CCBill - Do they have the ability to login to any user account on a VB forum?

[greetingsjb]

Curious if anyone else has experienced this. Going through logs and the multiple login detector forum it looks like CCBill or someone associated with them has the ability to login to any account. Has anyone else run into this or have some insight to offer on this?

Thanks

[Ramsesx]

How should this be possible, the passwords are secret. From what data exactly did you got this assumption?

[greetingsjb]

its been confirmed- they do have the ability to do that

[Wayne Luke]

its been confirmed- they do have the ability to do that

Why are you sending them the username and password? In the default system, we send 'unknown' for both of these values. Probably to prevent this issue.

[greetingsjb]

Where do I edit what is sent to them?

[Wayne Luke]

In the template subscription_payment_ccbill.

The default contents are:

<input type="hidden" name="clientAccnum" value="{vb:raw settings.clientAccnum}" />
<input type="hidden" name="clientSubacc" value="{vb:raw settings.clientSubacc}" />
<input type="hidden" name="formName" value="{vb:raw settings.formName}" />
<input type="hidden" name="subscriptionTypeId" value="{vb:raw subinfo.ccbillsubid}" />
<input type="hidden" name="allowedTypes" value="{vb:raw subinfo.ccbillsubid}" />
<input type="hidden" name="email" value="{vb:raw settings.email}" />
<input type="hidden" name="hash" value="{vb:raw hash}" />
<input type="hidden" name="username" value="NOUSERNAME" />
<input type="hidden" name="password" value="NOPASSWORD" />
<input type="hidden" name="noCache" value="1" />