Weblate: Improper validation of unicode characters

unicode characters are not properly being validated on the https://demo.weblate.org/accounts/profile/preferences in specical character Screenshot showing this is attached below...

Weblate: Account Restore / Reactivating an old email via old reset link

Hi, I noticed you now send a confirmation link after loading the reset link, below is a screenshot showing the email and highlighting the error. F227060 Best Regards, @footstep...

Weblate: Add another email address without verification

Introduction In the normal case, to link another email address to the Weblate account, users need to own the email address and click the verification link. However, I found an issue, that allows adding another email address without clicking on the verification link. Description and PoC: Create a...

Weblate: Application allowing old password to be set as new password | hosted.weblate.org

Hi Team, I found an issue that your application is allowing user to set new password same as that of the old password. Steps to reproduce the defect -Firstly logged into the application with existing password refer screenshot named : Original Password login Request-Old password highlighted in...

Weblate: No rate limit or captcha to identify humans

Affected URL: https://hosted.weblate.org/hosting/ Issue: There is no captcha or rate limit to protect from bots against adding request for new project hosting. Which makes it easy for an attacker to perform spamming. Shall you need any more info notify me,...

Weblate: Missing Restriction On String Size

Similar to 223454, there is no string size restriction on project parameter which is sent directly to the server. URL: https://hosted.weblate.org/hosting/ PoC: poc1.png and poc2.png Shall you need any more info notify me,...

Weblate: [debian.weblate.org]-Missing SPF Record

Reproduction Details: dig txt debian.weblate.org|grep "v=spf1"...

Weblate: Reset password more than once with a reset link #2

Sequel to the fix on 243594, this is still possible. Reproduction Steps 1. Request password reset - Load the link in email and set a new password - Navigate to https://demo.weblate.org/accounts/reset/ - Fill the email and captcha - You'll be prompted to enter a new password NOTE: I figured that i...

Weblate: Running 2 accounts with a single email #3

Following the fixes: 241608 & 224072. there's still another way round this. Reproduction Steps 1. Register 2 accounts Preferably using Gmail not third party - Login both accounts on separate browsers - In Browser1, navigate to https://demo.weblate.org/accounts/profile/auth - Add a new association...

Weblate: Password token validation in Weblate Bypass #2

Hi, I also found the bypass to 229987 and 243842. Reproduction Steps: 1. Add multiple emails to an account 2. Request password reset for all emails 3. Use the link in each to make the change 4. All link works! Shuaib...

Weblate: Password token validation in Weblate Bypass

Hi, This is a bypass of the fix on 229987. I could confirm that old link still works. Though you would need to use 2 browsers to pull this off Reproduction Steps 1. In Browser1, request a password reset - Load link sent to your email in the same browser - Request another password reset in Browser...

Weblate: Improper validation of unicode characters #3

Hi! This issue also exists at Translations. Link: https://demo.weblate.org/translate/hello/master/gl/?type=all Screenshots F197895 F197896 Shuaib...

Weblate: No Rate Limitation on Regenerate Api Key

Hi, I discovered that there is no request throttling or limit on api key regeneration. Though theres a little change while making a total of 30 requests in a few seconds, server error occurred then it continued. Screenshot F197872 In the screenshot 685 denotes a processed request and 6052 denotes...

Weblate: Previous password could set as new password

Hi As resolved in 229577, I could still confirm this works. A previously set password could be set as a new one. Shuaib...

Weblate: Improper validation of unicode characters still not fixed #2

As resolved in 229483, I can't see a fix in the Full name field. The issue persists. Though this time it shows the decoded character on the error page but its not saved. Screenshot showing this is attached below. F197856 F197857 Shuaib...

Weblate: Reset password more than once with a reset link

Hi, Though passwords reset links cannot be used more than once but I found a case where one could do so. Reproduction Steps 1. Request a Password Reset on demo.weblate.org 2. Click the reset link in email 3. Enter a new password 4. Click Set my password 5. Then you'll be redirected to the login...

Weblate: No filteration of null characters in name field

Hello, Description: The account settings page, https://demo.weblate.org/accounts/profile/account, allows a user to set their username as a null character! A user intercepts the request using a proxy and changes the user name field to %00. Mitigation: I recommend you have filtering of null...

Weblate: Improper validation of unicode characters

Hi, I just saw a report of 229483 This issue still persist. When i tried some Unicode characters like smilies etc. It is working perfectly by displaying the Error message on the same page that Username may only contain letters, numbers or the following characters: @ . + - See 1.jpg for smilies...

Weblate: Persistence of Third Party Association.

After one might have disconnected a third party association, Google in this case. Using the third party login logs one back in the account...

Weblate: Running 2 accounts with a single email [Part 2]

Following the fix on 224072, I decided to try this in another way and it worked! Reproduction Steps 1. Login with Github on Browser1 and set a password to it. - With another email, signup on Weblate on Browser2 - In the new account on Browser2, do the following: Confirm email and Set a Password A...