To All Members

Printable View

Show 100 post(s) from this thread on one page

03-02-2005, 01:05 AM
STEvil

Is there a way the swear filter can be implemented to look for say an unclosed tag and close it?

I messed around with the swear filter on my friends forum some and was able to input java code into the user title, user avatar, and just about anywhere well enough that whenever someone said my or his names it would show up as flaming text.. :D

Now while we probably cant do quite that much here, maybe we can spoof some of the dynamic HTML code (ie: D2OL sigs) and disable the rest that isnt needed?

What I mean by spoofing is that I would put approved code in my sig that would be something like this:

#img=d2ol&user=STEvil&bg=9# (replace #'s with < and >) which the XS swear filter would pick up and call the correct background from the sigs.canyonlake.com page and info.

Not exactly the prettiest solution, but I dont see that we need all the HTML code.. just some of it.
03-02-2005, 02:36 AM
PS2pcGAMER

The D2OL sigs have been compatible since November-ish with the tightened security (I originally did that because phpBB forced it whereas Vbulliten it is optional).

In my eyes, there is absolutely no point in having HTML enabled as it is a security threat. No one needs it at all. Everyone's images will still work as is provided they are in [*IMG] brackets and not <*img src="http://server/image.jog">. As I stated on XR, just be wise about what you have enabled as things can easily be taken advantage of and if Boshi hadn't done something (that was relatively minor), someone else could have easily done something worse (that was more harmful). IIRC the front page didn't have the latest version of PHP-Nuke when it got hacked, so things like that will happen if they are left open. The only thing you will lose is the ability to link to attachments hosted here at XS (I've noticed a few sigs fail to work now) because they are loaded from the attachment script. There has to be a hack to block all images except those here hosted at XS, so that may be something to look into.

I could be wrong, but I have never seen much HTML use at any forum. If anyone can point to a few examples, i'd like to see them.

Edit:

BTW, I don't think Kazoo is talking about disabling BB code. That'd just be silly.

Quote:

Originally Posted by conrad.maranan

I voted to keep HTML off. What would you rather have? Pretty pictures and fancy sigs, or data that maintains its integrity and security? Keep in mind that the value of this forum lies not only in the contributing members, but also in the information that we share.

You can still change the size/color of the text in your sigs with BB code along with keeping the images. Just do it with BB code and not HTML.

And a slightly different rant, because I am in a ranting mood...

Why is XR/XS being brought up again? Nothing of any good ever comes of it. A few people have taken sides but the majority of people don't know nor care what happened. I mean look at how badly it hurt the DF/FAH teams this past summer, it is just getting extremely old and tiresome IMO.

BTW, I like the blimp story :p
03-02-2005, 07:06 AM
masterofpuppets

Finally, I know the truth about the XS/XR split! Anyway, I say, just write a new BBcode for D2OL sigs and Folding sigs. Isn't that hard, there is an option in the Vbulletin admin panel.
03-02-2005, 10:56 AM
sky

Quote:

Originally Posted by Dissolved

Well with IE and FFOX thats like telling people to use linux cuz windows isn't Safe. Yea, Os's are different but its the same idea.

Not many people can use FFOX, people @ work & such..

But yea, its up to the admins.. but it html posses such a threat against XS and its users then it should be removed. I dont study programming, hell i cant spell half the time, so i wouldn't know how safe leaveing HTML on is. but alot of forums dont use it.

i kinda agree with this statement. at work, i strongly encourage people to use firefox. after all i have been using it for quite some time now and have converted a few people. basically it is the same minus some javascript-stuff i coded years ago that doesnt work with a standard firefox. and if someone else at the office wants to change, i'll help them do it (parttime admin), but i can't force them to do it (well i could ;), but let's be reasonable here).

as i understand it, there's not much going to change anyway, as most stuff can still be done using the board-tags. picture links won't work anymore? well i've been using the (img)http://xxxxxxxxx(/img) variant for some time and it works just fine (didn't even bother trying html-code).

well i'd hate to have people be afraid of losing their data - whether it's their choice of browser or over time maybe any browser might be attackable. (anyway, whatever that is worth, but a guy doing that, if he is trackable should be sued with everything the law offers, no second thoughts!).

i voted turn html off. safety first, even if it seriously cuts our freedom (and that's about the only thing i think is worth fighting for). anyway, using firefox i'm feeling safe, so i basically don't really care. that may be a false feeling of security, who knows. i'm running backups off my important stuff on my own server in the cellar anyway. so it's more of a question of protecting the unsuspecting...

/edited after reading some of the later post, d0h! :)
03-02-2005, 11:38 AM
drcrawn

If it is really warrented, I think you guys should turn it off for an entire month and see how everyone copes. I think it will be fine.
Amazing how some people won't get over "that other forum" considering 80% of the people that post here, post there and vice versa.
03-02-2005, 11:55 AM
HARDCORECLOCKER

:D Thought about it, but that happened now one time, mean it is no daily problem, so in my opinion there's no need to stop HTML - think about all the nice pics here.

BTW, even when HTML get stopped a clever bad bird could be able to create another faulty thing to do harm to XS..........

:toast:
03-02-2005, 12:03 PM
killzone

Im new hear but not to the scene, i REALLY think disabling the HTML is just silly your giving the guy exactly what he wants and there for he wins.. If you want him to win then by all means disable HTML ill still come to this forum its the best forum ive ever been apart of i wish i would have come across it sooner, Look we are a community here and when communities have a problem they are supposed to team up to win not lay down down in the ditch and take it.. think of everything we come up with all the good ideas to gain alittle peformance over the next guy.. surely there is another way to beat this
03-02-2005, 12:41 PM
matt9669

I agree with Killzone - otherwise you guys know my objections. This was not an exploit, just an MS bug!!
03-02-2005, 12:50 PM
Torin

While you're at it, you might as well disable any kind of external linking, because so long as people use MS products, mainly IE in this case, there will always be vulnerabilities.

XS is not responsible for the security of every individual's PC that uses the forum. If you willingly choose to use an unsecure, exploitable browser, you willingly accept the consequences. As others have stated, Firefox is a perfect alternative, and is readily available for everyone to use. This is the last forum in the world that should be catering to the lowest common denominator in the computing world. If you aren't capable enough to either keep your system updated, or in the case that isn't enough (MS isn't fully supported security fixes for anything but XP now) use a different browser, that's your problem.

But, given what BB code can do, and assuming the functionality of BB code is not going to be inhibited by disabling HTML, I don't see much of a consequence of disabling HTML.

If I was in running the forum, I'd make it each user's responsibility. As this is not a server-side problem, you shouldn't implement a server-side solution. This is a client problem that should have a client solution.

But, if disabling HTML won't really have much of an effect considering what BB can do, by all means. If people have to learn new ways to do the same thing, then it isn't so bad, IMO.
03-02-2005, 12:50 PM
drftkng

I voted to keep it on.. I don't like giving up my freedoms.

As far as the firefox at work issue goes. On my computer here at work I am restricted from installing any code onto my machine. No admin right :( That never stopped me from installing Firefox onto my usb thumbdrive at my house and plugging it into my machine at work. Works like a champ and they are none the wiser.
03-02-2005, 12:54 PM
bh2k

I'm not bothered by turning it off.
03-02-2005, 01:21 PM
matt9669

Quote:

Originally Posted by bh2k

I'm not bothered by turning it off.

I am.

How in the hell is HTML code a vulnerability? HTML formats web pages. That's it. It has no memory access, no conditional statements or branches: most programmers do not consider it a programming language in the formal sense!

If ANYONE has a good example of how having HTML code on is hazardous to the forums (other than a rediculous MS bug) PM them to me if you cannot post them here.

Forgive me if I am spamming this thread but I am appalled by this. I do not believe it is right to take away the freedoms of our forum members just because of the actions of a little kid (age or mentally, same difference - this is a child we are dealing with!)
03-02-2005, 01:38 PM
bachus_anonym

Oh man!!! I Just looked at couple of threads I started where I had (url=xxx)(img)xxx(/img)(/url) tags and they're ALL MESSED UP!!! There's no longer access to linked pics on my server :(

Turn HTML back ON, pliiizzzzzzz !!!
03-02-2005, 02:22 PM
9mmCensor

Turn [img] code on. But leave HTML off.

Here is how to link to images.
[url=location of the image here]WRITE A NAME HERE[/URL*]

remove the *
03-02-2005, 02:27 PM
matt9669

This is the error:

http://support.microsoft.com/kb/832823

All boshi did was not close an HTML tag. It is common practice not to close some HTML tags!

Quote:

we recommend that you wait for the next Internet Explorer service pack that contains this hotfix.

And MS expects this fix to be included with a Service Pack!

So we should turn off HTML for THIS? :soap:
03-02-2005, 02:32 PM
9mmCensor

Quote:

Originally Posted by chilly1

Ben Franklin said it best "Anyone who is willing to give up any of their rights or privilages for a margin of security deserves to lose both."

Benny said, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." (Historical Review of Pennsylvania - 1759).

Now giving up HTML code is hardly an "essential liberty", and does aid to prevent further exploits, which infact strip people of the essential liberty of freedom of speech.
03-02-2005, 02:33 PM
masterofpuppets

This is stupid. Not closing an HTML tag shouldn't result in turning off HTML.
03-02-2005, 02:34 PM
HARDCORECLOCKER

:slobber: I want back my pics !!!!!!!!!!!

:toast:
03-02-2005, 02:40 PM
matt9669

Quote:

Originally Posted by 9mmCensor

Now giving up HTML code is hardly an "essential liberty", and does aid to prevent further exploits, which infact strip people of the essential liberty of freedom of speech.

Exploits such as MS bugs? All this does is crash IE! Period! This does not qualify as an exploit! HTML code by itself (which is the kind that was and hopefully still will be allowed on the forums) CANNOT compromise any system, period!
03-02-2005, 02:52 PM
Dissolved

Quote:

Originally Posted by matt9669

Exploits such as MS bugs? All this does is crash IE! Period! This does not qualify as an exploit! HTML code by itself (which is the kind that was and hopefully still will be allowed on the forums) CANNOT compromise any system, period!

yea so what if we leave it on, and one of these tards finds something worst to post and it affects someone or XS itself?

Then what?

if haveing HTML on just for Sig pictures is kinda stupid i say.
03-02-2005, 02:58 PM
[XC]thewildblue

This is a p1ss take, why does the XR crew still feel the need to kick off. I mean it seems as though its once a month that one member from there comes over to cause some sort of grief/moan about things only to get a ban. So much for loving the hobby and forum like most of us do, cant these ppl stick to places like genmay or such like.

I say turn off HTML Im not fussed, I read the content here and sigs dont bother me much, yes they are nice to see (specially coz Im doing D2OL for the team and its nice to show my support and loyality to the site and to others) but if they pose a security flaw then get rid. I personally use a proper browser (not IE but firefox) so the flaw wouldnt affect me.

Its about time that the XR/XS got sorted once and for all, we lost some good ppl in the split, but we have gained alot as well, so isnt it time that the guilty parties just went down and played pick up the soap !

I have been here since the big Icrontic split in 2002 and this has been my home ever since. I visit everyday and it saddens me when ppl feel the need to cause trouble in my "home". I mean its like a cyber terrrorism, why dont these ppl get a life. RANT OVER.

Thanks
03-02-2005, 02:59 PM
bh2k

We should force all users to use firefox. Problem solved.
03-02-2005, 03:00 PM
[XC]thewildblue

Quote:

Originally Posted by bh2k

We should force all users to use firefox. Problem solved.

Thats not realistic though, however much I would like that.
03-02-2005, 03:08 PM
matt9669

Quote:

Originally Posted by Dissolved

yea so what if we leave it on, and one of these tards finds something worst to post and it affects someone or XS itself?

Then what?

if haveing HTML on just for Sig pictures is kinda stupid i say.

A) It's not on just for sigs, I've explained this more times than I care to and will not again.

B) Read my previous posts! I DARE you to find an exploit that works purely with HTML! Why? Because one does not exist, period.

I would not be advocating something that I felt was a security risk to XS or it's members. HTML code simply is not.
03-02-2005, 03:10 PM
jjcom

I say leave HTML on. In that case, it was a problem with IE. There are many other broswers out there that can be used. People use HTML code on a regular basis so it would mess up many posts. Like others have said, pictures get messed up, etc. IMO it would just cause more issues rather than fix them

jjcom

Show 100 post(s) from this thread on one page