards when on Samsung S4 [swype's fault]/iPad 2 Wifi[too slow to use!]

6951 posts

Uber Geek
+1 received by user: 325

Trusted

  Reply # 693946 1-Oct-2012 10:35 Send private message quote this post

mind you there is still a way to recover this ... but if they spent X millions creating this legless piece of wood ... the need to spend another 2-10x more to beat TM!




Apologies for poor typing standards when on Samsung S4 [swype's fault]/iPad 2 Wifi[too slow to use!]

10690 posts

Uber Geek
+1 received by user: 390

Trusted
Subscriber

  Reply # 693952 1-Oct-2012 10:37 Send private message quote this post

Kyanar:

Is there an apostrophe in your password?  If so, you're causing an SqlException when you log in.  Otherwise, you're causing some other kind of Exception.


Nope, just 19 chars of mixed upper, lower and numerics

Heres some more gems I have found.



The password.



messed up layout or something



Someone not happy with being logged in as someone else.





Richard rich.ms

10690 posts

Uber Geek
+1 received by user: 390

Trusted
Subscriber

  Reply # 693956 1-Oct-2012 10:41 Send private message quote this post

So since it looks like they are chanign the search terms with javascript to remove things they dont like, has someone tried this yet? http://xkcd.com/327/




Richard rich.ms

738 posts

Ultimate Geek
+1 received by user: 47


  Reply # 693958 1-Oct-2012 10:42 Send private message quote this post

Another case of corporate marketing deadlines exceeding realistic delivery timeframes.





1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | ... | 36
View this topic in a long page with up to 500 replies per page Watch this topic Create new topic




Twitter »
Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:




News »

Trending now »
Hot discussions in our forums right now:

2010 Honda Jazz, Suzuki Swift - which has higher maintenance cost?
Created by joker97, last reply by KiwiNZ on 29-Jul-2014 20:15 (57 replies)
Pages... 2 3 4


2 x PS4s to give away. Geekzone members only.
Created by BigPipeNZ, last reply by PhantomNVD on 29-Jul-2014 20:18 (52 replies)
Pages... 2 3 4


Logitech K400r HTPC Cordless Keyboard Half Price
Created by Dynamic, last reply by Blanch on 28-Jul-2014 22:16 (25 replies)
Pages... 2


"keyless" keys - questions
Created by joker97, last reply by Handle9 on 29-Jul-2014 20:30 (24 replies)
Pages... 2


VF, why you lie to me?
Created by kenkeniff, last reply by kenkeniff on 29-Jul-2014 14:35 (46 replies)
Pages... 2 3 4


What do Police prioritise?
Created by tardtasticx, last reply by alasta on 29-Jul-2014 20:21 (22 replies)
Pages... 2


Dick Smith in Continual Sale Mode
Created by Dynamic, last reply by eXDee on 29-Jul-2014 19:23 (65 replies)
Pages... 3 4 5


Checking UHF aerial is working
Created by OnceBitten, last reply by B1GGLZ on 28-Jul-2014 21:49 (21 replies)
Pages... 2



Geekzone Live »
Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.

Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.