OWASP/NodeGoat

Unable to save changes to First Name field on the profile page

ckarande opened this issue · 3 comments

The changes to first name field on the profile page do not get saved

@ckarande is it possible you missed filling the bank code number down in one of the fields?

@lirantal thanks for the hint. Yes it looks like the bank code is a required field and the form won't save unless it is specified.

On exploring it further, I realized that the changes to the firstname field actually do get saved on the server; however, it is not set correctly in the template in the response coming back to the browser on update request. In the profile.html, the template is populates the field with firstNameSafeString and the object returned from the profile-dao.js doesn't include this field.

              <input type="text" class="form-control" id="firstName" name="firstName" value="{{firstNameSafeString}}" placeholder="Enter first name">

This is issue only with the updateProfile function in the routes/profile.js. The other function displayProfile works correctly as it sets the firstNameSafeString in the response.

On loading the profile page again by clicking on the profile link, the firstname does show up on the UI. So as part of this issue, we need to verify why the response

Are you sure?
It looks to me like when you fail to add the bank routing number then nothing in the form gets saved. Not the firstname either.

However what I did notice is that when the error comes back to the client-side no data on the form is populated so it leaves it all blank.