1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
  2. Hey Guest, is it this your first time on the forums?

    Visit the Beginner's Box

    Introduce yourself, read some of the ins and outs of the community, access to useful links and information.

    Dismiss Notice
Cookies New to the forums?

I broke the user list on the website

Discussion in 'General Discussion' started by plaintext, Jun 26, 2011.

Mods: Hella, Lieber, ParaLogia
  1. plaintext

    plaintext Guest

    Hey guys!

    My in-game name is <plaintext>, and I registered on the main site and my name kinda broke the user list, as it's a deprecated html tag :P
    This means a malicious user could use cross-site scripting to do whatever bad stuff they want to do. Redirect the site to porn, steal sessions, etc. So this is a shout-out to the people who run the site: you may want to use the htmlentities() function to defend against xss :)
    Sorry for breaking that list, I only realised it may not be filtered after I registered

    This is the link to the user list:
    http://www.kag2d.com/users.php
     
    plaintext, Jun 26, 2011
    #1
  2. darDar

    darDar KAG Guard Forum Moderator Tester

    Messages:
    325
    lol
     
    darDar, Jun 26, 2011
    #2
  3. Monsteri

    Monsteri Slower Than Light Tester

    Messages:
    1,916
    hmm lol indeed :D
     
    Monsteri, Jun 26, 2011
    #3
  4. Zenrix

    Zenrix Guest

    Huh, does that mean it does it in posts too?

    <i>Test</i>
     
    Zenrix, Jun 26, 2011
    #4
  5. Shadlington

    Shadlington THD Team THD Team Administrator Global Moderator

    Messages:
    1,562
    No, the forum is using fluxBB - I think the website is a custom-coded thing.
    Would probably be better off just using a CMS like drupal for the main site, would get a lot of functionality for free.
     
    Shadlington, Jun 26, 2011
    #5
  6. Furai

    Furai THD Team THD Team Administrator

    Messages:
    3,124
    Someone should msg Poe about this...
     
    Furai, Jun 26, 2011
    #6
  7. Zenrix

    Zenrix Guest

    Not a fan of Drupal myself, would rather get WordPress and integrate it with PHPbb3 so you can easily post announcemts on the front page and have forum functionality.
     
    Zenrix, Jun 26, 2011
    #7
  8. poe

    poe Shopkeep Stealer

    Messages:
    29
    I removed the issue with your name. I use html entities for everything but I suppose I missed something X_X I can't fix this until Friday but I'll keep a lookout on the database for users trying to abuse this. If worst comes to worse I'll ask Mike to throw the site into maintenance mode.

    Thank you for finding this I really appreciate it!

    EDIT:
    I'm doing the website for free :3 also the issue with a CMS is that it wouldn't be as custom tailored for the game(and I wouldn't be needed ;-;)

    EDIT2: Changed your name back and actually fixed the issue with many thanks to Mike(He had to send me the files and upload the changes)
     
    poe, Jun 26, 2011
    #8
  9. Shadlington

    Shadlington THD Team THD Team Administrator Global Moderator

    Messages:
    1,562
    For the record, by 'for free' I was referring to the effort/time cost rather than financial - I'd assumed it was likely free in that sense.
    And even with a CMS you'd still need plenty of custom tailoring, its just that a lot of the less fun/interesting stuff would be done for you.

    Yeah, WP is nice for simple sites, but drupal is more powerful and flexible - I figure that if you want to build more custom functionality into the site, it'd be a better bet.
     
    Shadlington, Jun 27, 2011
    #9
  10. poe

    poe Shopkeep Stealer

    Messages:
    29
    Heh all the less fun and interesting stuff is done basically. At least what I consider not fun. I enjoy maintaining the website and programming new features programming in general has always been a hobby of mine :)
     
    poe, Jun 27, 2011
    #10
  11. Shadlington

    Shadlington THD Team THD Team Administrator Global Moderator

    Messages:
    1,562
    Hey, sure I respect that.
    I'm a web developer myself so I understand the satisfaction in building something from scratch.
    That said, I like using drupal for a lot of the sites I build as having access to both the framework and all the 1000s of modules is often invaluable.
     
    Shadlington, Jun 27, 2011
    #11
  12. poe

    poe Shopkeep Stealer

    Messages:
    29
    I've honestly only tried it once or twice, but to each their own :)
     
    poe, Jun 27, 2011
    #12
Mods: Hella, Lieber, ParaLogia