I am at a loss for words. This JavaScript powers the login of a company's intranet

What the.... does someone not know how to use a WHERE clause?

O M G.

No, please NO! Tell me this is just a lame joke!

Why the fuck is there an API service calling SQL?

@nblackburn SQL injection made easy, you know 😂

Let's not miss the TODO at the top because... That would be better?

@pstuart2 Of course, if the file is named secret.js and starts with a comment warning not to edit or read that file

speechless

I love how it checks if true is still true lol

WHAT THE HELLLLL???

Haha now that's a good one

This has to be fake. If true = true return false block gives it away as a lame attempt to show bad code.

At least that's my assessment of this. I could wrong, and this could actually be someone's real code, and exposed on the internet somewhere. :P

@yo-adrian intranet*

@fyroc wait that's what caught your eye? Not the fact that some api accepts sql queries?

I saw that and typed internet, thinking, if the code is that bad... anything is possible, code could float up to the internet someday.

@yo-adrian He did say intranet so not exposed (if it is a large company it is still problematic as hell though).

I would not be surprised if it was real, i've seen much worse. (Non technical companies buying custom software from the lowest bidder and getting pretty much what they pay for isn't all that uncommon)

' if ("true" == "true") ' Nice :D

@ChappIO And that the passwords are stored in plaintext 😰😱

Ok....
I hope the original dev was found behind the shed, with a bullet holes in both hands, and the head.

@ItsNotMyFault uhm and itsNotYourFault... 😁

@ItsNotMyFault yeah, see my explanation. I probably should have thrown that in my first response.

could have been written by my former "lead dev". i think i don't have to tell you the reason he's no more.

I am very confused about line 556

@srivmanu he just felt like wasting an if. If it's true, it won't leave continue past the for, so he's just being silly with the base case

What to the actual fuck lol

Shit on me!

What site is that??

"DROP TABLE users;" anyone? xD

Wow... Someone needs fired.

@qbasic16 @arantr Explain? I don't see a vulnerability.

@ronakkaria @ronakkaria Well obviously the passwords are stored in clear text, so you basically have every pw of every user ;)
Maybe you can't hack the DB, but even then it is a huuuuuuge fail.

@ronakkaria Because of the <script> tags I assume that this JS code is run on the client side (in the browser). So anyone can go and edit the code and use the exposed API to run *any* SQL queries like `drop table users;` and similar. And apiService seems to be global, so console is enough.

And the fact that you have access to every password in the system is a problem not only for this system but also because most users tend to reuse the passwords in multiple services... so...

Dude....

My ministry of DEFENSE is running Joomla 1.5.
😐😐😐😐😐

And no I won't say which country :D

@antonis179 Wild guess: Greece?

@arantr
Gotta change that username 🤔🤔
But I didn't say it! 👼👼👼

O. M. F. G. 😨

@ChappIO I mean I didn't want to assume that this was Frontend. Could've been an electron or Cordova app

@fyroc but even then... Just extract the app package and there you go. Happens...

@yo-adrian i guees you are right. "true" == "true" (its a String!!!!)... Thats to lame.

Even if its in Intranet...

The most beautiful part is that he retrieve the whole user table... with what we can assume, password in clear!!

@arantr @qbasic16 ohh.. didn't even notice this was client side :P. Brain fart. Saw sql and apiService and, just imagined this as node. (Fail)

#dehydrated

Now with a clearer head I see that call to get the accounts is treated as synchronous. There's no callbacks! Wut. So this cannot even work. This is a joke right?

@qbasic16 noticed the passwords thing before. Didn't see the sql injection. Lol. I need sleep

if("true" === "true"){
return false;
}
😭😢😂

Oh my. So many things wrong with it I cannot hold...all the jokes....brain freeze.

Can you git blame that please so none of use will ever hire this person.

The passwords are stored in plain text??
The stupidity of "professionals" never ceases to amaze me

stores passwords in plain text file called passwords.txt

Two wrongs a right do not make.

But two trues make a false...
...according to that javascript which looks fake.

@srivmanu me too. then it would return false? that would showthe error message right? or not? haha. I think my logic is failing XD

You gonna have to give credit to the man, he wants to put the js-code into a different file, for better security i guess 😅

I can't stand the pain, this is wrong in so many ways.

There is no need for a sql injection just modify the js to be true always and Tada no authentication!!

Haha true === true of course. This is the worst implementation on login I've ever seen. Doesn't someone know about server side code?

"Oh yes, little Bobby tables we call him.."

This is the best I have seen all day 😅

Fuck dis shit man, that ain't right!

Only single line have no security flaws - comment

You could have a lot of fun with that in the console.

This code doesn't work cause the http call is async.

@clay it can be both sync and async -https://developer.mozilla.org/en-US...

@one541 TIL

I'm surprised by first todo, then I'm confused by SQL API call? I totally doubt my life when true true thing comes...

#rantOfTheWeek congratz

It's getting harder to breathe. My face is turning blue. There's only fear in my eyes.

MY EYES !

Console.log (accounts) 😉

I think this was made by someone who just started coding. Otherwise this was made by a pm who thought that devs are a waste of cash.

😕

@Sauruz What does that have to do with this?

If true is true it's false :D

It's only missing a 'goto'

@Sauruz Does the developer above look capable of that?

@Sauruz I meant from the shitty code :P

I'm sleeping now. Wake me up when this is fixed!

@antonis179 or you could change your location

@zubin10 but to what... Maybe Mars? Hmmmmm

WTF this can't be real... This would also suggest that the passwords are not encrypted?!

This is so fun😂😂
only if this was real, oh. wait a sec-😑

This is code rape. Please someone arrest the guy who wrote this

My fucking eyes!!! This is disgusting!

If there is somebody getting paid to do that, I can get it too, even without any professional experience! Better than that I certainly do.

It can be worse, the SQL user can have power to drop tables too...

And to think that the best improvement the author could think of was abstract this garbage to a different file.. lmfao 😂