Saturday, February 16, 2019

Magnolia App: Facebook Messenger Sharing: Just a picture, not a link, when sharing via FB messenger

Magnolia Market app (version 1.11.1)
Date: 02/16/2019

Description:

When you share an item for sale on the Magnolia Market app using Facebook Messenger,

Please see the attached screenshots.

Steps to Reproduce:
1. Download and launch the Magnolia Market app for iOS
2. Select any item that is for sale
3. Scroll down to the "SHARE TO" area and select the up arrow that triggers the iOS sharing option
4. Select Messenger

Result: No link to the item for sale - just a photograph

Expected: Should be a link to the item for sale

Scroll down and select the SHARE TO option (the up arrow)

Select the Messenger option....
Just a photo, no link....

Sunday, February 10, 2019

Jiffy - App crashes if you deny camera permission to scan credit card, then try to re-enter that screen

Jiffy app for iOS (version 5.1.13)
Date: 02/10/2019

Description:

There is a crash with the Jiffy app for iOS. It's not likely that any end user will ever run into this issue, but it is still a crash nonetheless.

Here's a video of it:


Steps to reproduce:

1. Download and launch the Jiffy app for iOS
2. Create a new account
3. Select the profile option in the bottom right hand corner of the screen
4. Select "Payment details"
5. Select the "+" in the upper right
6. Select "Scan"
7. Deny camera access from the pop up
8. Select "Scan" again

Result: Easy to reproduce crash on the "Payment details" area of the iOS app. Select the "Scan" option - deny camera access. Then select "Scan" again

Expected: App shouldn't crash

Magnolia App - Twitter Authorization Pop Up - Dead "Privacy Policy" Link

Magnolia app (version 1.11.0)
Date: 02/10/2019

Description:

There is a dead "Privacy Policy" link on the twitter authorization pop up from the Magnolia app. Nothing happens when the user selects this link. The other link for Magnolia works, but the "Privacy Policy" link does not.

Please see the video:


Steps to Reproduce:

1. Download and launch the Magnolia app
2. Go to any product
3. Scroll down and select Twitter from the "SHARE TO" option
4. From the "Sign in to connect your account" Twitter authorization pop up, scroll down and select "Privacy Policy"

Result: Magnolia's Privacy Policy link on the Twitter authorization pop up is a dead link

Expected: Magnolia's Privacy Policy link on the Twitter authorization pop up should be a working link

Sunday, February 3, 2019

Zola: Canceling out of Facebook Messenger pop up results in a message that the user has successfully shared an item

Zola app (version 6.0.8)
Date: 02/04/2019

Description:

There is a minor (and somewhat aggravating) bug with the Zola iOS app and Facebook Messenger sharing.

If you go to any product for sale on the Zola app, there is a social media sharing pop up on the right side of the screen. If you select the "Messenger" option, the Facebook Messenger list will pop up.

If the user cancels out of this list, the app will display a ribbon at the top of the screen that states the product was "successfully shared"- presumably via Facebook Messenger.

This is scary for users, as I don't want to spam Facebook Messenger contacts. I worried that this message meant that I had just sent a product page to all of my FB Messenger contacts! If possible, could you remove this ribbon if the user cancels out of sharing a product via Facebook Messenger?

See the video for more information:

Steps to Reproduce:
1. Download the Zola iOS app
2. Select "I WANT TO SHOP"
3. Select any of the trending products
4. Select the share icon
5. Select "Messenger"
6. Cancel out of the Facebook Messenger pop up
7. Note the ribbon message at the top of the screen that says the product was shared

Result: Backing out of Facebook Messenger sharing results in message stating that the product was "shared" successfully

Expected: No message about a successful "sharing" of a product if the user cancels out of the Facebook Messenger pop up in the iOS app

Click To Pray: Incorrect Warning Message: Trying to delete profile photo results in an error message about deleting the account

Click To Pray app (version 1.0.8)
Date: 2/03/2019

Description:

There is a minor bug on the edit settings portion of the "Personal Information" section of the Click to Pray app.

After selecting "Change Photo" there appears on the screen a drop down menu labeled as "Image options".

This image options drop down menu has a "Delete" option to delete the user supplied profile photo. There is an incorrect error message if the user selects the "Delete" option. Instead of an warning message about deleting your profile photo, a message appears that asks, "Are you sure you want to delete your account?".

This warning message is not correct, as confirming this message simply deletes the user supplied profile photo. It does not lead to the deletion of the account.

This message should be amended to "Are you sure you want to delete your photo?" instead.

Please Note: This is a bug about the error message - not about functionality.

Steps to Reproduce:

1. Download and launch the Click to Pray app
2. Create an account and sign in
3. Select the person icon in the upper right hand corner of the screen
4. Select the gearbox settings icon
5. Select "Personal Information"
6. Select "Edit"
7. Select "Change photo"
8. Select the "Delete" option
9. Note the error message that displays as "Are you sure you want to delete your account?"

Result: Incorrect warning message about account deletion after the user tries to delete their profile photo

Expected: A correct warning message to the user about the deletion of their photograph - not their account

Please see the attached screenshots. Thank you!

Select the "Delete" option from this menu...

The "Are you sure you want to delete your account?" warning message is incorrect, as selecting the "Accept" option does not delete the account, it simply deletes the profile photo. Please change the text of this error message.

Monday, January 28, 2019

Crate & Barrel: Twitter Sharing: No working link back to website from Tweets generated from within the app

Crate & Barrel app (version 4.8)
Date: 01/29/2019

Description:

There is no working link back to the app or the website, from within a tweet generated by sharing an time.

There is only a photograph - no working link.



Steps to Reproduce:
1. Download and launch the app
2. Select "Shop"
3. Select any item
4. Scroll down to the "Share and Save" option for any time
5. Select the Twitter share option

Result: Only a photograph of the time you chose to share - no working link back to the website

Expected: Should always be a working link.

Monday, January 21, 2019

Bartels Giant Burger App for iOS - vulnerable to self directed Cross Site Scripting error

Bartels Giant Burger app for iOS
Date: 1/22/2019

Description:

The Bartels Giant Burger app is vulnerable to a self directed, cross site scripting error. This occurs after the user enters in a term like "<plaintext>" into the location search box.

I would assume that a number of other XSS errors can be triggered in this box.

This is easier to show than it is to describe, so please see the attached video:



Steps to Reproduce:
1. Download the Bartels Giant Burger app
2. Launch the app
3. Select "Locations" from the sidebar
4. From the "Find Your Store" screen, click inside the "Zip or City, State" input box
5. Enter in "<plaintext>" and run a search

Result: A search of "<plaintext>" in the "Find Your Store" location box of the Bartels Giant Burger app results in an XSS error

Expected: A search of "<plaintext>" in the "Find Your Store" location box in the Bartles Giant Burger app should not result in an XSS error