o.o


Honestly, it kinda does. This pretty much forces them to do something unless they really give no shits.

Oh, please... everyone knows your true identity by now, Keyser Söze!

He does have a point now though. I tend to log out and back in frequently though, so I'm not too worried.

Maybe if he first informed GOG, waited for them to take action, and only did this as a last resort after they obviously ignored his warning. But as plan A this just sucks.

Heh. Okay.

Let me guess.

You can attach JS code?

> Have you reported the issue to GOG staff?

I have. In the past. Many times. Nothing was ever done.

This time around I also don't expect any action on their part. My goal is to warn the users. I just decided to look into this issue today (prompted by the "91" debacle) and found it right away. If someone was looking for vulnerabilities on purpose and with a malicious goal in mind, they'd have found this a looooong time ago.

So yea, informing GOG is useless. I'd much rather let you know.

Scary... I assume copying text and putting it in the "quote_x" "/quote" brackets while using the "new post" option is safe, right?

> I assume copying text and putting it in the "quote_x" "/quote" brackets while using the "new post" option is safe, right?

Should be safe. If you use {quote}{/quote} but with square brackets you probably won't get the name of the person you are quoting. If you note the number of their post and do {quote_22}{/quote} you'll get the regular quote with their avatar.

Yes.
It's only the buttons that can be dangerous (the author is essentially creating new fake ones by injecting javascript).

> It's only the buttons that can be dangerous

Incorrect. The very act of clicking on the reply button will execute code. The fake buttons are just to demonstrate what can be done. Notice that if you hit reply to my original post, an alert message will be displayed before you ever see the buttons.

Yes. By "buttons" I meant Reply button as well.

A quick and easy partial fix which breaks OP's exploit would be to disallow any post that contains </textarea>. Just like they did for +91. Just saying.

But to be honest they really should properly escape everything, I'm quite surprised that's currently not the case.

I'm not.

Munchausen by proxy? lol