vb.org Archive - vB Tetris v2.5 | Leaderboard, Comments and High Score System v2.5 :)

Page 34 of 106

Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vBulletin 2.x Full Releases (https://vborg.vbsupport.ru/forumdisplay.php?f=4)

- - vB Tetris v2.5 | Leaderboard, Comments and High Score System v2.5 :) (https://vborg.vbsupport.ru/showthread.php?t=42293)

NexDog

08-16-2002 03:07 PM

He posted a new file in the post just before yours. :rollseyes: :D

John	08-16-2002 03:07 PM

Basically, in older versions of tetris.php people could add a "get" string in the header of the page.

i.e. tetris.php?action=reg&points=10000000&userid=1

In the new file, a piece of code refuses to accept any point values in the header.

John	08-16-2002 03:08 PM

Quote:

Originally posted by NexDog
He posted a new file in the post just before yours. :rollseyes: :D

And the zip has also been updated - did any get the update email? The hack updater is playing up...

Stuwee

08-16-2002 03:11 PM

Riiiight... very nice game and all credit to you for that, but there are two glaring big holes in your script here which I feel somewhat obliged to point out.

First and foremost, even with your updated script, it's still 100% possible to cheat (by posting the values using a form instead of using the querystring). For example - this simple html form run on your own machine:

Code:

<form name="tetrischeat" method="post" action="http://yoursite/tetris.php?action=reg">

  enter your score! 

  <input type="text" name="punteggio"><br>

  and your userid (get from bbuserid field in cookie)<input type="text" name="userid"><br>

  <input type="submit" value="What's tetris again?">

</form>

It just requires digging out your userid from the vB cookie. For a working example, register on our boards, and then give it a shot here.

Secondly, the comment system here is very open to abuse. For example, as your comment, try:

Code:

<script>alert("i rock j00!")</script>

And you'll see what I mean. Luckily, the mysql comment column is restricted to 70 charaters, which limits the damage we can do with this (no XSS cookie harvesting kiddies, sorry)... but it can still be rather annoying.

Overall, a little more thought is needed here in order to secure the script properly. Let me know if you need any help with this, I'll be happy to help.

John	08-16-2002 03:15 PM

Quote:

Originally posted by Stuwee
Riiiight... very nice game and all credit to you for that, but there are two glaring big holes in your script here which I feel somewhat obliged to point out.

First and foremost, even with your updated script, it's still 100% possible to cheat (by posting the values using a form instead of using the querystring). For example - this simple html form run on your own machine:

Code:

<form name="tetrischeat" method="post" action="http://yoursite/tetris.php?action=reg"> enter your score! <input type="text" name="punteggio"><br> and your userid (get from bbuserid field in cookie)<input type="text" name="userid"><br> <input type="submit" value="What's tetris again?"> </form>

It just requires digging out your userid from the vB cookie. For a working example, register on our boards, and then give it a shot here.

Secondly, the comment system here is very open to abuse. For example, as your comment, try:

Code:

<script>alert("i rock j00!")</script>

And you'll see what I mean. Luckily, the mysql comment column is restricted to 70 charaters, which limits the damage we can do with this (no XSS cookie harvesting kiddies, sorry)... but it can still be rather annoying.

Overall, a little more thought is needed here in order to secure the script properly. Let me know if you need any help with this, I'll be happy to help.

I've been aware that the script wasn't 100% secure for some time now, but I don't have the time to update it (I'm not familiar with the vB cookie system either).

If you could update the existing tetris.php and email it to me, we'd all be grateful.

Stuwee

08-16-2002 03:35 PM

Quote:

Originally posted by john.eovie

I've been aware that the script wasn't 100% secure for some time now, but I don't have the time to update it (I'm not familiar with the vB cookie system either).

If you could update the existing tetris.php and email it to me, we'd all be grateful.

Actually, it's possible to do it without knowing the userid (by setting s=something in the querystring). I don't have time to fix it tonight, but I'll see what I can do for you tomorrow... in the mean time, I updated my little example so it doesn't need the userid.

John	08-16-2002 03:37 PM

Tried it with sessions - sometimes, for some unknown reason the user doesn't have a sessionhash. Meaning they can't get to it at all... :s

Stuwee

08-16-2002 03:40 PM

Quote:

Originally posted by john.eovie
Tried it with sessions - sometimes, for some unknown reason the user doesn't have a sessionhash. Meaning they can't get to it at all... :s

Yeah, sometimes the session hash isn't present in the querystring, sometimes it is (never bothered to find out exactly why)... but that doesn't solve our problem anyway... I'll hopefully get back to you tomorrow with an updated version of the script.

Lesane

08-16-2002 03:52 PM

You could use sessions for that.

When they are going to the play action (tetris?action=play) then you can set a session name for example:

PHP Code:


		
			
session_start();

session_register("test");

Then by the code of reg (tetris?action=reg) you can check if the user has a session named test by the following code:

PHP Code:


		
			
if (session_is_registered("test")) {

echo "User has a session named test so he came from the play action";

} else {

echo "ooops, cheatterr";

}

Stuwee

08-16-2002 04:09 PM

Quote:

Originally posted by Lesane
You could use sessions for that.

When they are going to the play action (tetris?action=play) then you can set a session name for example:

PHP Code:

session_start(); session_register("test");

Then by the code of reg (tetris?action=reg) you can check if the user has a session named test by the following code:

PHP Code:

if (session_is_registered("test")) { echo "User has a session named test so he came from the play action"; } else { echo "ooops, cheatterr"; }

Quite right, but as far as I can see, the cheat0r could just start a game, and then while it's playing, submit the form. The session still exists, but it wasn't submitted by the script... the leaderboard would be none the wiser. $_SERVER["HTTP_REFERRER"] could always be checked to see if the user is indeed coming from the playfield, but there's no reason that can't be poisoned either....

All times are GMT. The time now is 11:12 AM.

Page 34 of 106

« First

Last »

Show 40 post(s) from this thread on one page

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01809 seconds Memory Usage 1,759KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (4)bbcode_code_printable (4)bbcode_php_printable (5)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (4)pagenav_pagelink (3)pagenav_pagelinkrel (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: