What’s Your Preference?

mcanseco · #1 (**permalink**) 10-16-2010, 11:37 PM

IABoomer · #2 (**permalink**) 10-17-2010, 12:23 AM

I'd be shocked if the forum software let you incorporate ********** into your image tags, since that could allow for all sorts of malicious things.

If you want to show before and after images here, you'll have to post them individually.

mcanseco · #3 (**permalink**) 10-17-2010, 01:12 AM

Looks like I figured it out.......

dakwegmo · #4 (**permalink**) 10-17-2010, 02:56 AM

Yeah, while it works. I'm a little concerned that it does

Not good

sk66 · #5 (**permalink**) 10-17-2010, 03:48 AM

It's simple onmouseover html code, what's the concern?
I showed how to do this several months ago.

mcanseco · #6 (**permalink**) 10-17-2010, 04:52 AM

Quote:

Originally Posted by dakwegmo

Yeah, while it works. I'm a little concerned that it does

Not good

wow....I see what you mean.

IABoomer · #7 (**permalink**) 10-17-2010, 05:46 AM

Quote:

Originally Posted by sk66

It's simple onmouseover html code, what's the concern?
I showed how to do this several months ago.

Search for "cross site scripting" or "XSS" to see examples of how malicious users could manipulate code to cause problems. If the admins wouldn't just let any user post code to the web server, then they should really consider locking down the ability for scripting to run.

statichash · #8 (**permalink**) 10-17-2010, 07:28 AM

Hey mcanseco glad you got it working, looks good!

@IABoomer & dakwegmo: you make valid points regarding the malicious use of java-script, hopefully people aren't trying to do that, but so long as it's used in a positive manner, like mcanseco and others including myself who are using it to do basic non-malicious things, I think it's great to have it at our disposal, it makes things fun and interesting! Fortunately, non-members are unable to post or add threads, so the fact that the site is moderated helps. If a user were to do something malicious, then I would suspect that it would immediately result in their account being deleted.

sk66 · #9 (**permalink**) 10-17-2010, 01:53 PM

Quote:

Originally Posted by IABoomer

Search for "cross site scripting" or "XSS" to see examples of how malicious users could manipulate code to cause problems. If the admins wouldn't just let any user post code to the web server, then they should really consider locking down the ability for scripting to run.

I am aware of XSS, it requires JS to be loaded/activated to be malicious. When I first figured out how to get rollover to work no JS or fragment of Java would work here...the BB is pretty well locked down. Only very basic HTML is allowed and not all commands are accepted. (I did not try to load a Script from external)