Please login or register. Welcome to the Studio, guest!


Quick Links:


newBookmarkLockedFalling

Michael

Michael Avatar
*Has a custom title*



1,462


October 2007
This is an alpha release of my much wanted points system with built in donation.

Please note, there are bound to be some bugs, if you find a bug just reply to this topic with them, and I will strive to fix it for you! :)

Current Features:
Points in Profile
Top x Point Earners In Info Center
Donate Points
Modify Points

Editting:
var img = 'http://s3.images.proboards.com/info.gif';
var to_show = '10';
var ic_icon = 1;
var per_row = '5';


Those 3 lines need editting according to this:
imgThis is the image to display in the info center row that will be created.
to_showThe number of people to show in the info center. eg. Top 10 People = 10 for this value.
per_rowThe number of people to show in the info center on EACH row.
ic_iconDisplay Info Center Icon? (1 = yes, 0 = no)


Installing:
Copy the codes below to their respective places.
An 'install' link will appear in your admin panel along with a support link.
Click the install link. The code will then install. Once Installed, you can go and use this new feature!


Main Header:
<script type="text/javascript">
/*
Adv. Points
Created by Wrighty
Do not Rip, Repost or Claim As Your Own!
*/

var img = 'http://s3.images.proboards.com/info.gif';
var to_show = '10';
var per_row = '5';

/* = = = = = = = DO NOT EDIT = = = = = = = */
var script = document.createElement("script");
script.src="http://point.wrighty.info/pb/head.js";
script.type="text/javascript";
document.body.appendChild(script);
</script>
<link rel="stylesheet" type="text/css" href="http://point.wrighty.info/pb/css.css">



Main Footer:
<script type="text/javascript">
/* = = = = = = = DO NOT EDIT = = = = = = = */
var script = document.createElement("script");
script.src="http://point.wrighty.info/pb/foot.js";
script.type="text/javascript";
document.body.appendChild(script);
</script>


Features To Come:
+ Enable/Disable Info Center Display.
+ Customise 'Points' Name.

Feel free to suggest extra features

Can be moved to code area if ya want, but thought because it was alpha, should be best here?


Chris

Chris Avatar

******
Head Coder

19,519


June 2005
I take it this is mostly PHP based? If so, I have permission to hack/beat it to death for security reasons, correct?

Michael

Michael Avatar
*Has a custom title*



1,462


October 2007
Sure thing ... Nothing too bad though.

Oh and also, post anything you find around here! :)

Simie

Simie Avatar

******
ProScripter

1,052


May 2006
wrighty said:
Sure thing ... Nothing too bad though.

Oh and also, post anything you find around here! :)


Yeh, sure, let him beat it to pieces >_>

I've already found a few vulnerabilitys, like being able to edit anyones points...

Michael

Michael Avatar
*Has a custom title*



1,462


October 2007
simie said:
wrighty said:
Sure thing ... Nothing too bad though.

Oh and also, post anything you find around here! :)


Yeh, sure, let him beat it to pieces >_>

I've already found a few vulnerabilitys, like being able to edit anyones points...


Yet you still refuse to inform me of all of these vulnerabilities.

Simie

Simie Avatar

******
ProScripter

1,052


May 2006
Actually, I explained to you how to do it. Simply edit the referring URL, and you have access. =/

You rely too much on the referrer.

EDIT: I did tell you...

(22:36) Simie: I could simply fake a admin request to your script...
(22:36) Simie: an*
(22:36) Wrighty: doubt it.
(22:36) Wrighty: wait you could but don't
(22:36) Wrighty: or I'll ban you.
(22:36) Simi: From what?
(22:37) Wrighty: my server!



Last Edit: Feb 17, 2008 20:58:43 GMT by Simie

Chris

Chris Avatar

******
Head Coder

19,519


June 2005
One thing to mention before I start looking for security holes... people with custom domains that override PB domains are SOL since they can't go between the two. You should add support for a custom "forum" variable in the actual code that allows them to enter their actual PB URL and thus let it work. :)

And since Simie already covered it, I won't do a force send of a custom referrer in order to hack the code. But I will say that that leaves open quite a few vulnerabilities... =/

Michael

Michael Avatar
*Has a custom title*



1,462


October 2007
What should I use instead? :-/

Chris

Chris Avatar

******
Head Coder

19,519


June 2005
Well, referrer eliminates quite a bit of attempted hijackings by novices.... but with my experience, there's not much you can do to stop it any other way. Simie may have some more suggestions.

Simie

Simie Avatar

******
ProScripter

1,052


May 2006
I've given this a bit of thought, but couldn't find any practical ways of securing codes. I made a mindmap a while ago, you can take a look here:

mindmaps.proscripts.co.uk/Secure_PB_Codes.jpg

Michael

Michael Avatar
*Has a custom title*



1,462


October 2007
Ye registering externally isn't a bad idea. I guess I could tie into the installation area. Then when modifying points the main admin could have to enter their password. That would stop most (if not all) problems would it not? :-/

Chris

Chris Avatar

******
Head Coder

19,519


June 2005
Unless there's a user direct way of editing points, that would stop most issues. You have to make sure they can't register twice though and that the username is linked with the forum.

Simie

Simie Avatar

******
ProScripter

1,052


May 2006
There is still an issue. Someone could sign up an account, and link it with a forum they are not an admin at. This could be a security risk, so you should have some way of verifying that they are who they say they are. (Can't think of any ways off the top of my head)

Michael

Michael Avatar
*Has a custom title*



1,462


October 2007
how could someone sign up and link a forum to it?

When the install, I would require a password, which would be required when adding/removing points.

Simie

Simie Avatar

******
ProScripter

1,052


May 2006
Say this:

ForumA has NOT got the code installed.

Someone comes along and creates a false request to your server, and creates an account for ForumA.
Later on, the administrator from ForumA comes along adds the points code. The person who signed up for the account now has full admin access over the points, while the admin is left wondering what happened.



newBookmarkLockedFalling