The Arcive of vBulletin Modifications Site. |
|
Read this thread Details »»
|
|||||||||||||||||||||||||
Usually "Don't read this thread" doesn't work, so...
Ignore: test [font=nobody@nowhere" onMouseOver="alert('test')]test[/font] [color=nobody@nowhere" onMouseOver="alert('test')]test[/color] Show Your Support
|
|||||||||||||||||||||||||
About Developer
Visit Web Site
No support by the author.| Comments |
|
#3
08-28-2003, 01:52 AM
|
|||
|
|||
BTW, my test didn't work, so you should all be happy; otherwise I just found the biggest XSS flaw in vB ever. Actually I did find one that exists in custom-written vB codes (ones created in the admin CP) but I won't go into details.
|
|
#5
08-29-2003, 05:10 AM
|
||||
|
||||
|
Looks like its been fixed in the SQL tag as well
|
|
#6
08-29-2003, 09:18 AM
|
|||
|
|||
|
I've been looking at the bbcodeparse function and its child functions. There are no XSS problems, it seems, but there can be for custom vB codes (and I have yet to receive a reply): http://www.vbulletin.com/forum/showthread.php?t=81176
|
|
#7
08-29-2003, 11:00 AM
|
||||
|
||||
|
Looks like quite a big bug then?
|
|
#8
08-29-2003, 11:52 AM
|
|||
|
|||
|
Yes, provided your custom tags work like that. It seems, though, whenever I post a bug or potential bug, I always have to bump it to at least get a reply for details, confirmation, etc...
|
|
#9
08-29-2003, 12:02 PM
|
||||
|
||||
|
Too bad vB.com don't have a bug tracker for vB2, but seeing as there may not be any more releases of vB2.x, it would be rather pointless
|
|
#10
08-29-2003, 01:53 PM
|
|||
|
|||
|
I bet the problem still exists in vB3. Fancy making a test? I'm busy working on the craziest script ever for WDF (string parsing in a loop about 300,000 times).
|
 |
«
Previous Thread
|
Next Thread
»
|
|
All times are GMT. The time now is 10:44 PM.