Hello. I'm wondering if someone could make a mod to accept the word 'alert' in the url, because MyBB's new version does more harm than good by blocking this.
Example(if BBC is on):
Test1
<a href="http://alertgames.com">Test</a>
Thanks in advance for a mod or info.
anyone?
I don't understand why is alert not working?
labrocca Wrote:I don't understand why is alert not working?
my forum is currently not working, but i would guess that it is a security feture to block javascrpt
Yes. If you unblock the word alert, you'll have XSS hackers swarming your site....
well, could there at least be a way to make it work with the url BBC? Maybie check fo something else with the 'alert' to tell the difference between a site and something else?
Ok..I read up on XSS..wouldn't it be better to filter <script> or "alert(" from post messages? That's really where the danger lies anyways. I think "alert(" should be filtered and make sure to ignore white space.
Is it possible to do this? (to tell you the truth, I haven't downloaded MyBB yet, I believe I will very soon. I am a member of a couple MyBB boards however)