javascript:who(userid) - I think you should fix that huh?

[CipherLock]

Maybe Ganryu can help out?

 

[OMGWTFBBQ]

lol - where is this?

 

[CipherLock]

lol - where is this?

the post count beside EVERY THREAD

 

[OMGWTFBBQ]

Hmm, when I click on it nothing happens - so I assume it must pop something up and my browser is blocking that.
I'm too lazy to figure out what Safari/PithHelmet want me to do to see pop-ups since it is something beyond ctrl, shift, or alt equivalents.

 

[PIGEON-RAT]

digger will fix it

never doubt the man

 

[OMGWTFBBQ]

What is the problem?

When I was on windows, I was far more annoyed with the errors that would occur on the code that would tell the karma what to say if clicked on and if the username had an apostrophe in it (it would die because it saw it as closing quotes and then a script failure).... which actually now that I think of it is a security hole...

interesting - your username can be a security hole

I can go into more detail of how to exploit that if you want - or I can go into more detail on how to fix it.

Either way.

 

[Becoming]

mr smarty-pants....

how bout you just exploit it and show us what you can do with it or STFU?

 

[OMGWTFBBQ]

mr smarty-pants....

how bout you just exploit it and show us what you can do with it or STFU?

It would involve a long username and registering new users here is a pain in the ass.

Theoretically you would be able to get a user's cookie and then redirect that data to an outside site, store the data, and then either let them see they are on the outside site, or redirect them back to the main page of Elite.

Once you have their cookie, then you have their username and password.

Once you have those, you can enter the site as them, change the password, and you have their account to do with as you please.

That said - I think the username would have to be quite long and I suspect that they limit the username length to something well under that limit.

The username would need to look something like:
';a=getCookieCode();redirectCode(a);break;

But the getCookieCode and redirectCode stuff would be much longer than that - were it just the above, I think it would be feasible.

I also don't recall if "break" is the syntax in javascript or if there is something else, but the theory is the same.

 

[Code]

Alright hoe, I'm taking this site off my alerts portal beeyoch!

It would involve a long username and registering new users here is a pain in the ass.

Theoretically you would be able to get a user's cookie and then redirect that data to an outside site, store the data, and then either let them see they are on the outside site, or redirect them back to the main page of Elite.

Once you have their cookie, then you have their username and password.

Once you have those, you can enter the site as them, change the password, and you have their account to do with as you please.

That said - I think the username would have to be quite long and I suspect that they limit the username length to something well under that limit.

The username would need to look something like:
';a=getCookieCode();redirectCode(a);break;

But the getCookieCode and redirectCode stuff would be much longer than that - were it just the above, I think it would be feasible.

I also don't recall if "break" is the syntax in javascript or if there is something else, but the theory is the same.

 

[Becoming]

well if I can't get some free karma out of it, it really is of no use to me...