Uploaded image for project: 'phpBB3'
  1. phpBB3
  2. PHPBB3-10184

Bots can be sent private messages

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 3.0.8
    • Fix Version/s: 3.0.12-RC1
    • Labels:
      None
    • Environment:
      all environments - this bug exists on every phpBB installation.

      Description

      Hello,

      It is possible to send PMs to bots (3.0.8)!
      Bots are not visible at the member page, but there is a way to access their profile, however:

      [*]Open a users profile.
      [*]Edit the adress bar (change the User-ID - In my case, Bing[bot] was ID 63).
      [*]The bot has got an profile! And he has got an "PM"-button, too.
      [*]Using this button, you can write personal messages to bots. Nobody will ever realize that the bot has got messages, but they are able to flood the forums database and evil users could use this to overload it (with attachments etc.).

      Even an administrator of the forum is not able to view the messages of other users, so it is not possible to delete such messages! :shock:
      An evil user is able to flood the forums's server with [Number of bot-accounts] * [PM inbox limit] * [forum attachment limit MB] MB of undeleteable attachments. If there are 50 bot accounts and the inbox limit is 50 messages and the attachment limit is 1 MB, this means it is possible to send 2500 MB = 2,5 Gigabytes of attachments to bot accounts!

      I suggest turning user_allow_PM off for bot accounts by default.

      I am attaching a screenshot.

      Sorry for my bad english. :|
      If you were not able to follow the steps, I will make a screencapture.

      ToBeFree

        Issue Links

          Activity

          Hide
          Derky Derky added a comment -

          Only admins can view the profiles of bots. So only admins are able to PM the bots.

          E.g. try this link:
          http://www.phpbb.com/community/memberlist.php?mode=viewprofile&un=Google%20[Bot]
          You'll not be able to view that profile.
          Then try this part on your own board as admin and you will be able to see it: "memberlist.php?mode=viewprofile&un=Google%20[Bot]"

          Though I do like your suggestion about setting the default 'allow PM' preference to false for bots.

          Show
          Derky Derky added a comment - Only admins can view the profiles of bots. So only admins are able to PM the bots. E.g. try this link: http://www.phpbb.com/community/memberlist.php?mode=viewprofile&un=Google%20[Bot ] You'll not be able to view that profile. Then try this part on your own board as admin and you will be able to see it: "memberlist.php?mode=viewprofile&un=Google%20 [Bot] " Though I do like your suggestion about setting the default 'allow PM' preference to false for bots.
          Hide
          ToBeFree Tobias Frei added a comment -

          Oh, okay, you're right.

          But http://forum-url.tld/ucp.php?i=pm&mode=compose&u=63&sid=xyz works for non-admins, too, doesn't it?
          You just have to replace 63 with a bot's user ID.

          Show
          ToBeFree Tobias Frei added a comment - Oh, okay, you're right. But http://forum-url.tld/ucp.php?i=pm&mode=compose&u=63&sid=xyz works for non-admins, too, doesn't it? You just have to replace 63 with a bot's user ID.
          Hide
          nickvergessen Joas Schilling added a comment -

          Users without moderator/admin permissions receive the

          "Some users couldn’t be added as they have disabled private message receipt."

          message, which they also get, when a user selected to not receive PMs.

          Show
          nickvergessen Joas Schilling added a comment - Users without moderator/admin permissions receive the "Some users couldn’t be added as they have disabled private message receipt." message, which they also get, when a user selected to not receive PMs.
          Show
          nickvergessen Joas Schilling added a comment - Reopened as per https://github.com/phpbb/phpbb3/pull/589#issuecomment-4571934

            People

            • Assignee:
              nickvergessen Joas Schilling
              Reporter:
              ToBeFree Tobias Frei
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development