VERY IMPORTANT : GAPING SECURITY HOLE : XSS VULN! about infinity HOT 9 CLOSED

@bui
I only terrorize cute twinks. ;^))))))

from infinity.

i agree

from infinity.

are you a terrorist

from infinity.

cc: @czaks

Hello,

8chan is no longer an open source project in the sense that it was up to April 2016 when I retired. I made a board to see what you are talking about and it is using a route that I don't recognize, edit_board_rules. If I had to make a conservative estimate, I would guess that 8ch.net is over one hundred commits ahead of this repository, perhaps more. Very few commits have been ported from the 8ch.net closed source version to this repository, the only ones are in the public-site branch.

When I made the static pages feature, I imported the rules page as a static page and then disabled the edit rules route. ?/edit_board_rules is not my code, and I don't know what it does, but based on the link you shared it just uses simple concatenation...

This commit enabled "Edit pages": 12fa8ec#diff-4eb9dfb2a18c93c1c47d74c033513d64L668

In pre March 2015 versions of the source code, new rules could be POST'd directly to ?/settings/board.

So, no repositories based on the open source code are affected, and I am closing this bug.

from infinity.

@Getindor Sorry, there's literally nothing I can do, but at least the open source code is not vulnerable.

from infinity.

@ctrlcctrlv
Man, that sucks. Do you have contact info for the guys currently in charge of infinitesimal-chan's codebase? Feel free to email it to me so the nutjobs on github don't use it to troll: [email protected]

from infinity.

@ctrlcctrlv It's all your fault, cuck.

from infinity.

@LandonPowell I showed them this bug report and they seem to have disabled the ?/edit_board_rules mod.php route, but they didn't clean up the XSS you wrote out to /islamicstate/rules.html for some reason. I also did ask why they made the route in the first place and did not get a response.

So, at least this specific issue seems fixed, but how many other bugs there might be in the closed source code is anyone else's guess given how naive the implementation of this rules page was...

from infinity.

@ctrlcctrlv U fucked everything up

from infinity.