|
Welcome,
Guest
|
Link articles to CB Profile
(1 viewing) (1) Guest
|
TOPIC: Link articles to CB Profile
Re:Link articles to CB Profile 2 years, 5 months ago #107715
|
Very good point!
 |
|
|
Re:Link articles to CB Profile 2 years, 5 months ago #107768
|
yvolk wrote:
krileon wrote: lemur wrote: The problem was solved by Yuri Volkov (yvcomment). See: forum.joomla.org/viewtopic.php?f=473&...p;p=1804749#p1804749 Do not do as instructed in the post. This was done for a reason, security. By reverting what Joomla team has done you just open up the vulnerability again. This is not a resolution to the problem, but creates an even bigger problem. Very interesting. What a security risk is to show on HTML page some part of the Article (namely "created_by_alias" property) that was just retrieved from the database (from _our_ database)? One possible scenario that I can think of is that some attacker managed to save this article with some evil "injection" to his "alias"  and so we're fighting with injections stored in our database.In this case I'm sure we should better care about filtering (escaping...) that injection _before_ it is written to the database, and not _after_ it is read from it?! Post edited by: yvolk, at: 2009/08/11 21:08 Very good point indeed. However, as the filtering wasn't done right by joomla earlier, database may have "dangerous" content inside. The correct method would have been to clean the database on upgrade, but joomla's point releases upgrades are just FTP overwrites without database adjustments, like CB does. Maybe a point to raise on joomla's dev group ? |
|
Beat
Community Builder Team Member Before posting on forums: Read FAQ thoroughly CB links: Subscribe to CB documentation - Our templates - Paid Subscriptions - Get Hosting - Our Forge - Incubator Visit my CB Profile - Send me a Private Message (PM) -- help us spend more time coding by helping others in this forum, many thanks |
Re:Link articles to CB Profile 1 year, 11 months ago #125302
|
I should have a solution shortly. This solution allows display and control over the CB avatar, pre and post name text, and allows selection of username or name...
|
|
CB/Joomla golf site: www.thegolfspace.com
Geek/joomla site: www.tkserver.com Check out my Joomla/CB projects: * LIKE thumbs up system for "liking" content items * Karma - CB user rating system * Golf Score Tracker * Jitter - status update system. "What's on your mind?" * CB Author Plug - Shows CB author link and avatar in content items. J1.5 compatible and very customizable! Found on my web site or in the Joomlapolis Directory! |
|