Author Topic: Please view my forum...  (Read 51430 times)

0 Members and 1 Guest are viewing this topic.

Offline dannylukedTopic starter

  • Enthusiast
  • Posts: 95
  • Gender: Male
    • View Profile
    • dannyluked.co.nr
Please view my forum...
« on: December 22, 2009, 12:51:18 PM »
Hi,
I have recentley made a forum! Please test it, and tell me how it looks on your browser. I'm not too bothered about the code for the moment just functionality, looks and usability.
Test with;
Username: test
passowrd: test

My forum is here: http://dannyluked.comze.com/forum

Please only comment on the forum as I have another thread to comment on the rest of the site...here

Offline corrupshun

  • Enthusiast
  • Posts: 80
    • View Profile
Re: Please view my forum...
« Reply #1 on: December 23, 2009, 09:32:58 AM »
looks like it works well but the only problem i had was the size of the forum, kinda small.
or is that the way you wanted it?
<?php
if(isset($_POST['troll'])) {
echo 'GTFO';
}
?>

Offline dannylukedTopic starter

  • Enthusiast
  • Posts: 95
  • Gender: Male
    • View Profile
    • dannyluked.co.nr
Re: Please view my forum...
« Reply #2 on: December 23, 2009, 10:09:28 AM »
The way I wanted, sortof!
I could have made it wider but I wanted it to be inside the site rather than attached (I wanted to keep the lefta nd right of the site)
Thanks for the comment...

Online Adam

  • Guru
  • Fanatic
  • *
  • Posts: 4,700
  • Gender: Male
    • View Profile
Re: Please view my forum...
« Reply #3 on: December 23, 2009, 10:11:21 AM »
Not keen on the look, too small and basic -- looks like it would be awkward to use on a regular basis. The white pages that appear after you've done something like make a post are really.. unattractive. When you modify a post especially you're left with no link forward, and you have to click the back button twice in order to get back to the topic or even a link to the board index.

Functionality wise it has all the necessities but lacks any of the more "miscellaneous" features such as formatting, attachments, notifications(?), etc, etc. You should also perhaps try to think of something unique you can add to your forum that would grab some attention - depending on what kind project this is for you.

The navigation I found is quite bizarre. The forum link (although active) should still be clickable. People will probably more often than not spot that link hoping to take them back to the board index, before the actual 'board index' breadcrumb or the "Forum" link right below it (which seems odd to extend the menu down for just one link), and get frustrated if it isn't actually a link. I also couldn't find the 'modify profile' section easily. I was expecting it to be somewhere within the forum tab, as it's a forum profile, but instead was hidden away in the members page as a barely noticeable link in the top right.

Not a bad effort though, just needs work.
Ronnie Wood, true or false?

Offline dannylukedTopic starter

  • Enthusiast
  • Posts: 95
  • Gender: Male
    • View Profile
    • dannyluked.co.nr
Re: Please view my forum...
« Reply #4 on: December 23, 2009, 12:54:36 PM »
Thanks for the good 'review'.
I am next goint to be looking at introducing BBcode. This would make the forum a lot better but when looking for info about bbcode I am struggling to find some help!.
I will add another profile button on the forum page right away!
The forum is mainly to practice my PHP but if good enough I may use it if I go into PHP when I'm older! It is ment to be simple so that when implemented on someones site (e.g. client...) they will be able to use it even with basic computer knowledge. If they did want a complicated forum I would just install one!!
I am not 100% keen on the white page messages but I dont like forwarding users straight to a page. I feel it is like someone is controlling you!

Thanks for the comment again!!

Offline dannylukedTopic starter

  • Enthusiast
  • Posts: 95
  • Gender: Male
    • View Profile
    • dannyluked.co.nr
Re: Please view my forum...
« Reply #5 on: January 03, 2010, 01:36:56 PM »
UPDATE: I have now changed the navigation accordingly and I have added formatting. Please continue to review and update me on any thoughts. BBcode is now enabled also

Offline corrupshun

  • Enthusiast
  • Posts: 80
    • View Profile
Re: Please view my forum...
« Reply #6 on: January 04, 2010, 10:23:45 PM »
alright, one thing i should say is that you should not put the ip address in the <input hidden> option, because people could edit this and pretend.. (although i didn't see the code, i just assume)
oh also: the BBcode, looks good, i can't seem to xss it but i can make it looked fucked up (just a little)
http://dannyluked.comze.com/forum/view_topic.php?id=38
edit:

I REALLY fucked it up
Code: [Select]
[img]http://'/><img src='http://dannyluked.comze.com/inc/img/Bottom.png' height='9000' width='9000[/img]put that in it :P
« Last Edit: January 04, 2010, 10:33:31 PM by corrupshun »
<?php
if(isset($_POST['troll'])) {
echo 'GTFO';
}
?>

Offline corrupshun

  • Enthusiast
  • Posts: 80
    • View Profile
Re: Please view my forum...
« Reply #7 on: January 04, 2010, 10:39:26 PM »
sorry for double posting but couldn't find modify anymore..
So yeah i found XSS
Code: [Select]
[img]http://dannyluked.comze.com/inc/img/Bottom.png' border='20' onClick=javascript:alert('XSS') width='200[/img]
« Last Edit: January 04, 2010, 10:40:10 PM by corrupshun »
<?php
if(isset($_POST['troll'])) {
echo 'GTFO';
}
?>

Offline dannylukedTopic starter

  • Enthusiast
  • Posts: 95
  • Gender: Male
    • View Profile
    • dannyluked.co.nr
Re: Please view my forum...
« Reply #8 on: January 05, 2010, 04:27:05 AM »
sorry for double posting but couldn't find modify anymore..
So yeah i found XSS
Code: [Select]
[img]http://dannyluked.comze.com/inc/img/Bottom.png' border='20' onClick=javascript:alert('XSS') width='200[/img]

Hi, Thanks for testing. I was just wondering if you could ellaborat more on the above post! I think I have stopped the onclick functon along with some others!

Online Adam

  • Guru
  • Fanatic
  • *
  • Posts: 4,700
  • Gender: Male
    • View Profile
Re: Please view my forum...
« Reply #9 on: January 05, 2010, 04:34:46 AM »
He means that your BB code parser allows users to 'inject' JavaScript through the 'onclick' attribute (most likely all other event attributes too); you need to filter any XSS attempts like these out.
Ronnie Wood, true or false?

Offline corrupshun

  • Enthusiast
  • Posts: 80
    • View Profile
Re: Please view my forum...
« Reply #10 on: January 05, 2010, 07:33:18 AM »
to add to MrAdam,
if a random visitor was to put that in the post box, they could inject javascript into the code, they could also add more css elements to completely destroy the page.
i would make it so that the user cannot type a ' in the code
also filter onclick, onblur, onload, onunload, onchange, onsubmit, onmouseover, and onmouseout
<?php
if(isset($_POST['troll'])) {
echo 'GTFO';
}
?>

Offline dannylukedTopic starter

  • Enthusiast
  • Posts: 95
  • Gender: Male
    • View Profile
    • dannyluked.co.nr
Re: Please view my forum...
« Reply #11 on: January 05, 2010, 08:23:53 AM »
to add to MrAdam,
if a random visitor was to put that in the post box, they could inject javascript into the code, they could also add more css elements to completely destroy the page.
i would make it so that the user cannot type a ' in the code
also filter onclick, onblur, onload, onunload, onchange, onsubmit, onmouseover, and onmouseout

Thanks for the reply but I cant filter ' because some websites contain the (i think!) Is there anything else I need to filter apart from the ones mentioned?

Offline corrupshun

  • Enthusiast
  • Posts: 80
    • View Profile
Re: Please view my forum...
« Reply #12 on: January 05, 2010, 05:20:00 PM »
websites do not have ' in the url
it's not allowed
<?php
if(isset($_POST['troll'])) {
echo 'GTFO';
}
?>

Online Adam

  • Guru
  • Fanatic
  • *
  • Posts: 4,700
  • Gender: Male
    • View Profile
Re: Please view my forum...
« Reply #13 on: January 05, 2010, 06:33:47 PM »
websites do not have ' in the url
it's not allowed

Technically file names can contain a ', however it's highly unlikely you'll ever come across it.

Is there anything else I need to filter apart from the ones mentioned?

Personally I'd think about the parameters that are allowed, as opposed to which you need to filter out.
Ronnie Wood, true or false?

Offline corrupshun

  • Enthusiast
  • Posts: 80
    • View Profile
Re: Please view my forum...
« Reply #14 on: January 06, 2010, 07:36:19 AM »
Personally I'd think about the parameters that are allowed, as opposed to which you need to filter out.
Exactly.
<?php
if(isset($_POST['troll'])) {
echo 'GTFO';
}
?>