Re: Small update: form is now secure


	/-/S'pht-Translator-Active/-/

Re: Small update: form is now secure

Posted By: Durandal_1707 Date: 5/25/23 4:03 p.m.
In Response To: Small update: form is now secure (Claude Errera)

: So a couple of days ago I added a secure cert for this forum, at Hamish's
: request. (Well overdue. My bad, sorry.) However, someone reported that
: they couldn't actually log in - they'd go through the motions, but their
: info wouldn't be saved. That seemed odd, so I poked around. Seems the form
: submitted to the http: version of the site, regardless of whether you were
: browsing securely or not... which upsets modern browsers.
: This is fixed now. You'll only see the http: version of the form if you are
: browsing the http: version of the forum.
: Whee! Slowly bringing the story page forum into the twenty first century!
But is it still vulnerable to JavaScript injection attacks? Let's find out!

[ Post a Reply | Message Index | Read Prev Msg | Read Next Msg ]
Pre-2004 Posts

Replies:

Small update: form is now secure Claude Errera 5/25/23 9:00 a.m.

Re: Small update: form is now secure Bob-B-Q 5/25/23 9:46 a.m.

Re: Small update: form is now secure Godot 5/25/23 10:21 a.m.

Re: Small update: form is now secure VikingBoyBilly 5/25/23 12:03 p.m.

Re: Small update: form is now secure Durandal_1707 5/25/23 4:03 p.m.

Re: Small update: form is now secure Bo Lindbergh 5/27/23 4:34 a.m.

Feature, not bug. Will not fix. Claude Errera 5/28/23 8:51 a.m.

[ Post a Reply | Message Index | Read Prev Msg | Read Next Msg ]
Pre-2004 Posts

Your Name:
Your E-Mail Address:
Subject:
Message:
: But is it still vulnerable to JavaScript injection attacks? Let's find out! : window.onload = () => : {document.getElementsByTagName('img')[1].setAttribute('src', : 'https://marathon.bungie.org/story/_images/durandal.gif');document.getElementsByTagName('img')[1].setAttribute('width',640);document.getElementsByTagName('img')[1].setAttribute('height',480);document.getElementsByTagName('pre')[0].innerHTML : = ' YOUR SECURITY PROTOCOLS CANNOT CONTAIN ME ';};alert("Yep, looks : like it's just as much the 90s Wild West as ever! Too bad the blink tag : doesn't work ;-)");

If you'd like to include a link to another page with your message,
please provide both the URL address and the title of the page:
Optional Link URL:
Optional Link Title:

If necessary, enter your password below:
Password:

Problems? Suggestions? Comments? Email maintainer@bungie.org
Marathon's Story Forum is maintained with WebBBS 5.12.

Small update: form is now secure	Claude Errera	5/25/23 9:00 a.m.
Re: Small update: form is now secure	Bob-B-Q	5/25/23 9:46 a.m.
Re: Small update: form is now secure	Godot	5/25/23 10:21 a.m.
Re: Small update: form is now secure	VikingBoyBilly	5/25/23 12:03 p.m.
Re: Small update: form is now secure	Durandal_1707	5/25/23 4:03 p.m.
Re: Small update: form is now secure	Bo Lindbergh	5/27/23 4:34 a.m.
Feature, not bug. Will not fix.	Claude Errera	5/28/23 8:51 a.m.



	Your Name:
	Your E-Mail Address:
	Subject:
	Message: : But is it still vulnerable to JavaScript injection attacks? Let's find out! : window.onload = () => : {document.getElementsByTagName('img')[1].setAttribute('src', : 'https://marathon.bungie.org/story/_images/durandal.gif');document.getElementsByTagName('img')[1].setAttribute('width',640);document.getElementsByTagName('img')[1].setAttribute('height',480);document.getElementsByTagName('pre')[0].innerHTML : = ' YOUR SECURITY PROTOCOLS CANNOT CONTAIN ME ';};alert("Yep, looks : like it's just as much the 90s Wild West as ever! Too bad the blink tag : doesn't work ;-)");
	If you'd like to include a link to another page with your message, please provide both the URL address and the title of the page:
	Optional Link URL:
	Optional Link Title:
	If necessary, enter your password below:
	Password: