Filter these

[nvrspk4]

Congrats while it lasted, quite ingenious honestly. We will be implementing a simple patch, hopefully tomorrow morning. (Credit to Pyroka)

[Jxhn]

Congrats while it lasted, quite ingenious honestly. We will be implementing a simple patch, hopefully tomorrow morning. (Credit to Pyroka)

Yes, very ingenious. I wonder who started it off.

I'm pretty sure things like these are impossible to patch without adding a security token to each form.

Look up CSRF/XSRF.

[nvrspk4]

Yes, very ingenious. I wonder who started it off.

I'm pretty sure things like these are impossible to patch without adding a security token to each form.

Look up CSRF/XSRF.

I would show you the simple patch however I feel like someone would find a workaround so we'll let them discover it without our help.

[Decode]

I would show you the simple patch however I feel like someone would find a workaround so we'll let them discover it without our help.

Im sure people will find a way arround it anyway

Yes, very ingenious. I wonder who started it off.

I'm pretty sure things like these are impossible to patch without adding a security token to each form.

Look up CSRF/XSRF.

You could simply change the change style form at the bottom of the page to use $_POST then it cannot be changed unless someone submits it.

[Jxhn]

You could simply change the change style form at the bottom of the page to use $_POST then it cannot be changed unless someone submits it.

It is still possible, just harder. I won't explain how.

[Jxhn]

It is still possible, just harder. I won't explain how.

EDIT: It's also possible to do this with Habbox's radio request system (I won't say how). I'm sure 300 of the same request from different people would piss off the DJs, although it might convince them to play some death metal.

EDIT: I pressed quote instead of edit by accident.

EDIT: I was past the edit limit anyway.

[Favourtism]

yes i know smart pants, i was just agreeing

dont give me that

I didnt mean the '-.-' at you, it was directed at the noobs who are doing it.

EDIT: It's also possible to do this with Habbox's radio request system (I won't say how). I'm sure 300 of the same request from different people would piss off the DJs, although it might convince them to play some death metal.

EDIT: I pressed quote instead of edit by accident.

EDIT: I was past the edit limit anyway.

Yup. Me and Mecto were testingo n our forum and you can do that. its also is/was(?) possible to log users out and redirect them.

Glad to see that is has/is being patched

[J0SH]

Can't you just filter the styleid= or something?

[Pyroka]

That's just filtering out one problem, there's many things they could do with the [IMG] tag. It's not limited to just changing styles on a forum so they needed something more generic. Either way, it's done now.

[Decode]

That's just filtering out one problem, there's many things they could do with the [IMG] tag. It's not limited to just changing styles on a forum so they needed something more generic. Either way, it's done now.

What changes have been made, I can still use image tags.