diff --git a/includes/account.php b/includes/account.php index 9c68371..a702eb6 100644 --- a/includes/account.php +++ b/includes/account.php @@ -19,6 +19,13 @@ if($process != "" && $oldid == 1) { $id = 1; + if(strstr($newemail, "xn--") && $_SESSION['profile']['codesign'] <= 0) + { + showheader(_("My CAcert.org Account!")); + echo _("Due to the possibility for punycode domain exploits we currently do not allow any certificates to sign punycode domains or email addresses."); + showfooter(); + exit; + } if(trim(mysql_escape_string(stripslashes($newemail))) == "") { showheader(_("My CAcert.org Account!")); @@ -289,6 +296,14 @@ if($oldid == 7) { + if(strstr($newdomain, "xn--") && $_SESSION['profile']['codesign'] <= 0) + { + showheader(_("My CAcert.org Account!")); + echo _("Due to the possibility for punycode domain exploits we currently do not allow any certificates to sign punycode domains or email addresses."); + showfooter(); + exit; + } + $newdom = trim(escapeshellarg($newdomain)); $newdomain = mysql_escape_string(trim($newdomain)); @@ -837,7 +852,7 @@ if(strlen($_SESSION['_config']['user']['pword1']) < 6) { echo _("The Pass Phrase you submitted was too short."); } else if($score < 3) { - echo _("The Pass Phrase you submitted failed to contain enough differing characters and/or contained words from your name and/or email address. Only scored $score points out of 6."); + printf(_("The Pass Phrase you submitted failed to contain enough differing characters and/or contained words from your name and/or email address. Only scored %s points out of 6."), $score); } else if(mysql_num_rows($match) <= 0) { echo _("You failed to correctly enter your current Pass Phrase."); } else { diff --git a/includes/account_stuff.php b/includes/account_stuff.php index 5c1887d..b50ddc2 100644 --- a/includes/account_stuff.php +++ b/includes/account_stuff.php @@ -134,7 +134,7 @@ function hideall() {