Hey boarders,

My users are getting creative with their profiles. They've been creating their own style sheet and uploading it to a free public server, and then inserting a CSS tag into one of the text fields/areas in their CB profile.

This feature creates two problems:
1. It's cross-site scripting; a severe concern for every web developer. These tags could eventually lead to the exploitation of other users' profiles (eg: changing another user's password/email without them knowing) or the exploitation of the server itself (eg: manipulating the MySQL database).
2. It interferes with the site's atmosphere and brand. The layout for both their profiles and the userlist becomes severely butchered.

These abilities should be a concern of all CB users. So, now we have to ask, what can we do to disable these features/bugs and parse all text?

Thanks everybody.

Post edited by: arobb, at: 2006/06/16 01:39

hi beat

i have added an artefact on the Joomla Forge concerning text that may be offensive (in the connection texts).

(How about the other artefacts i have added ?)