one of our members discovered a bug that allows any member to steal money from someone elses account using the donate cash function because it just relies on a simply GET request in the form of

you can force users to give cash by simply abusing the fact the a forum allows html.

by using a no one can see what's happening but every visit will force a donate through as long as the page viewer has enough cash.

to do a simple fix simply make the donate check code make sure that the form was sent via POST and not GET, still because the forum allows for HTML you could get past this still be creating a hidden form that is automatically submitted on pageload that can then force a POST request.

I'd say the safest securist method would be to create a hash inside the form in a hidden variable that is something like your username salted with a random word that is checked on the donate processing bit.

I can confirm this backdoor is there - as I discovered this particular member stealing $1000's from others' accounts.

Please fix asap

Thanks for the help Andrew!

I can make that change, but I'm gonna be honest. If your allowing members to post html, you got far bigger security risks then stealing cash...

I would very, very strongly recommend you turn html posting off before something more important then casino cash gets swiped.

The texasholdem_modgroups record was missing from the casino_settings table so when I added the usergroup for moderation of Texas Holdem, it was not updating the field in the CP. After adding the record to the table, I'm still not able to /kick people out of Texas Holdem. I'm guessing some code is missing too.

what about being able to embed code such as youtube videos? its a popular feature.

id appreciate the change anyway - thanks

embedding youtube videos? there's so many mods and bbcodde additions that do that, if youtube videos are your only reason for allowing html, then u really should look into those here on vb.org! Also, jelsoft themselves (the company that makes vBulletin) warns against allowing html in posts...

Then you'd want to set up a bbcode to do the embedding, or use the auto media embeding product. If you let them embed youtube videos, then they can also embed things a lot more malicious. Only a matter of time before someone starts hijacking accounts or worse.

Andrew,

Any ideas why that /kick feature is not working in Texas Holdem? I posted a little earlier about the texasholdem_modgroups record missing from the table and wondered if this is possibly due to some code missing from the release.

haven't had a chance to think about it, works for me on my sites. You have the usergroupid set up properly? Does it show anything when you type it in in the chat box?

Thanks Freesteyelz