Graal Forums  

Go Back   Graal Forums > Graal V6 forums > Bug Report
Reload this Page HTML abuse in PMs
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
Page 1 of 3 1 23
 
Thread Tools Search this Thread Rating: Thread Rating: 4 votes, 5.00 average. Display Modes
  #1  
Old 04-10-2008, 02:03 PM
Eranian Eranian is offline
Registered User
Join Date: Apr 2008
Posts: 22
Eranian is on a distinguished road
Exclamation HTML abuse in PMs
Earlier today I received a few PMs with download links embedded in <img> HTML tags.

The links were to Linux ISOs which were about 4GB each, and Graal tried to automatically download the files when I opened the PM.

I'm concerned because somebody could use the same method to link to more malicious files, and Graal no longer has an option to disable HTML in PMs.
Reply With Quote
  #2  
Old 04-10-2008, 02:11 PM
TSAdmin TSAdmin is offline
Forum Moderator
TSAdmin's Avatar
Join Date: Aug 2006
Location: Australia
Posts: 1,980
TSAdmin has much to be proud ofTSAdmin has much to be proud ofTSAdmin has much to be proud ofTSAdmin has much to be proud ofTSAdmin has much to be proud ofTSAdmin has much to be proud of
I just heard about this, myself. Even if we had an option to "disable HTML" implemented, now, people who choose not to disable it would be still prone. It wasn't so fun even getting PMs of ACTUAL images, at times, when the image itself was bigger than the PM window. Maybe HTML tags such as IMG need to be entirely removed.
__________________
⇒ TSAdmin (Forum Moderator)
⇒ Welcome to the Official GraalOnline Forums! Where sharing an opinion may be seen as a declaration of war!
------------------------
· User Agreement · Code of Conduct · Forum Rules ·
· Graal Support · Administrative Contacts ·
Reply With Quote
  #3  
Old 04-10-2008, 02:35 PM
Eranian Eranian is offline
Registered User
Join Date: Apr 2008
Posts: 22
Eranian is on a distinguished road
I like images in HTMLs.

Lucas has been hosting a lot of cool events on Era making excellent use of images in PMs to describe the event and such.

ISO is technically an image format though, except it's an image of an executable so it's not really safe.

If there were some way to limit the img tags to gifs, pngs & jpgs, and maybe even a filesize or image dimensions limit, that'd be nice.
Reply With Quote
  #4  
Old 04-10-2008, 02:55 PM
Admins Admins is offline
Graal Administration
Join Date: Jan 2000
Location: Admins
Posts: 11,693
Admins has much to be proud ofAdmins has much to be proud ofAdmins has much to be proud ofAdmins has much to be proud ofAdmins has much to be proud ofAdmins has much to be proud of
Yes will add a filter to only allow local server files in img tags.
Reply With Quote
  #5  
Old 04-10-2008, 03:04 PM
Rufus Rufus is offline
Registered User
Join Date: Jun 2004
Location: United Kingdom
Posts: 4,698
Rufus has much to be proud ofRufus has much to be proud ofRufus has much to be proud ofRufus has much to be proud ofRufus has much to be proud ofRufus has much to be proud of
Quote:
Originally Posted by Stefan View Post
Yes will add a filter to only allow local server files in img tags.
Why would you want to link a local server file as an image in PM?
__________________
Quote:
Originally Posted by Loriel View Post
Seriously, you have ****-all for content and you're not exactly pulling in new developer talent, angling for prestigious titles should be your last concern.
Reply With Quote
  #6  
Old 04-10-2008, 03:16 PM
Crow Crow is offline
ǝɔɐɹq ʎןɹnɔ
Crow's Avatar
Join Date: Dec 2006
Location: Germany
Posts: 5,153
Crow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond repute
Quote:
Originally Posted by Rufus View Post
Why would you want to link a local server file as an image in PM?
Basic html or announcing PMs included. We did that on Era last christmas, having a christmas picture somewhere in the file browser we linked to in the news gui. Its useful.

Stefan, I think you should limit external links to ones with no extension, .html, .htm and maybe .php or .phtml.


Edit: And images, of course :o!
Reply With Quote
  #7  
Old 04-10-2008, 03:38 PM
Rufus Rufus is offline
Registered User
Join Date: Jun 2004
Location: United Kingdom
Posts: 4,698
Rufus has much to be proud ofRufus has much to be proud ofRufus has much to be proud ofRufus has much to be proud ofRufus has much to be proud ofRufus has much to be proud of
Quote:
Originally Posted by Crow View Post
Basic html or announcing PMs included. We did that on Era last christmas, having a christmas picture somewhere in the file browser we linked to in the news gui. Its useful.
Useful for server staff maybe, but not for players who simply want to embed images into their private messages though.
__________________
Quote:
Originally Posted by Loriel View Post
Seriously, you have ****-all for content and you're not exactly pulling in new developer talent, angling for prestigious titles should be your last concern.
Reply With Quote
  #8  
Old 04-10-2008, 03:57 PM
xXziroXx xXziroXx is offline
Master of Puppets
xXziroXx's Avatar
Join Date: May 2004
Location: Sweden
Posts: 5,288
xXziroXx has a brilliant futurexXziroXx has a brilliant futurexXziroXx has a brilliant futurexXziroXx has a brilliant futurexXziroXx has a brilliant futurexXziroXx has a brilliant futurexXziroXx has a brilliant future
Send a message via AIM to xXziroXx Send a message via MSN to xXziroXx
Afaik, ISO files will NOT execute on their own, ever. I dont know of any program that auto opens them when you download them, and as long as you dont open it, who cares. Just delete it.

And Stefan, making it so only local images can be displayed with IMG tags kinda defeats the purpose of it. How about making a serveroption for "trusted domains" that staff could alter? Sorta like...

trusteddomains=imageshack.com,photobucket.com,graa lonline.com

And so fourth. Just throwing it out there..
__________________

"A delayed game is eventually good, but a rushed game is forever bad." - Shigeru Miyamoto
Reply With Quote
  #9  
Old 04-10-2008, 04:12 PM
Crow Crow is offline
ǝɔɐɹq ʎןɹnɔ
Crow's Avatar
Join Date: Dec 2006
Location: Germany
Posts: 5,153
Crow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond reputeCrow has a reputation beyond repute
Quote:
Originally Posted by Rufus View Post
Useful for server staff maybe, but not for players who simply want to embed images into their private messages though.
True ;f
Reply With Quote
  #10  
Old 04-10-2008, 04:24 PM
Twinny Twinny is offline
My empire of dirt
Twinny's Avatar
Join Date: Mar 2006
Location: Australia
Posts: 2,422
Twinny is just really niceTwinny is just really nice
Send a message via AIM to Twinny
Haha Linux pride!

Anyhoo, perhaps just filter out remote files > 2mb (screw BMPs) and to .jpg, .gif and .png.
Reply With Quote
  #11  
Old 04-10-2008, 04:49 PM
DrakilorP2P DrakilorP2P is offline
Registered User
DrakilorP2P's Avatar
Join Date: Apr 2006
Posts: 755
DrakilorP2P is just really niceDrakilorP2P is just really nice
Quote:
Originally Posted by xXziroXx View Post
Afaik, ISO files will NOT execute on their own, ever.
As far as I know, ISO files aren't executable.

Quote:
Originally Posted by Eranian View Post
ISO is technically an image format though, except it's an image of an executable so it's not really safe.
And I'm pretty sure that the files in question are archive files complete with all files and filesystem metadata in order to represent an optical disc.

On the other hand, it's possible to append large files onto a jpg image and <img> tag them.
Reply With Quote
  #12  
Old 04-10-2008, 05:05 PM
Rufus Rufus is offline
Registered User
Join Date: Jun 2004
Location: United Kingdom
Posts: 4,698
Rufus has much to be proud ofRufus has much to be proud ofRufus has much to be proud ofRufus has much to be proud ofRufus has much to be proud ofRufus has much to be proud of
You know, PM windows could be so much better. Going a little off topic, but I think PM's would be much better if they used something like BB Code along side a WYSIWYG or standard editor. The current features are pretty hidden, and not everyone knows you can embed images, but why? There probably should be a smileys menu instead of relying on going to the forums, and there should be a list of features somewhere.

Hmm.. heres a quick example mockup..
Attached Thumbnails
Click image for larger version Name: pm_interface.gif Views: 1881 Size: 64.8 KB ID: 44350  
__________________
Quote:
Originally Posted by Loriel View Post
Seriously, you have ****-all for content and you're not exactly pulling in new developer talent, angling for prestigious titles should be your last concern.
Reply With Quote
  #13  
Old 04-10-2008, 05:07 PM
Dan Dan is offline
Daniel
Join Date: Oct 2007
Posts: 383
Dan is an unknown quantity at this point
Send a message via MSN to Dan
Nice
__________________
Reply With Quote
  #14  
Old 04-10-2008, 05:50 PM
Tigairius Tigairius is offline
The Cat
Tigairius's Avatar
Join Date: Jan 2007
Location: Missouri, USA
Posts: 4,240
Tigairius has a brilliant futureTigairius has a brilliant futureTigairius has a brilliant futureTigairius has a brilliant futureTigairius has a brilliant futureTigairius has a brilliant futureTigairius has a brilliant futureTigairius has a brilliant future
Quote:
Originally Posted by Twinny View Post
Anyhoo, perhaps just filter out remote files > 2mb (screw BMPs) and to .jpg, .gif and .png.
I agree.
Quote:
Originally Posted by Rufus View Post
Hmm.. heres a quick example mockup..
I think the PM windows should look something like this.
__________________


“Shoot for the moon. Even if you miss, you'll land among the stars.”
Reply With Quote
  #15  
Old 04-10-2008, 05:50 PM
Admins Admins is offline
Graal Administration
Join Date: Jan 2000
Location: Admins
Posts: 11,693
Admins has much to be proud ofAdmins has much to be proud ofAdmins has much to be proud ofAdmins has much to be proud ofAdmins has much to be proud ofAdmins has much to be proud of
Would be interesting if someone could script that, may be for the start add some "<b>" tags and similar.

For filtering it will allow the npcserver to send any tags, but filter the PMs of players to not allow urls, only local server files.
Reply With Quote
Reply
Page 1 of 3 1 23

« Previous Thread | Next Thread »
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes Rate This Thread
Linear Mode Linear Mode
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT +2. The time now is 01:42 AM.

Contact Us - Graal - Archive - Privacy Statement - Top

Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2025, vBulletin Solutions Inc.
Copyright (C) 1998-2019 Toonslab All Rights Reserved.