Napping.Synth.DownloadOH MY GOD
so
ÖBB disabled easy name changes via their settings UI
*but*
i was like "eh, i wonder if i can just... un-disable the input field via devtools"
so i did
and it worked
ÖBB didnt validate the random name change in their backend
|
17 comments
@schrottkatze trying to see if this is possible on the Magenta site, which is doesn't allow changing the name or the contact email @schrottkatze can unlock the fields, and the save button, but that alone doesn't seem to allow it to save hmm... @schrottkatze I think the save button literally just doesn't do anything, since you're not supposed to actually be able to change anything on this page lmao @schrottkatze I am forever reminding my devs that the backend should treat all Input like it's coming from a third party using our API for their product. @indiealexh and i am reminding you that if you build something like this web app, restricting names for trans people, that you should just do it badly @schrottkatze thankfully my work is not in any such space. My work is mostly around the collection of research data and the services / people supporting the researchers / research. @schrottkatze have you tried changing any elements likely to go into the WHERE clause of the SQL? Although, if that turns out to allow you to change other people's names, you get the ethical conundrum of disclosure possibly also fixing the other client side validation "feature". @sophieschmieg no, i'm happy changing my own name. probing for other vulnerabilities is an exercise to the reader @sophieschmieg @schrottkatze changing everyone's name to be the same @schrottkatze lol. lmao even. "einmal mit Profis" hat also manchmal tatsächlich sogar praktische Folgen :awesome: @schrottkatze so *that's* this DIY transition thing I've heard so much about |
anyway, PSA for austrian trans people who didn't change their name in ÖBBs system i guess:
ÖBB doesn't allow you to change your name easily
you can do that anyway if you open devtools, find the input element for the first name, and just remove "disabled="""
you can just click save and... it saves correctly.
:BoostOK: