User Name Password Register
DaniWeb IT Discussion Community
All
What is DaniWeb IT Discussion Community?
You're currently browsing the DaniWeb Community Feedback section within the Coffee House category of DaniWeb, a massive community of 403,509 software developers, web developers, Internet marketers, and tech gurus who are all enthusiastic about making contacts, networking, and learning from each other. In fact, there are 4,142 IT professionals currently interacting right now! Registration is free, only takes a minute and lets you enjoy all of the interactive features of the site.
Please support our DaniWeb Community Feedback advertiser: Programming Forums
Views: 2598 | Replies: 37
Reply
Join Date: Apr 2006
Location: Canada
Posts: 4,476
Reputation: John A is a glorious beacon of light John A is a glorious beacon of light John A is a glorious beacon of light John A is a glorious beacon of light John A is a glorious beacon of light John A is a glorious beacon of light 
Rep Power: 16
Solved Threads: 272
Moderator
Staff Writer
Featured Blogger
John A's Avatar
John A John A is offline Offline
Vampirical Moderator

Re: Message preview seems to allow unfiltered markup... XSS?

  #31  
Aug 1st, 2007
>I know what im talking about my friend

Fair enough, you do know what you're talking about. Therefore, I ask you to explain the following things.

When I look in the source code of this post, this is what follows:
&lt;iframe src=&quot;http://fusiongroups.net/test.html&quot; /&gt;<br />
<br />
I noticed this a while back... it seems that any html in the first part of the body of a message gets interpreted in that little preview box that shows the first part of a thread when you mouse over the title in a forum view... is this known about/considered a problem? If my suspicions are correct; mousing over this thread's title on the daniweb community board listing page title will execute some javascript from another server in a child context of a daniweb page = not good.
Firstly, is this HTML or not? Secondly, can you explain how the content posted above (in particular, the first line) would behave differently in various browsers? (You cited IE 7 as one that, as you claim, executed 'disabled' HTML.)

Thirdly, can you please explain the significance of CSS in determining whether or not the popup window shows or not?

(Note: the said popup does not appear for me within IE 7 running on XP Pro, so I'm at a loss for what causes jbennet's issue.)
Last edited by John A : Aug 1st, 2007 at 10:54 pm.
tuxation.com - Linux articles, tutorials, and discussions
Reply With Quote  
Join Date: Jan 2007
Posts: 2,537
Reputation: MidiMagic is on a distinguished road 
Rep Power: 7
Solved Threads: 111
MidiMagic's Avatar
MidiMagic MidiMagic is offline Offline
Posting Maven

Re: Message preview seems to allow unfiltered markup... XSS?

  #32  
Aug 1st, 2007
Joeprogrammer

What is in your code box is one line of "browser-proofed" html, followed by plain text.

It should render as source html code, not as an actual html object.
Last edited by MidiMagic : Aug 1st, 2007 at 10:55 pm.
Daylight-saving time uses more gasoline
Reply With Quote  
Join Date: Dec 2005
Posts: 2,623
Reputation: The Dude is an unknown quantity at this point 
Rep Power: 8
Solved Threads: 24
The Dude's Avatar
The Dude The Dude is offline Offline
Posting Maven

Re: Message preview seems to allow unfiltered markup... XSS?

  #33  
Aug 2nd, 2007
Yes thats exactly right.......

HTML code is DISABLED on this site (MEMBERS cannot post HTML coding in posts (And have it execute))
Reply With Quote  
Join Date: Jun 2006
Location: India
Posts: 6,816
Reputation: ~s.o.s~ is a splendid one to behold ~s.o.s~ is a splendid one to behold ~s.o.s~ is a splendid one to behold ~s.o.s~ is a splendid one to behold ~s.o.s~ is a splendid one to behold ~s.o.s~ is a splendid one to behold ~s.o.s~ is a splendid one to behold 
Rep Power: 23
Solved Threads: 339
Moderator
Featured Poster
~s.o.s~'s Avatar
~s.o.s~ ~s.o.s~ is offline Offline
Lazy, Useless & Apathetic

Re: Message preview seems to allow unfiltered markup... XSS?

  #34  
Aug 2nd, 2007
> HTML code is DISABLED
Of course, phpBB's use bbcode for formatting and not HTML.
"I don't accept change. I don't deserve to live."

"Working a real job is a win if you're lazy, greedy, or unmotivated. If you're average, you fit right in. And if you're above average, the basic terms of employment and premise of the arrangement is against your interests."
Reply With Quote  
Join Date: Jan 2007
Posts: 2,537
Reputation: MidiMagic is on a distinguished road 
Rep Power: 7
Solved Threads: 111
MidiMagic's Avatar
MidiMagic MidiMagic is offline Offline
Posting Maven

Re: Message preview seems to allow unfiltered markup... XSS?

  #35  
Aug 2nd, 2007
So why did I see the html code I put in a code block fully rendered in the edit window when I clicked the back button after posting that code?
Daylight-saving time uses more gasoline
Reply With Quote  
Join Date: Apr 2006
Location: Canada
Posts: 4,476
Reputation: John A is a glorious beacon of light John A is a glorious beacon of light John A is a glorious beacon of light John A is a glorious beacon of light John A is a glorious beacon of light John A is a glorious beacon of light 
Rep Power: 16
Solved Threads: 272
Moderator
Staff Writer
Featured Blogger
John A's Avatar
John A John A is offline Offline
Vampirical Moderator

Re: Message preview seems to allow unfiltered markup... XSS?

  #36  
Aug 2nd, 2007
Originally Posted by MidiMagic View Post
What is in your code box is one line of "browser-proofed" html, followed by plain text.

It should render as source html code, not as an actual html object.
Yes, I am completely aware of that. The real problem was that code coming through the preview window was not "browser-proofed".

Originally Posted by The Dude View Post
Yes thats exactly right.......

HTML code is DISABLED on this site (MEMBERS cannot post HTML coding in posts (And have it execute))
Then how come 6 users (including myself) experienced this problem of un-escaped HTML through the preview window with Firefox, Internet Explorer, and Opera? Surely you don't mean to say that all these browsers were executing code incorrectly while yours was behaving normally? By the way, you never answered by second and third questions.

But this is a completely pointless argument, everything is going in circles. As far as I'm concerned, it's over -- at least for me.
tuxation.com - Linux articles, tutorials, and discussions
Reply With Quote  
Join Date: Dec 2005
Posts: 2,623
Reputation: The Dude is an unknown quantity at this point 
Rep Power: 8
Solved Threads: 24
The Dude's Avatar
The Dude The Dude is offline Offline
Posting Maven

Re: Message preview seems to allow unfiltered markup... XSS?

  #37  
Aug 3rd, 2007
Because your browser is executing the code manually! (Which it shouldnt do)
Reply With Quote  
Join Date: Jan 2007
Posts: 2,537
Reputation: MidiMagic is on a distinguished road 
Rep Power: 7
Solved Threads: 111
MidiMagic's Avatar
MidiMagic MidiMagic is offline Offline
Posting Maven

Re: Message preview seems to allow unfiltered markup... XSS?

  #38  
Aug 3rd, 2007
I just thought of something stupid.

Is it possible that the browser is somehow seeing text it already interpreted (such as stuff cached) and is interpreting it again?
Daylight-saving time uses more gasoline
Reply With Quote  
Reply

Only community members can participate in forum threads. You must register or log in to contribute.

DaniWeb DaniWeb Community Feedback Marketplace
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

 

Thread Tools Display Modes

Other Threads in the DaniWeb Community Feedback Forum

All times are GMT -4. The time now is 12:40 pm.
Forum system based on vBulletin Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
©2003 - 2008 DaniWeb® LLC