vb.org Archive
Page 9 of 27 « First 78 9 101119 Last »
Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vBulletin 2.x Full Releases (https://vborg.vbsupport.ru/forumdisplay.php?f=4)
-   -   vB Tetris v2.5 | Leaderboard, Comments and High Score System v2.5 :) (https://vborg.vbsupport.ru/showthread.php?t=42293)

John 08-16-2002 12:29 PM
Quote:
Originally posted by DanIAm


SON OF A'

That's my friggen problem. I installed this dang thing time and time over, gave up, came back to try it again, and thought, maybe I am not correctly uploading the .swf file...

Thanks john.eovie, I finally got it working... I wasn't uploading the file binary.
Ouch, that's gotta hurt!

I just use WS_FTP and upload with Auto everytime - never fails me :)

Just so I know how to help others, what was your initial problem? The swf file not loading?

DanIAm 08-16-2002 12:35 PM
Quote:
Originally posted by john.eovie
Just so I know how to help others, what was your initial problem? The swf file not loading?
When clicking the play tetris link the game tried to come up, but would appear to freeze with the game screen remaining solid (see pic)

http://www.mentalmingle.com/images/pic1.jpg

And the Explorer status bar would indicate that it was opening tetris.php but it would never fully load. The status bar continued to indicate 1 item remaing (to load), but would never do so. (see pic)

http://www.mentalmingle.com/images/pic2.jpg

Thanks again!

pgowder 08-16-2002 01:22 PM
Great hack!

I was up and running within about 5 minutes!

Nice job!

pgowder 08-16-2002 01:23 PM
Now we need someone to come up with a full arcade of games for our vB's!

chris frolic 08-16-2002 02:04 PM
Anyone have any ideas about the bug that doesn't record your score if you finish all 10 levels?

Schorsch 08-16-2002 02:15 PM
please please please dear John, could you do this:

Quote:
Originally posted by Gamingforce
3) Maybe one recording of a high score per person? If it's higher, then it updates the old highest score for that user. That way more people can be displayed in the hall of fame.
would be great :banana:

regards,
Schorsch

Martin64 08-16-2002 02:16 PM
It is still awfully easy to cheat...

Code:
http://www.yoursite.com/forums/tetris.php?action=reg&punteggio=1000000&userid=1
Run that.

John 08-16-2002 02:17 PM
Quote:
Originally posted by chris frolic
Anyone have any ideas about the bug that doesn't record your score if you finish all 10 levels?
We're still looking for someone who's really good at Flash and can speak Italian...

John 08-16-2002 02:20 PM
Quote:
Originally posted by Martin64
It is still awfully easy to cheat...

Code:
http://www.yoursite.com/forums/tetris.php?action=reg&punteggio=1000000&userid=1
Run that.
New tetris.php fixes this:

Ninth Dimension 08-16-2002 03:04 PM
This has got to be one of the best hacks I've seen, add's a whole new level to the forum :)

I'm using the new tetris.php file provided by john.eovie, I do have a quick question, what have you don't to prevent the cheating?

NexDog 08-16-2002 03:07 PM
He posted a new file in the post just before yours. :rollseyes: :D

John 08-16-2002 03:07 PM
Basically, in older versions of tetris.php people could add a "get" string in the header of the page.

i.e. tetris.php?action=reg&points=10000000&userid=1

In the new file, a piece of code refuses to accept any point values in the header.

John 08-16-2002 03:08 PM
Quote:
Originally posted by NexDog
He posted a new file in the post just before yours. :rollseyes: :D
And the zip has also been updated - did any get the update email? The hack updater is playing up...

Stuwee 08-16-2002 03:11 PM
Riiiight... very nice game and all credit to you for that, but there are two glaring big holes in your script here which I feel somewhat obliged to point out.

First and foremost, even with your updated script, it's still 100% possible to cheat (by posting the values using a form instead of using the querystring). For example - this simple html form run on your own machine:

Code:
<form name="tetrischeat" method="post" action="http://yoursite/tetris.php?action=reg">
  enter your score!
  <input type="text" name="punteggio"><br>
  and your userid (get from bbuserid field in cookie)<input type="text" name="userid"><br>
  <input type="submit" value="What's tetris again?">
</form>
It just requires digging out your userid from the vB cookie. For a working example, register on our boards, and then give it a shot here.

Secondly, the comment system here is very open to abuse. For example, as your comment, try:

Code:
<script>alert("i rock j00!")</script>
And you'll see what I mean. Luckily, the mysql comment column is restricted to 70 charaters, which limits the damage we can do with this (no XSS cookie harvesting kiddies, sorry)... but it can still be rather annoying.

Overall, a little more thought is needed here in order to secure the script properly. Let me know if you need any help with this, I'll be happy to help.

John 08-16-2002 03:15 PM
Quote:
Originally posted by Stuwee
Riiiight... very nice game and all credit to you for that, but there are two glaring big holes in your script here which I feel somewhat obliged to point out.

First and foremost, even with your updated script, it's still 100% possible to cheat (by posting the values using a form instead of using the querystring). For example - this simple html form run on your own machine:

Code:
<form name="tetrischeat" method="post" action="http://yoursite/tetris.php?action=reg">
  enter your score!
  <input type="text" name="punteggio"><br>
  and your userid (get from bbuserid field in cookie)<input type="text" name="userid"><br>
  <input type="submit" value="What's tetris again?">
</form>
It just requires digging out your userid from the vB cookie. For a working example, register on our boards, and then give it a shot here.

Secondly, the comment system here is very open to abuse. For example, as your comment, try:

Code:
<script>alert("i rock j00!")</script>
And you'll see what I mean. Luckily, the mysql comment column is restricted to 70 charaters, which limits the damage we can do with this (no XSS cookie harvesting kiddies, sorry)... but it can still be rather annoying.

Overall, a little more thought is needed here in order to secure the script properly. Let me know if you need any help with this, I'll be happy to help.
I've been aware that the script wasn't 100% secure for some time now, but I don't have the time to update it (I'm not familiar with the vB cookie system either).

If you could update the existing tetris.php and email it to me, we'd all be grateful.

Stuwee 08-16-2002 03:35 PM
Quote:
Originally posted by john.eovie


I've been aware that the script wasn't 100% secure for some time now, but I don't have the time to update it (I'm not familiar with the vB cookie system either).

If you could update the existing tetris.php and email it to me, we'd all be grateful.
Actually, it's possible to do it without knowing the userid (by setting s=something in the querystring). I don't have time to fix it tonight, but I'll see what I can do for you tomorrow... in the mean time, I updated my little example so it doesn't need the userid.

John 08-16-2002 03:37 PM
Tried it with sessions - sometimes, for some unknown reason the user doesn't have a sessionhash. Meaning they can't get to it at all... :s

Stuwee 08-16-2002 03:40 PM
Quote:
Originally posted by john.eovie
Tried it with sessions - sometimes, for some unknown reason the user doesn't have a sessionhash. Meaning they can't get to it at all... :s
Yeah, sometimes the session hash isn't present in the querystring, sometimes it is (never bothered to find out exactly why)... but that doesn't solve our problem anyway... I'll hopefully get back to you tomorrow with an updated version of the script.

Lesane 08-16-2002 03:52 PM
You could use sessions for that.

When they are going to the play action (tetris?action=play) then you can set a session name for example:

PHP Code:
session_start();
session_register("test"); 
Then by the code of reg (tetris?action=reg) you can check if the user has a session named test by the following code:

PHP Code:
if (session_is_registered("test")) {
echo "User has a session named test so he came from the play action";
} else {
echo "ooops, cheatterr";
} 

Stuwee 08-16-2002 04:09 PM
Quote:
Originally posted by Lesane
You could use sessions for that.

When they are going to the play action (tetris?action=play) then you can set a session name for example:

PHP Code:
session_start();
session_register("test"); 
Then by the code of reg (tetris?action=reg) you can check if the user has a session named test by the following code:

PHP Code:
if (session_is_registered("test")) {
echo "User has a session named test so he came from the play action";
} else {
echo "ooops, cheatterr";
} 
Quite right, but as far as I can see, the cheat0r could just start a game, and then while it's playing, submit the form. The session still exists, but it wasn't submitted by the script... the leaderboard would be none the wiser. $_SERVER["HTTP_REFERRER"] could always be checked to see if the user is indeed coming from the playfield, but there's no reason that can't be poisoned either....

Lesane 08-16-2002 04:26 PM
$_SERVER['HTTP_REFERRER'] is not that reliable.

You could also put an extra useless value in the play action:

PHP Code:
$useless_value="100"; 
And then by reg action you can use something like this:

PHP Code:
if ($action == "reg" && $useless_value == 100) { 

Stuwee 08-16-2002 04:34 PM
Quote:
Originally posted by Lesane
$_SERVER['HTTP_REFERRER'] is not that reliable.

You could also put an extra useless value in the play action:

PHP Code:
$useless_value="100"; 
And then by reg action you can use something like this:

PHP Code:
if ($action == "reg" && $useless_value == 100) { 
This also wouldn't be possible since the script is called *again* when the score is submitted, and hence any vars set when the user was playing won't still be set... I actually can't think of a 100% reliable way around this right now - the referrer is the best way I can think of, but as we all know, it can be easily poisoned.

Back to the drawing board :).

pgowder 08-16-2002 06:04 PM
How can I intergrate this with Who's Online?

Keta 08-16-2002 06:08 PM
cool hack will be installing

John 08-16-2002 06:19 PM
lol, Lesane Vs. Stuwee - battle of the brains!

xxxsaint 08-16-2002 06:41 PM
You can integrate this into your who's online by opening root/online.php

first find

case 'printthread.php':
$userinfo[activity] = 'printthread';
$blowup = explode('=', $token1);
$threadid = intval($blowup[1]);
$threadids .= ",$threadid";
$userinfo[threadid] = $threadid;
break;

+++++++ do not add this divider ++++++++

and AFTER THAT add

++++++ do not add this divider +++++++++

case 'tetris.php':
$userinfo[activity] = 'tetris';
break;

++++++ do not add this divider +++++++++

then find

+++++++do not add this divider ++++++++

case 'calendar':
$userinfo[where] = "Viewing <a href='calendar.php?s=$session[sessionhash]'>Calendar</a>";
break;

+++++++ do not add this divider ++++++++++++

and AFTER IT ADD

+++++++ do not add this divider ++++++++++++

case 'tetris':
$userinfo[where] = "Going for the King of Tetris Crown";
break;

++++++do not add this divider ++++++++++++++

save , and upload.

** As always , when you are installing a new hack , create a new folder called ' backup ( name of hack ) ' and before you do ANYTHING put the files that you are modifying in there. ALWAYS back your file up , that way if the modded file does not work , you simply upload the one from your new folder.

I added this to my root/online.php on version 2.2.6 and it works just fine.

I put " Going for the King of Tetris Crown " because I also have the crown hack installed.

enjoy.

Ninth Dimension 08-16-2002 06:47 PM
Just a quick note, i'm not sure if anyone else has said this or not, but one of my users has just reported that he got a score of 108697 once he had completed the game - not dieing early but actually getting to the end...

He says that the score did not update or anything, might this be a bug?

xxxsaint 08-16-2002 06:50 PM
I've had users tell me the same thing

Ninth Dimension 08-16-2002 06:56 PM
Quote:
Originally posted by xxxsaint
I've had users tell me the same thing
I've just had to manually add a score for one of my new members because he compained about it LOL

Souly 08-16-2002 07:28 PM
Thx to john.eovie for the Great Hack.

I installed teris and the addon yesterday and now more and more from my users send me PM?s and say that after Lvl10 (theEND) no Score ist updated and the Site ist not refreshed to the leaderboard :(

Ninth Dimension 08-16-2002 07:31 PM
I've only had the hack on the site for about 8 hours now, and already we are getting some REALLY high scores.

I think that the scores should be reset once a week or something and have a weekly leader board as well as an overall leader board.

In addition to this maybe it should be made harder, or indeed more level added to the game, etc....

oh, and the level complete bug thing needs to be fixed LOL :)

(I still think that this is a world class hack though)

ULTIMATESSJ 08-16-2002 07:35 PM
............wow, what an amazing idea, great work

/me clicks on install

Ninth Dimension 08-16-2002 08:14 PM
Just to spice things up a little bit more than they already are, I see from the database entrys that the table is called "arcade" and one of the fields is called "game".

this to me sounds like it's going to be used for future games, if so, that would be fantastic :)

ziggy 08-16-2002 08:17 PM
Anyone interested in a Music Player addon?
Heres just a peek at my MusikHak v0.1 alpha...
http://www.crashsoftware.com/muzikhak/

Its not actually installed in VB, so no leaderboard etc. yet!

I need to add a preload for the loops to the dialup version & whip up some streaming files for the broadband version.

Let me know what ya think so far?

Cheers...ziggy

John 08-16-2002 08:18 PM
Yes, I had planned to expand this further - I've already got Space Invaders working locally on the same system.

But I can never release it while there are security holes in the script.

John 08-16-2002 08:19 PM
Quote:
Originally posted by ziggy
Anyone interested in a Music Player addon?
Heres just a peek at my MusikHak v0.1 alpha...
http://www.crashsoftware.com/muzikhak/

Its not actually installed in VB, so no leaderboard etc. yet!

I need to add a preload for the loops to the dialup version & whip up some streaming files for the broadband version.

Let me know what ya think so far?

Cheers...ziggy
Good work Ziggy, could you send me the original FLA file please?

Ninth Dimension 08-16-2002 08:21 PM
ziggy I think a music player addition to the fla file would be fantastic, but only if we could choose the music to be played.

john.eovie I think you are doing a fantastic job, keep up the good work, i'm very interested in seeing any future updates to this script as it fits in perfectly with my sites theme :)

Ninth Dimension 08-16-2002 08:22 PM
just so you know, so far today I've had 9 new people sign-up to play tetris, obviously the sign of good work :)

John 08-16-2002 08:24 PM
Quote:
Originally posted by danielhollands
just so you know, so far today I've had 9 new people sign-up to play tetris, obviously the sign of good work :)
Glad to hear it :)

On my vB board at the moment I already have a system where it shows you the day's highest scores, it's gone down well :)

ziggy 08-16-2002 08:38 PM
Sorry, No player FLA! I'm under a NDA & the player was made with a non-public app.
I have a zip about ready to go with all the current files though.
I tried REAL hard to put a nice mix in the 10 choices just for that reason.
Its all done w/LoadMovie to make it modular. I guess I could make the menu just Track1,Track2 etc. so people could make their own SWF loops & name them track_1.swf, track_2.swf etc. ???
Don't have time right now though, spent ALOT longer on this sucker than I had planned already!

The zip is 13 files, the modified tetris.fla, music_player.swf, tetris.swf & the 10 loop.swf's
You just upload them to where your tetris.swf is , overwrite tetris.swf w/the new one & thats it!

You got tunes! :D

BTW John, did you get my email I sent you this morning?


All times are GMT. The time now is 09:53 AM.
Page 9 of 27 « First 78 9 101119 Last »
Show 40 post(s) from this thread on one page

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.02087 seconds
  • Memory Usage 1,856KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (6)bbcode_code_printable
  • (8)bbcode_php_printable
  • (14)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (4)pagenav_pagelink
  • (1)pagenav_pagelinkrel
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (40)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete