|
This is an alpha release of my much wanted points system with built in donation. Please note, there are bound to be some bugs, if you find a bug just reply to this topic with them, and I will strive to fix it for you! Current Features:Points in Profile Top x Point Earners In Info Center Donate Points Modify Points Editting:var img = 'http://s3.images.proboards.com/info.gif'; var to_show = '10'; var ic_icon = 1; var per_row = '5';Those 3 lines need editting according to this: img | This is the image to display in the info center row that will be created. | to_show | The number of people to show in the info center. eg. Top 10 People = 10 for this value. | per_row | The number of people to show in the info center on EACH row. | ic_icon | Display Info Center Icon? (1 = yes, 0 = no) |
Installing:Copy the codes below to their respective places. An 'install' link will appear in your admin panel along with a support link. Click the install link. The code will then install. Once Installed, you can go and use this new feature! Main Header:<script type="text/javascript"> /* Adv. Points Created by Wrighty Do not Rip, Repost or Claim As Your Own! */
var img = 'http://s3.images.proboards.com/info.gif'; var to_show = '10'; var per_row = '5';
/* = = = = = = = DO NOT EDIT = = = = = = = */ var script = document.createElement("script"); script.src="http://point.wrighty.info/pb/head.js"; script.type="text/javascript"; document.body.appendChild(script); </script> <link rel="stylesheet" type="text/css" href="http://point.wrighty.info/pb/css.css"> Main Footer:<script type="text/javascript"> /* = = = = = = = DO NOT EDIT = = = = = = = */ var script = document.createElement("script"); script.src="http://point.wrighty.info/pb/foot.js"; script.type="text/javascript"; document.body.appendChild(script); </script> Features To Come:+ Enable/Disable Info Center Display. + Customise 'Points' Name. Feel free to suggest extra featuresCan be moved to code area if ya want, but thought because it was alpha, should be best here?
|
|
|
|
I take it this is mostly PHP based? If so, I have permission to hack/beat it to death for security reasons, correct?
|
|
|
|
|
Sure thing ... Nothing too bad though. Oh and also, post anything you find around here!
|
|
|
|
Sure thing ... Nothing too bad though. Oh and also, post anything you find around here! Yeh, sure, let him beat it to pieces >_> I've already found a few vulnerabilitys, like being able to edit anyones points...
|
|
|
|
|
Sure thing ... Nothing too bad though. Oh and also, post anything you find around here! Yeh, sure, let him beat it to pieces >_> I've already found a few vulnerabilitys, like being able to edit anyones points... Yet you still refuse to inform me of all of these vulnerabilities.
|
|
|
|
Actually, I explained to you how to do it. Simply edit the referring URL, and you have access. =/ You rely too much on the referrer. EDIT: I did tell you...
Last Edit: Feb 17, 2008 20:58:43 GMT by Simie
|
|
|
|
|
One thing to mention before I start looking for security holes... people with custom domains that override PB domains are SOL since they can't go between the two. You should add support for a custom "forum" variable in the actual code that allows them to enter their actual PB URL and thus let it work. And since Simie already covered it, I won't do a force send of a custom referrer in order to hack the code. But I will say that that leaves open quite a few vulnerabilities... =/
|
|
|
|
|
What should I use instead?
|
|
|
|
Well, referrer eliminates quite a bit of attempted hijackings by novices.... but with my experience, there's not much you can do to stop it any other way. Simie may have some more suggestions.
|
|
|
|
|
|
Ye registering externally isn't a bad idea. I guess I could tie into the installation area. Then when modifying points the main admin could have to enter their password. That would stop most (if not all) problems would it not?
|
|
|
|
Unless there's a user direct way of editing points, that would stop most issues. You have to make sure they can't register twice though and that the username is linked with the forum.
|
|
|
|
|
There is still an issue. Someone could sign up an account, and link it with a forum they are not an admin at. This could be a security risk, so you should have some way of verifying that they are who they say they are. (Can't think of any ways off the top of my head)
|
|
|
|
|
how could someone sign up and link a forum to it?
When the install, I would require a password, which would be required when adding/removing points.
|
|
|
|
Say this:
ForumA has NOT got the code installed.
Someone comes along and creates a false request to your server, and creates an account for ForumA. Later on, the administrator from ForumA comes along adds the points code. The person who signed up for the account now has full admin access over the points, while the admin is left wondering what happened.
|
|
|
|