Shoutbox

there's a bug that let  a user upload an attachment with a dodgy name that can make  that the pages looks weird. As an example, see the name of the attached file, and now think about what would have happened if the name had something like <script> ...

I finally can add Flashes to my sig

dangerous security bug...

Hmm... dodgy. I didn't think Windows would allow such characters in file names...

fortunaly, <script> wouldn't be possible to use though... (I think...... I hope..... gonna test this )

edit: hmmm... I thought you used mybb code and that the filename gots converted... you actually used < and > ? How did you do that? Cause what WDZ said is true, windows wouldn't allow it...

?

or was it the use of %3C and %3E ?

quote:

---

Originally posted by KeyStorm
I finally can add Flashes to my sig

---

not in the sig only in attachments

quote:

---

Originally posted by WDZ
I didn't think Windows would allow such characters in file names

---

windows not, but linux yes. I was testing in my own mybb instalation and I could upload a file with "<script>" in its name. Then the page couldn't be veiwed from that point

quote:

---

Originally posted by CookieRevised
you actually used < and > ?

---

yes, i did.

just create a file in linux, something like

echo hello > normal\<b\>bold\<font\ size=\'7\'\>size.txt

and upload it ...

quote:

---

Originally posted by KeyStorm
dangerous security bug...

---

of course....


Anyway, I see that's fixed now

* Mike wanted to see how it looks...

So you mean that it allowed you to use html?

quote:

---

Originally posted by Mike2
* Mike2 wanted to see how it looks...

---

Attachment: normalboldsize.txt (20 bytes)
This file has been downloaded 12 time(s).

quote:

---

Originally posted by Mike2
So you mean that it allowed you to use html?

---

yes...

see more examples at
http://usuarios.lycos.es/lostintos/choli/foros/showthread.php?tid=6 (I've deleted the one with <script>, btw)

I got a nice script one:

<script>windows.status='VERY DANGEROUS THREAD'</script>test.txt

quote:

---

Originally posted by CookieRevised

<script>windows.status='VERY DANGEROUS THREAD'</script>test.txt

---

I've also thought about that but can't be done, because in Linux (and also in Win) you can't create a file with a / in its name (in linux you can put a \ , however <\script> isn't recogniced by browsers )

Cool.
I want to put a background music