HTML Vulnerability

Hey staff or admin I suggest that the HTML Should be deactivated for Security issues.

The problem is that anyone can put a full HTML page in a thread, and it will work.

If you guys are being ignorant watch this.


http://www.fmcodes.com/t577-the-html-vulnerability#3231

Hello,

1st. Moved to suggestion forum
2nd. Well, No one has already posted an html code... We will see

Really HTML is enabled? Oh dear.

I believe script tags are stripped out of the posts, so there are no script issues.
But here are some things that aren't stripped and would cause issues:

Code:


<div style="position:fixed;top:0px;left:0px;background:#000;width:100%;height:10000px;text-align:center;padding-top:100px">HTML issue, tut tut.</div>


OR

Code:

<style>body { display: none }</style>

Or I wonder if Iframes work?
Oh my god they do... so thats the script issue brought back immediately. You should disable HTML... or I'll start demonstrating live, the potential issues.

I notice HTML is still enabled.
This is a big issue that you need to sort. Luckily most browsers have security systems in place to prevent such things, but most still don't.

We'll try to disable it. But we have to change every single tutorial and Information topic.

Mathias wrote:We'll try to disable it. But we have to change every single tutorial and Information topic.

As Mathias said... Our topics works on html: If we uneable it, we are a terrible forum ;(

What a bad idea.



You'll see your last post in this topic is hidden. Its hidden with css within this post. One major flaw. Thats just an example.

very bad idea i think users using some intermediate scripts will risk our view with some great and powerfull scripts

about that i think i have suggestion for this forum on here
It's a teamwork! We need a temwork!
first i think all staff members need to generate all the html to bb codes and the members
so then i-lgforum-chris-dans and other staff members reposting the original BBcode
third
All request from members and topics edit is on some PM so Luky pm shouldn't be inactive
Fourth change all the codes of this forum prefectly with bbcodes
and then all of users must doesn't use html and only staff are able to use it okay?
Great idea? :B): :<3:

Ryan wrote:

ow don't post an iframe dude

This could be a real problem! :/