test content
Logo
What is the Arc Client?
Install Arc
Major Issue in Gateway Site and Character Names!
revenantbob
Member Posts: 0 Arc User
I noticed when I selected my character in the Neverwinter Gateway nothing would happen, although my alt would work fine. I decided to debug the problem and found the issue:
The Onclick is using my character's name as is without escaping the string. Therefore "Szinrah Rin'Aghar" which has an apostrophe in it is causing the onclick to screw up the string it's passing in.
http://gateway.playneverwinter.com/#char(Szinrah Rin'Aghar@RevenantBob)/ <-- when I went to the site manually like this, sure enough, the character worked fine.
This leads me to believe there are other places where strings are not properly escaped and this can cause major issues (And possible exploits) to the site.
I'm reporting this here because I am not sure where to report bugs in that site.
<li class="Player_Trickster" onclick="client.characterSelect('Szinrah Rin'Aghar@RevenantBob');">
<h4 class="char-list-name">Szinrah Rin'Aghar</h4>
<h5 class="char-list-level">Level <span>60</span></h5>
<h5 class="char-list-class">Trickster Rogue</h5>
<h5 class="char-list-race">Menzoberranzan Renegade</h5>
</li>
The Onclick is using my character's name as is without escaping the string. Therefore "Szinrah Rin'Aghar" which has an apostrophe in it is causing the onclick to screw up the string it's passing in.
http://gateway.playneverwinter.com/#char(Szinrah Rin'Aghar@RevenantBob)/ <-- when I went to the site manually like this, sure enough, the character worked fine.
This leads me to believe there are other places where strings are not properly escaped and this can cause major issues (And possible exploits) to the site.
I'm reporting this here because I am not sure where to report bugs in that site.
0