Why can't MyBB use JavaScripts, meta tags, and scripts in user names or user groups?
(2013-01-17, 06:06 AM)Nathan Malcolm Wrote: [ -> ][Issue #1713]
There's still an error message when you try to use it.
Yes, because it's a security risk.
(2013-01-18, 04:53 AM)Nathan Malcolm Wrote: [ -> ]Yes, because it's a security risk.
Will the security risk ever be resolved?
(2013-01-18, 04:58 AM)MYBB GHOST Wrote: [ -> ] (2013-01-18, 04:53 AM)Nathan Malcolm Wrote: [ -> ]Yes, because it's a security risk.
Will the security risk ever be resolved?
It has been. The fact we're disallowing base, meta, and script tags fixes the security issue.
(2013-01-18, 05:02 AM)Nathan Malcolm Wrote: [ -> ] (2013-01-18, 04:58 AM)MYBB GHOST Wrote: [ -> ] (2013-01-18, 04:53 AM)Nathan Malcolm Wrote: [ -> ]Yes, because it's a security risk.
Will the security risk ever be resolved?
It has been. The fact we're disallowing base, meta, and script tags fixes the security issue.
So would that be allowed in 1.8 or 2.0?
No, you don't understand. It's a security risk to allow them, so we don't.
(2013-01-18, 05:48 AM)Nathan Malcolm Wrote: [ -> ]No, you don't understand. It's a security risk to allow them, so we don't.
So it would never be added?
(2013-01-18, 06:09 AM)MYBB GHOST Wrote: [ -> ] (2013-01-18, 05:48 AM)Nathan Malcolm Wrote: [ -> ]No, you don't understand. It's a security risk to allow them, so we don't.
So it would never be added?
No. I can't see why you'd need to use base, meta, or script tags for a usergroup title or username. It's practically saying "Hey, come and hack me.".