Go Back   vb.org Archive > vBulletin Modifications > Archive > vB.org Archives > General > Testing Zone
Reload this Page Read this thread
FAQ Community Calendar Today's Posts Search

Reply
Page 1 of 2 1 2
 
Thread Tools
Read this thread Details »»
Read this thread
Version: , by filburt1 filburt1 is offline
Developer Last Online: May 2007 Show Printable Version Email this Page
Version: Unknown Rating:
Released: 08-27-2003 Last Update: Never Installs: 0
 
No support by the author.

Usually "Don't read this thread" doesn't work, so...

Ignore:

test
[font=nobody@nowhere" onMouseOver="alert('test')]test[/font]
[color=nobody@nowhere" onMouseOver="alert('test')]test[/color]

Show Your Support

  • This modification may not be copied, reproduced or published elsewhere without author's permission.

Comments
  #2  
Old 08-27-2003, 09:26 PM
lasto lasto is offline
 
Join Date: Jan 2002
Posts: 1,514
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
/me is dopey cause he just had to read it!
Reply With Quote
  #3  
Old 08-28-2003, 02:52 AM
filburt1 filburt1 is offline
 
Join Date: Feb 2002
Location: Maryland, US
Posts: 6,144
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
BTW, my test didn't work, so you should all be happy; otherwise I just found the biggest XSS flaw in vB ever. Actually I did find one that exists in custom-written vB codes (ones created in the admin CP) but I won't go into details.
Reply With Quote
  #4  
Old 08-29-2003, 12:57 AM
filburt1 filburt1 is offline
 
Join Date: Feb 2002
Location: Maryland, US
Posts: 6,144
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

  1. test
Reply With Quote
  #5  
Old 08-29-2003, 06:10 AM
assassingod's Avatar
assassingod assassingod is offline
 
Join Date: Jul 2002
Posts: 3,337
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Looks like its been fixed in the SQL tag as well
Reply With Quote
  #6  
Old 08-29-2003, 10:18 AM
filburt1 filburt1 is offline
 
Join Date: Feb 2002
Location: Maryland, US
Posts: 6,144
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
I've been looking at the bbcodeparse function and its child functions. There are no XSS problems, it seems, but there can be for custom vB codes (and I have yet to receive a reply): http://www.vbulletin.com/forum/showthread.php?t=81176
Reply With Quote
  #7  
Old 08-29-2003, 12:00 PM
assassingod's Avatar
assassingod assassingod is offline
 
Join Date: Jul 2002
Posts: 3,337
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Looks like quite a big bug then?
Reply With Quote
  #8  
Old 08-29-2003, 12:52 PM
filburt1 filburt1 is offline
 
Join Date: Feb 2002
Location: Maryland, US
Posts: 6,144
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Yes, provided your custom tags work like that. It seems, though, whenever I post a bug or potential bug, I always have to bump it to at least get a reply for details, confirmation, etc...
Reply With Quote
  #9  
Old 08-29-2003, 01:02 PM
assassingod's Avatar
assassingod assassingod is offline
 
Join Date: Jul 2002
Posts: 3,337
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Too bad vB.com don't have a bug tracker for vB2, but seeing as there may not be any more releases of vB2.x, it would be rather pointless
Reply With Quote
  #10  
Old 08-29-2003, 02:53 PM
filburt1 filburt1 is offline
 
Join Date: Feb 2002
Location: Maryland, US
Posts: 6,144
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
I bet the problem still exists in vB3. Fancy making a test? I'm busy working on the craziest script ever for WDF (string parsing in a loop about 300,000 times).
Reply With Quote
Reply
Page 1 of 2 1 2

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 02:19 PM.

Contact Us - Archive - Top

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.04183 seconds
  • Memory Usage 2,280KB
  • Queries Executed 23 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)modsystem_post
  • (1)navbar
  • (6)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (1)pagenav_pagelink
  • (10)post_thanks_box
  • (10)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (10)post_thanks_postbit_info
  • (9)postbit
  • (10)postbit_onlinestatus
  • (10)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 
Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete