密码验证码的逻辑错误

Posted

技术标签:

【中文标题】密码验证码的逻辑错误【英文标题】:Logic errors with password authentication code 【发布时间】:2020-01-13 06:12:16 【问题描述】:

我的代码如下:

@IBAction func clicked(_ sender: Any) 
        let ref = Database.database().reference()
        let pass = password.text
        var firpass = ""
        var bool = false;
        ref.child(name.text as! String).child("password").observeSingleEvent(of: .value, with:  dataSnapshot in
          firpass = dataSnapshot.value as? String ?? ""
            if firpass == pass 
                bool = true
            
            if bool 
                self.sendname = self.name.text!
                let vc = DatabaseTableViewController(nibName: "DatabaseTableViewController", bundle: nil)
                vc.finalName = self.sendname
                self.navigationController?.pushViewController(vc, animated: true)
                self.performSegue(withIdentifier: "username", sender: self)
             else 
                let alert = UIAlertController(title: "Error", message: "Incorrect username or password", preferredStyle: UIAlertController.Style.alert)
                alert.addAction(UIAlertAction(title: "OK", style: UIAlertAction.Style.default, handler: nil))
                self.present(alert, animated: true, completion: nil)
                self.performSegue(withIdentifier: "failed", sender: self)
            
        )
    

    override func shouldPerformSegue(withIdentifier identifier: String?, sender: Any?) -> Bool 
        if let ident = identifier 
            if ident == "failed" 
                return false
            
        
        return true
    

当我输入正确的用户名和密码时,我会转到下一页,但出现以下错误:

Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: 'Receiver (<OCRApp.ViewController: 0x105e00f60>) has no segue with identifier 'failed''
*** First throw call stack:
(0x1877aaa48 0x1874d1fa4 0x18b206010 0x104a5b58c 0x104a5ba20 0x104aaa19c 0x104aaa598 0x104a8bb40 0x105cd97fc 0x105cdabd8 0x105ce8c34 0x1877285e4 0x1877235d8 0x187722adc 0x1916a8328 0x18b81dae0 0x104a6cdb0 0x1875ac360)
libc++abi.dylib: terminating with uncaught exception of type NSException

当我输入错误的用户名/密码时,我仍然转到下一页,我得到了上述错误,但标识符为failed;当我取出self.performSegue(withIdentifier: "failed", sender: self)这行时,我还是转到了下一页并收到消息:

Warning: Attempt to present <UIAlertController: 0x102978a00>  on <OCRApp.ViewController: 0x10170a650> which is already presenting <OCRApp.DatabaseTableViewController: 0x10206beb0>

如果您进行了正确的身份验证,我想要的是没有错误地进入下一页,如果您提供了不正确的身份验证,则只获得警报并停留在当前页面上。我该怎么做?

【问题讨论】:

参考本教程将有助于segue概念codingexplorer.com/segue-swift-view-controllers 为什么你执行 segue 你已经在推送视图控制器,你不能同时执行这两个。从你的代码来看,我认为你不需要那个 segue 代码。 【参考方案1】:

无论是使用 push 还是 performSegue,都不能同时使用。这将推动您的视图控制器两次。我已经更新了下面的代码。

@IBAction func clicked(_ sender: Any) 
    let ref = Database.database().reference()
    let pass = password.text
    var firpass = ""
    var bool = false;
    ref.child(name.text as! String).child("password").observeSingleEvent(of: .value, with:  dataSnapshot in
        firpass = dataSnapshot.value as? String ?? ""
        if firpass == pass 
            bool = true
        
        if bool 
            self.sendname = self.name.text!
            let vc = DatabaseTableViewController(nibName: "DatabaseTableViewController", bundle: nil)
            vc.finalName = self.sendname
            self.navigationController?.pushViewController(vc, animated: true) // either use push or performSegue, you cant use both.
            //   self.performSegue(withIdentifier: "username", sender: self)
         else 
            let alert = UIAlertController(title: "Error", message: "Incorrect username or password", preferredStyle: UIAlertController.Style.alert)
            alert.addAction(UIAlertAction(title: "OK", style: UIAlertAction.Style.default, handler: nil))
            self.present(alert, animated: true, completion: nil) // if there is an error, you do not need to performSegue.
            //    self.performSegue(withIdentifier: "failed", sender: self)
        
    )

【讨论】:

【参考方案2】:

我们没有关于你的 segues 的信息,我建议你 instantiate 你的下一个 ViewController。你可以使用这样的东西:

let vc = UIStoryboard(name: "Main", bundle: nil).instantiateViewController(withIdentifier: "NextViewController") as? NextViewController
present(vc, animated: true, completion: nil)

【讨论】:

以上是关于密码验证码的逻辑错误的主要内容,如果未能解决你的问题,请参考以下文章

验证码的案例session

密码重置漏洞

八漏洞原理利用验证码绕过,密码找回漏洞 笔记和靶场

验证码以及登录模块的逻辑漏洞

关于登录模块测试思考总结

[8期]浅谈当代安全验证问题