From 2509cdbc7f0ebd800ed708453075e7d2234e8ece Mon Sep 17 00:00:00 2001 From: albertlast Date: Mon, 10 Aug 2026 07:04:50 +0200 Subject: [PATCH] Lets the registration form ask whether a username is taken The check the form makes as the username is typed answers 403 to everyone it exists for, and 3.0 now treats that as no answer at all. The guard wants Config::$cookiename in $_COOKIE. That is the login cookie, so the only people who get past it are the ones who already have an account. It then does not stop: sendHttpStatus(403) returns, and the XML it was refusing is written out underneath the refusal. 2.1 got away with that because its raw XMLHttpRequest never looked at the status. 3.0's wrapper does - smc_Request.fetch() rejects anything that is not res.ok - so the promise fails, getXMLDocument() calls the callback with false, and the icon beside the field never moves whatever is typed into it. Asks for a session and a referer from this forum, which is what the check was after, and stops when it refuses. Co-Authored-By: Claude Opus 5 Signed-off-by: albertlast --- Sources/Actions/Register.php | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/Sources/Actions/Register.php b/Sources/Actions/Register.php index d6cbf6d375..17a34dfde4 100644 --- a/Sources/Actions/Register.php +++ b/Sources/Actions/Register.php @@ -347,9 +347,18 @@ public function show(): void */ public function checkUsername(): void { - // Who are you again? - if (empty($_COOKIE) || empty($_COOKIE[Config::$cookiename]) || empty($_SERVER['HTTP_REFERER']) || stripos($_SERVER['HTTP_REFERER'], Config::$scripturl) !== 0) { + /* + * Who are you again? Somebody with a session, who got here from a page + * of ours. Config::$cookiename is the login cookie, and the person + * filling in the registration form has not got one by definition, so + * asking for it turns everybody this is for away. + */ + if (empty($_COOKIE) || empty($_SERVER['HTTP_REFERER']) || stripos($_SERVER['HTTP_REFERER'], Config::$scripturl) !== 0) { + // And that is the whole answer. Carrying on would send the status + // and then the very thing it was refusing. Utils::sendHttpStatus(403); + + Utils::obExit(false); } // This is XML!