i mean wtf

I understand some people write:
If Boolean == true

It is more readable for them.

But if true

Else if false

That I cannot understand why... Seriously wtf!

So the accounts database gets copied to the frontend to evaluate and passwords are plain text?

Nice.

I'm calling the police...

@Meta just noticed that lol.

I hope OP did the Todo note I mean better put it in a different file and make it harder for the hacker to find it 🤷🏼‍♂️

@Brosyl this is the result of failing Data structure & Algorithms course

Wby bother with loading users table at all. Just go fuck all and set the cookie value to logged in regardless of what bullshit is entered as username and password

Its not any fucking code, Its a piece of art... I'm going to get it framed right now.

I cry everytime i see this

Using client-side scripting to handle auth. I mean, why even evaluate the password? The dev world needs to fall the fuck out of love with JavaScript.

Please, for the love of god tell me this is fake.

Out the developer who wrote this

@bahua Why blame the language instead of the obviously incompetent developer?

@MonkeyParade

Because the dev's biggest mistake is the use of JavaScript for this. Handling auth on the client side is inherently insecure. Since all the code is visible to the client, they can just set the auth variable themselves to ignore the evaluation segment entirely.

@bahua but that isn’t the languages fault it’s the retard who wrote the code.

@delegate212

Yes, but there's literally no way to do this securely, with JavaScript.

@bahua Its not a language issue its a placement issue. The auth implementation should be placed serverside not client side. You could implement it in Node using JS server side if you wanted.

This is wrong on so many levels...

Bloody fucking hell, this is a masterpiece.

Take the keyboard away from this "dev" and shove it up his ass.

Edit: had to put dev it quotes.

What I especially love is how it loads every user’s username and password into client-side memory.

Anyone with a console could learn every other user’s password.

No one mentioned the todo...

OH. MY. GOD.
Beautiful.
EXXXXXXQUISITE!
AJAXing your sql query from frontend as plaintext into backend which i bet just dumbly pipes it right into the database...
YUM.
Bobby Tables approves.

@bahua yes there is, its called nodejs and it can be run on the server.

Haha, at least he used triple equals 😂

This is exactly why you should pay your dev a good paycheck.

This is... Scary. Very.

I really wanted this to be node.js when I previewed the image.

This is a joke, right? This just cannot be true.

"true" === "true"
My god just kill me

@CodeMasterAlex the joke is that this is true

http://programmingpolice.com

I own that domain.

reply if anyone wants to develop that idea with me.

code like this needs police

and it needs to be jailed

@rant1ng I say you turn it into a programmer's hall of shame and showcase (anonymously) terrible code that people have encountered in the wild.

Would be great both as a learning tool and just for a laugh!

@devios1 that is a good idea, I want to allow people to submit them, they get voted on, there can be replies and discussion, suggestions on how to fix them, even some roasting

that's just too much and I've got loads on my plate, maybe ill submit a collab, see if someone picks it up

there would be money of course

@rant1ng I think it's a great idea, but I'm the same, quite busy with other stuff atm and not really looking to get heavily involved in a web project, but I'd be interested in actually using such a site and maybe brainstorming some ideas.

Kill it with fire.

@bahua I agree re: JavaScript. IMO it was designed for enhancing web frontends and should not have been ported to backend. It just seems to encourage laziness and/or confusion problems like in the OP’s screenshot.

Although, full disclosure: I have done some react native development

What a gem you have got.
You can now start course on hacking.
Start with this as introductory video and then make a course on Udemy earn for life 🤑🤑🤑🤑🤑🤑🤑
The following course will be the same as others
- don't store password in plain text
- using metasploit
- hacking XP
- tor
- dark web ...

Oh I missed block-chain and AI.

If this is not a fake then it was written by an amateur.
Not only he/she is using 'var', but he actually uses a for loop.
For years now JavaScript has been declarative.
People iterate using methods (especially when using jQuery), or at least a 'for in' or 'for of' loop.
Then there's the different brackets styles, poor logic and the redundant, counter intuitive condition for the False return.
Not even talking by the login algorithm itself.

@Noob these code will go around the internet for tens of years. So no blaming for var/for loops.

@Codex404 true, but thq quality of the image and the monokai color theme make me think that it's relatively new.

@Noob it's because I took the image from my ide of a clone of his git repo

@bigworld12 how old is the code?

@Codex404 the latest update to that file was ~2 months ago

Ooh well fuck! And my day is ruined just like that!

@CodesNotHot see it like this: all the code you will write today will be better than this.

At least SQL Code injection while login is not possible. Well everything else....

Pretty optimistic security level

The real concern... Did he ever fulfill that todo? 😂

What in the name of Jesus’ Mexican dicknuggets is this shit?

1. Why is the database copied to the frontend in its entirety on each login
2. Why is the input not validated in any way
3. What the fucking fuck is ‘if (“true” === “true”)’
4. What the fuck is the brace style there
5. Plaintext passwords?!

I have so many questions

@linuswillner to answer point 3: thats an if statement with a condition that returns true

@Codex404 Yes thank you Cpt. Obvious but why the hell is it there? What function does it have?

@linuswillner maybe it’s checking, whether the ===-Operator is still working...

I mean, you can do wierd stuff in JS...

@dder Tbh not far-fetched at all

@linuswillner yup, referring to this crazy „canthiseverevaluatetotrue“-riddle of the recruites it is not at all!

@rstular I've been telling myself to post a collab for a week now

I should just do that today ... ill do it tonight, no matter what

At least they avoid SQL injections...

@Meta it looks like you can just run queries straight from your browsers console. Lemme just change everyone's login details real quick

why even bother with sql injection when you can execute
apiService.sql("drop table users");

@bigworld12 How about apiService.sql(“UPDATE users SET password = ‘12345’”)? 🙂

Oof.

if true === true return false 🤣

if ("true" === "true") {return false;}

Reminds me of my ex.

That's what I call serverless

Sometimes I use `x === false` because x could be 0 and that would return true in `!x` which I don't want

@rant1ng sounds like something possible within a week if you use laravel 😉

The monsters live among us XD

O goshh .... Kick that guy out of your team :O

Please God kill me. I can't see these things anymore.

Tell me this isn’t real

You just know that whomever wrote this has one or more extra chromosomes.

...is that sql in front end JavaScript...?!
****infosec intensifies ****

The guy who wrote was pretty gutsy or it never meant to be in production 😆

@Brosyl this is neither An async nor callback promise. There’s to way to get it work regardless the conditions

Support for parralel universes ;)

Have you tried replacing it with "DROP TABLE users"?

This code sucks like a pornstar