[NEW PAGES] Custom CC Pages

Leumonic · 07-30-2013, 10:14 PM

(07-30-2013, 09:59 PM)Eternity Wrote:
(07-30-2013, 09:56 PM)Platinum Wrote:
(07-30-2013, 09:33 PM)Eternity Wrote: Good work i must say, though if I'm gonna start with an API for the forum i think i will go with the default user information since not all the user's information is stored in that page.

Well, me and Semp are already working on 2 API's ;(

Doesn't hurt with a third then

Unless you're doing it a third way, separate to the ways we've both come up with, you're sort of just re-inventing the wheel, are you not?

Eternity · 07-30-2013, 10:32 PM

(07-30-2013, 10:14 PM)Sempiternal Wrote:
(07-30-2013, 09:59 PM)Eternity Wrote:
(07-30-2013, 09:56 PM)Platinum Wrote:
(07-30-2013, 09:33 PM)Eternity Wrote: Good work i must say, though if I'm gonna start with an API for the forum i think i will go with the default user information since not all the user's information is stored in that page.

Well, me and Semp are already working on 2 API's ;(

Doesn't hurt with a third then

Unless you're doing it a third way, separate to the ways we've both come up with, you're sort of just re-inventing the wheel, are you not?

Probably, I have come up with a decent amount of system on my own.

Xanii · 07-31-2013, 09:04 AM

I like it. Don't click this in chrome, but I like this profile of yours... Wink

http://goo.gl/FHiewb

Platinum · 07-31-2013, 10:03 AM

(07-31-2013, 09:04 AM)Xanii Wrote: I like it. Don't click this in chrome, but I like this profile of yours...

http://goo.gl/FHiewb

So what about it, it adds an iframe or something and doesn't display the info.. Why would you do that?

Leumonic · 07-31-2013, 10:11 AM

(07-31-2013, 10:03 AM)Platinum Wrote:
(07-31-2013, 09:04 AM)Xanii Wrote: I like it. Don't click this in chrome, but I like this profile of yours...

http://goo.gl/FHiewb

So what about it, it adds an iframe or something and doesn't display the info.. Why would you do that?

He is hoping to get it to toy with the page and maybe do some XSS, but I am fairly certain it is fixable to get it to XSS safe.

Platinum · 07-31-2013, 10:16 AM

(07-31-2013, 10:11 AM)Sempiternal Wrote:
(07-31-2013, 10:03 AM)Platinum Wrote:
(07-31-2013, 09:04 AM)Xanii Wrote: I like it. Don't click this in chrome, but I like this profile of yours...

http://goo.gl/FHiewb

So what about it, it adds an iframe or something and doesn't display the info.. Why would you do that?

He is hoping to get it to toy with the page and maybe do some XSS, but I am fairly certain it is fixable to get it to XSS safe.

Aah like that, you can even block XSS if you wish I'm sure. Or you could check if ONLY the user variable is set.

Xanii · 07-31-2013, 06:17 PM

It IS XSS vulnerable. I was having some fun with making it automatically donate CCP or +rep me when someone visited the page, but I decided to do an iframe instead. Chrome automatically blocks XSS, which makes this no fun for Chrome users.

Leumonic · 07-31-2013, 11:04 PM

(07-31-2013, 06:17 PM)Xanii Wrote: It IS XSS vulnerable. I was having some fun with making it automatically donate CCP or +rep me when someone visited the page, but I decided to do an iframe instead. Chrome automatically blocks XSS, which makes this no fun for Chrome users.

No more XSS. The vuln. you found has been assessed and removed.

[NEW PAGES] Custom CC Pages
Author Message