vb.org Archive - View Single Post - BB Code Enhancements

syrus.xl · #7 02-08-2010, 05:37 AM

This is one of the biggest security holes I have seen on here yet!!!! Allowing HTML, is one thing, but a SWF is totally different.

Yes, it could be used for pretty animations in signatures, but it can also be used for malicious purposes. Okay, many companies use flash adverts, but these are designed by professional flash authors who do not place actionscript in SWF files for other purposes.

SWF files do not need to be downloaded to your PC to infect it (You are correct on that remark!), with SWF's it's done on a much larger scale. SWF files can easily be coded to do call-backs, cause re-directs and much more.

Quote:

Please people, don't worry... be happy

People will not be happy when they lose their forums because of a modification, that has opened up their vBulletin to attacks.

I cannot see this modification being allowed to stay on vbulletin.org when it is such a high security risk to any forum!

It would not be too bad if it was Usergroup specific, but it is not even that.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01048 seconds Memory Usage 1,764KB Queries Executed 11 (?)
More Information
Template Usage: (1)SHOWTHREAD_SHOWPOST (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)bbcode_quote (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_box (1)post_thanks_button (1)post_thanks_javascript (1)post_thanks_navbar_search (1)post_thanks_postbit_info (1)postbit (1)postbit_onlinestatus (1)postbit_wrapper (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit reputationlevel showthread	Included Files: ./showpost.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/functions_bigthree.php ./includes/class_postbit.php ./includes/class_bbcode.php ./includes/functions_reputation.php ./includes/functions_post_thanks.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_postinfo_query fetch_postinfo fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete showpost_start bbcode_fetch_tags bbcode_create postbit_factory showpost_post postbit_display_start post_thanks_function_post_thanks_off_start post_thanks_function_post_thanks_off_end post_thanks_function_fetch_thanks_start post_thanks_function_fetch_thanks_end post_thanks_function_thanked_already_start post_thanks_function_thanked_already_end fetch_musername postbit_imicons bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete postbit_display_complete post_thanks_function_can_thank_this_post_start showpost_complete
Messages: