test content
What is the Arc Client?
Install Arc

testing, bug-hunting, and finding exploits

tehbubbalootehbubbaloo Posts: 246 Arc User
edited June 2015 in Suggestions
700 posts in and many of the most annoying problems with this board have been resolved.

the vast majority of vanillaforums usability and aesthetic shortcoming have been addressed by two members, @nrglg and @asterelle. they have combined their efforts and packaged their auto-updating css and javascript improvements into a tampermonkey/stylish script that can be found here. go there and check it out. you wont be sorry.



Post edited by tehbubbaloo on
«13456756

Comments

  • tehbubbalootehbubbaloo Posts: 246 Arc User
    edited June 2015
    from this:


    to this:


    Post edited by tehbubbaloo on
  • tehbubbalootehbubbaloo Posts: 246 Arc User
    testing quotes.
    nope. although i now see a link, 'my discussions' has appeared in the nav menu.
    i wonder if threads i reply too will automatically be bookmarked, or maybe be accessed in the nav menu too?
    @tehbubbaloo works?
  • tehbubbalootehbubbaloo Posts: 246 Arc User
    testing quotes.
    nope. although i now see a link, 'my discussions' has appeared in the nav menu.
    i wonder if threads i reply too will automatically be bookmarked, or maybe be accessed in the nav menu too?
    @tehbubbaloo works?
    testing nested quotes.
    mentions ( @tehbubbaloo ) dont trigger a notification, so whats the point in them? it seems they cannot be preceded by a character other than space either: (@tehbubbaloo)
  • tehbubbalootehbubbaloo Posts: 246 Arc User
    edited April 2015
    testing images:



    2 mins edit
  • tehbubbalootehbubbaloo Posts: 246 Arc User
    this forum is super light on user preferences!
    i also see a link for 'followed categories', yet no way to specify any category as such. i think 'followed' may mean 'unhidden forums'. too bad i cant actually hide an entire category. or better yet, simply whitelist a category.
  • tehbubbalootehbubbaloo Posts: 246 Arc User
    this forum allows multiple recipients for pms. i wonder if that works similar to xenforo conversations or infopop eve private threads?
  • tehbubbalootehbubbaloo Posts: 246 Arc User
    edited April 2015
    i see no way to automatically bookmark threads that i participate in, a la vbulletin subscriptions. that is very unfortunate.


    edit: testing 30 second edit. looking for the window...
  • tehbubbalootehbubbaloo Posts: 246 Arc User
    why did that last comment also save as a draft in my draftbox? i would think autodrafts would autodelete if the post was lodged successfully.
  • rawynnrawynn Posts: 42 Arc User

    hmm...interesting, also looks like post counts here are a tad screwy too.., sorry has to post something cuase its going to look like your talking to yourself too much..lol.

    as far as the autosave to drafts go, that might be nice if your typing or making a massive post and lose internet connection, at least you might not have to start all over

    7GNOisE.gif?1
  • asterelleasterelle Posts: 368 Arc User
    I want to do some testing as well.
    Can we use fancy CSS?
    Floating divs?

    Fixed divs? (lol)

    alert("Script tags?");
  • asterelleasterelle Posts: 368 Arc User
    edited May 2015
    Wow seriously? Yeah there are lots of ways to troll with this stuff.
    Trippy stuff
    Post edited by Community_God on
  • asterelleasterelle Posts: 368 Arc User
    edited May 2015
    Testing possible signature. EDIT: Obsoleted
    Post edited by asterelle on
  • nrglgnrglg Posts: 347 Arc User
    edited April 2015
    What, can we just blatantly insert tags in? What are the limits I wonder.

    Nice find on the only animation available since inline animation isn't a thing. It should be.
    This is an example of how people could abuse these forums...
    Post edited by nrglg on

    GAME FORUMS (Direct Link & Arc Frame)
    Hub | Arc | PWI | FW | NW | STO | SO | BLR | JD | BOI | CO | WOI
    Hub | Arc | PWI | FW | NW | STO | SO | BLR | JD | BOI | CO | WOI
    Forum Enhancements and Visual Improvements
    (Greasemonkey/Tampermonkey and/or Stylish required)
    PWI vBulletin Forum Data Dumps and Backups
  • cococyacococya Posts: 230 Arc User
    Asterelle wins +1000 coolness points for the wonderful Madoka Magica siggy and avatar.
    ladybeard-crossdressing-wrestler-death-metal-singer-05.jpg
  • nrglgnrglg Posts: 347 Arc User
    edited April 2015
    Okay, this system is just downright vulnerable. Look, I covered up the flag and quote with my signature. Now imagine if instead of having what I wrote there, I mimicked the forum style "Flag" and "Quote" and then proceeded to have them do something malicious when the user clicked on them. This is what I would call a low-level XSS vulnerability (much like a phishing-style attack). It's not as bad as the usual ones involving js, but it's nothing to ignore.

    If you're reading this administrators, fix it.
    Post edited by nrglg on

    GAME FORUMS (Direct Link & Arc Frame)
    Hub | Arc | PWI | FW | NW | STO | SO | BLR | JD | BOI | CO | WOI
    Hub | Arc | PWI | FW | NW | STO | SO | BLR | JD | BOI | CO | WOI
    Forum Enhancements and Visual Improvements
    (Greasemonkey/Tampermonkey and/or Stylish required)
    PWI vBulletin Forum Data Dumps and Backups
  • asterelleasterelle Posts: 368 Arc User
    edited May 2015
    I'd rather they didn't fix it for a while, this is going to be fun. EDIT: -removed image-
    Post edited by asterelle on
  • dawnx2dawnx2 Posts: 4 Arc User
    This is funny...
    Doom_Panda
  • rieihdiusrieihdius Posts: 253 Arc User
    mmm so this fórum is all messed up

  • asterelleasterelle Posts: 368 Arc User
    OP was just using this as a test thread.  All the posts have been on topic.  These hacks don't work that well on mobile.
  • nrglgnrglg Posts: 347 Arc User
    edited April 2015
    Your above post floats in the background like a ghost on mobile and my name cover doesn't work either, because mobile doesn't show signatures.

    ----
    Edit: So, as proven by the person below, quote data comes unfiltered.

    Quote Test (iframe): Quote Test (youtube embed):
    Post edited by nrglg on

    GAME FORUMS (Direct Link & Arc Frame)
    Hub | Arc | PWI | FW | NW | STO | SO | BLR | JD | BOI | CO | WOI
    Hub | Arc | PWI | FW | NW | STO | SO | BLR | JD | BOI | CO | WOI
    Forum Enhancements and Visual Improvements
    (Greasemonkey/Tampermonkey and/or Stylish required)
    PWI vBulletin Forum Data Dumps and Backups
  • bankersbucksbankersbucks Posts: 6 Arc User
    edited April 2015
    This thread will be like the most fun ever!!!

    EDIT: Ok, so embedding flash into the sig didn't work. need to try something else.
    EDIT/EDIT: ok, turns out my code was archaic and the host site I had listed doesn't exist anymore. That what I get for ripping data from a site I haven't used in a few years.

    Final Edit: did something MUCH more simple. OMG. It doesn't show on the page, but will when you quote me.  HAHAHAHAHAHAHAHAHAAA
    Post edited by bankersbucks on
  • Break these forums.
    Rockfaise Posts: 999,999,999,999Unamused
  • tehbubbalootehbubbaloo Posts: 246 Arc User
    nrglg said:
    I just realized we hijacked the original poster's thread. Sorry OP.
    it was kinda the point of the thread ;)

    wow. i didnt realise it was so bad! anyone daring enough to try some sql injection?
  • savitrichaossavitrichaos Posts: 5 Arc User
    This thread will be like the most fun ever!!!

    EDIT: Ok, so embedding flash into the sig didn't work. need to try something else.
    EDIT/EDIT: ok, turns out my code was archaic and the host site I had listed doesn't exist anymore. That what I get for ripping data from a site I haven't used in a few years.

    Final Edit: did something MUCH more simple. OMG. It doesn't show on the page, but will when you quote me.  HAHAHAHAHAHAHAHAHAAA
    Ugh... bad to press quote many times.. lol
  • psychickittypsychickitty Posts: 253 Arc User
    edited April 2015

    well I hope they make it so people cant h_ac_k other accounts....because that would simply be lame. 


    I see that term I used is censored.  Interesting

    Power without Perception is Spiritually useless and therefore of no true value.

    =^_^=


  • tehbubbalootehbubbaloo Posts: 246 Arc User
    edited April 2015
    i have found that i can sorta 'subscribe' to threads by bookmarking them, but there is never any indication that there is a new post, nor is there any way to jump to the first unread post in  the thread.

    i dont see any way to ignore users...

    man this board is really starting to look like a board a company adopts if they dont want their customers using the forum.
    Post edited by tehbubbaloo on
  • gulberatgulberat Posts: 400 Arc User
    Good grief...and here I was thinking the HTML/CSS function was limited because I couldn't even get the link color to change in my signature. I was trying to change the shade of blue to look more like my sig pic, and it would reject the font coding (as in, strip it out entirely every time I tried to save it that way). Which begs the question of why signatures are so much more tightly restricted yet in the bodies of posts, people can do all of this stuff.

    Christian Gaming Community Fleets--Faith, Fun, and Fellowship! See the website and PM for more. :-)
    Proudly F2P.  Signature image by gulberat. Avatar image by balsavor.deviantart.com.
  • dabelgravedabelgrave Posts: 83 Arc User
    gulberat said:
    Good grief...and here I was thinking the HTML/CSS function was limited because I couldn't even get the link color to change in my signature. I was trying to change the shade of blue to look more like my sig pic, and it would reject the font coding (as in, strip it out entirely every time I tried to save it that way). Which begs the question of why signatures are so much more tightly restricted yet in the bodies of posts, people can do all of this stuff.
    Yeah, the css restriction in sigs bothered me too.
  • gulberatgulberat Posts: 400 Arc User
    dabelgrave said: gulberat said: Good grief...and here I was thinking the HTML/CSS function was limited because I couldn't even get the link color to change in my signature. I was trying to change the shade of blue to look more like my sig pic, and it would reject the font coding (as in, strip it out entirely every time I tried to save it that way). Which begs the question of why signatures are so much more tightly restricted yet in the bodies of posts, people can do all of this stuff. Yeah, the css restriction in sigs bothered me too. On the other hand, in light of all of this stuff, might it not be a sensible step for PWE to implement those limits on forum posts? I mean, I can live with my link and text not being exactly the right nitpicky color.

    Christian Gaming Community Fleets--Faith, Fun, and Fellowship! See the website and PM for more. :-)
    Proudly F2P.  Signature image by gulberat. Avatar image by balsavor.deviantart.com.
  • dabelgravedabelgrave Posts: 83 Arc User
    gulberat said:On the other hand, in light of all of this stuff, might it not be a sensible step for PWE to implement those limits on forum posts? I mean, I can live with my link and text not being exactly the right nitpicky color.

    I can adapt.

    CSS inserted into my post gets stripped if I toggle the html view. However, it does not get stripped if I hit the Preview button. I'll have to test if something like that is affecting sigs.


Sign In or Register to comment.