From c52dedad6bbab4a8d42beb81463d3d57348f9001 Mon Sep 17 00:00:00 2001
From: = <=>
Date: Wed, 2 Sep 2026 16:54:13 +0000
Subject: [PATCH] Fix misleading validation-failure log message in
 AddPlayer/CreateNewAdmin

Replace the inaccurate "JavaScript validation bypassed" ERROR log with
an accurate WARN message describing a server-side validation failure.

- Log the length of the offending username/password/address fields
  instead of asserting a JS bypass, so operators can tell which
  constraint (username 3-32 chars, password 8-512 chars, address
  <=128 chars) was violated.
- Never log the actual field values (especially the password).
- Downgrade log level from ERROR to WARN, since this is a routine
  input-validation rejection, not a tamper signal.
- Apply the same fix to CreateNewAdmin.java, which had the identical
  issue.
- User-facing response message is unchanged.

Fixes #860
---
 .../java/servlets/admin/userManagement/AddPlayer.java  | 10 +++++++++-
 .../servlets/admin/userManagement/CreateNewAdmin.java  | 10 +++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/src/main/java/servlets/admin/userManagement/AddPlayer.java b/src/main/java/servlets/admin/userManagement/AddPlayer.java
index 401c32e48..de391e1ad 100644
--- a/src/main/java/servlets/admin/userManagement/AddPlayer.java
+++ b/src/main/java/servlets/admin/userManagement/AddPlayer.java
@@ -156,7 +156,15 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
               log.error("Invalid Addresses Detected");
               errorMessage += "Invalid Addresses Detected";
             } else if (!userValidate) {
-              log.error("JavaScript validation bypassed");
+              log.warn(
+                  "Server-side user validation failed for new player (username length="
+                      + userName.length()
+                      + ", password length="
+                      + passWord.length()
+                      + ", address length="
+                      + userAddress.length()
+                      + "); expected: username 3-32 chars, password 8-512 chars, address <=128"
+                      + " chars");
               errorMessage += "Invalid Request. Please try again";
             } else {
               log.debug("Class Not Found");
diff --git a/src/main/java/servlets/admin/userManagement/CreateNewAdmin.java b/src/main/java/servlets/admin/userManagement/CreateNewAdmin.java
index 873b4b282..805e84849 100644
--- a/src/main/java/servlets/admin/userManagement/CreateNewAdmin.java
+++ b/src/main/java/servlets/admin/userManagement/CreateNewAdmin.java
@@ -136,7 +136,15 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
               log.error("Invalid Addresses Detected");
               errorMessage += "Invalid Addresses Detected";
             } else if (!userValidate) {
-              log.error("JavaScript validation bypassed");
+              log.warn(
+                  "Server-side user validation failed for new admin (username length="
+                      + userName.length()
+                      + ", password length="
+                      + passWord.length()
+                      + ", address length="
+                      + userAddress.length()
+                      + "); expected: username 3-32 chars, password 8-512 chars, address <=128"
+                      + " chars");
               errorMessage += "Invalid Request. Please try again";
             }
             out.print(