Post a message with a leading slash

Message
Author
User avatar
GoManutd
Forum Guide
Forum Guide
Posts: 2952
Joined: Mon Jun 30, 2008 8:06 pm

Re: Post a message with a standalone or leading slash

#11 Postby GoManutd » Sat Jan 01, 2011 6:02 pm

bit scary if you're getting a method not implemented for posting something with a slash...

seems like it's trying to execute some sort of macro.

of course, many web based apps that handle user input will prevent slashes and other evil sql characters, or will require that they be properly escaped to prevent sql injection attacks.

don't see this as an issue, rather a security feature

User avatar
m_pav
Forum Guide
Forum Guide
Posts: 2509
Age: 49
Joined: Sun Aug 06, 2006 3:02 pm

Re: Post a message with a standalone or leading slash

#12 Postby m_pav » Mon Jan 03, 2011 4:38 am

It doesn't accept leading forward slashes when they're wrapped up in code tags either and this forum rejects regular text files too.

Mike P

User avatar
richb
Administrator
Posts: 12978
Joined: Wed Jul 12, 2006 2:17 pm

Re: Post a message with a standalone or leading slash

#13 Postby richb » Mon Jan 03, 2011 5:41 am

m_pav wrote:It doesn't accept leading forward slashes when they're wrapped up in code tags either and this forum rejects regular text files too.

Mike P


/etc/boot

It accepts slashes with code tags. Do you mean text files as attachments?
Forum Rules
Guide - How to Ask for Help

Rich

Laptop: Acer V5-572G: Intel i5, 12 GIG mem, Intel graphics, SanDisk SSD, 256GB
Virtualbox: Win 7
Desktop: MX-15- 64, AMD A8 7600 FM2+ CPU R7 Graphics, fglrx driver, 16 GIG Mem. Samsung EVO SSD 250 GB

User avatar
m_pav
Forum Guide
Forum Guide
Posts: 2509
Age: 49
Joined: Sun Aug 06, 2006 3:02 pm

Re: Post a message with a standalone or leading slash

#14 Postby m_pav » Mon Jan 03, 2011 3:41 pm

Yes to the text files as attachments, it refuses them and actual code tags as in pasted code, not formatting code tags.

Code: Select all

[b]/[/b]etc/X11/xorg.conf


In the above example, the path to xorg.conf is wrapped in code tags, but that brings up the error, so I had to add formatting tags within the code tags for it to work, but the result is sloppy. The issue does not stop with that either. I tried all manner of things like the top left key on a US keyboard, which worked as a carriage return, yet allowed the forward slash
`/etc, so my thoughts are leading towards this forums back end trying to interpret / as bbcode outside of the [] square brackets

The following seems to support my theory, as hijack is not bbcode, yet it is accepted.
[hijack]
What would be nice is to see a list of permitted attachments and size limitations when adding an attachment
[/hijack]

Mike P

User avatar
richb
Administrator
Posts: 12978
Joined: Wed Jul 12, 2006 2:17 pm

Re: Post a message with a standalone or leading slash

#15 Postby richb » Mon Jan 03, 2011 4:09 pm

m_pav wrote:Yes to the text files as attachments, it refuses them and actual code tags as in pasted code, not formatting code tags.

Code: Select all

[b]/[/b]etc/X11/xorg.conf


In the above example, the path to xorg.conf is wrapped in code tags, but that brings up the error, so I had to add formatting tags within the code tags for it to work, but the result is sloppy. The issue does not stop with that either. I tried all manner of things like the top left key on a US keyboard, which worked as a carriage return, yet allowed the forward slash
`/etc, so my thoughts are leading towards this forums back end trying to interpret / as bbcode outside of the [] square brackets

The following seems to support my theory, as hijack is not bbcode, yet it is accepted.
[hijack]
What would be nice is to see a list of permitted attachments and size limitations when adding an attachment
[/hijack]

Mike P

I have enabled text file attachments.
I only wrap the slash with code tags, to make it post, not the whole path. It posts every time for me.

And Karen has a ticket in to fix it on the server. Please be patient.

EDIT: We are looking into adding that info real time, but it may be difficult. In the interim, I have posted the information in the How-To forum.
EDIT2:The How-To will have to do. Implementing file attachment information when adding an attachment is is very difficult for technical reasons. Perhaps in a future version of phpBB it will be added by the developers.
Last edited by richb on Mon Jan 03, 2011 5:40 pm, edited 2 times in total.
Reason: Added EDIT2
Forum Rules
Guide - How to Ask for Help

Rich

Laptop: Acer V5-572G: Intel i5, 12 GIG mem, Intel graphics, SanDisk SSD, 256GB
Virtualbox: Win 7
Desktop: MX-15- 64, AMD A8 7600 FM2+ CPU R7 Graphics, fglrx driver, 16 GIG Mem. Samsung EVO SSD 250 GB

User avatar
wireman
Forum Regular
Forum Regular
Posts: 874
Age: 66
Joined: Thu Aug 17, 2006 7:56 am

Re: Post a message with a standalone or leading slash

#16 Postby wireman » Wed Jan 26, 2011 4:32 pm

Problem is this looks really ugly when trying to quote contents of files within a code block. Anyone know how get code blocks to show leading '/' correctly without have to put something around it...?

e.g. this looks very bad:

Code: Select all

[i]/[/i]etc/fstab

User avatar
richb
Administrator
Posts: 12978
Joined: Wed Jul 12, 2006 2:17 pm

Re: Post a message with a standalone or leading slash

#17 Postby richb » Wed Jan 26, 2011 4:35 pm

wireman wrote:Problem is this looks really ugly when trying to quote contents of files within a code block. Anyone know how get code blocks to show leading '/' correctly without have to put something around it...?

e.g. this looks very bad:

Code: Select all

[i]/[/i]etc/fstab


Currently there is no way that I know of. That is what we are trying to fix with the server people.
Forum Rules
Guide - How to Ask for Help

Rich

Laptop: Acer V5-572G: Intel i5, 12 GIG mem, Intel graphics, SanDisk SSD, 256GB
Virtualbox: Win 7
Desktop: MX-15- 64, AMD A8 7600 FM2+ CPU R7 Graphics, fglrx driver, 16 GIG Mem. Samsung EVO SSD 250 GB

User avatar
wireman
Forum Regular
Forum Regular
Posts: 874
Age: 66
Joined: Thu Aug 17, 2006 7:56 am

Re: Post a message with a standalone or leading slash

#18 Postby wireman » Wed Jan 26, 2011 5:08 pm

Currently there is no way that I know of. That is what we are trying to fix with the server people.


OK. Here's hoping you get a solution.

User avatar
lucky9
Forum Veteran
Forum Veteran
Posts: 12274
Age: 70
Joined: Wed Jul 12, 2006 5:54 am

Re: Post a message with a standalone or leading slash

#19 Postby lucky9 » Wed Jan 26, 2011 6:48 pm

/home/user/ should work also. And I think it looks better.

PS: I got another server error when originally posting this post.
Yes, even I am dishonest. Not in many ways, but in some. Forty-one, I think it is.
--Mark Twain

User avatar
GoManutd
Forum Guide
Forum Guide
Posts: 2952
Joined: Mon Jun 30, 2008 8:06 pm

Re: Post a message with a standalone or leading slash

#20 Postby GoManutd » Wed Jan 26, 2011 7:24 pm

i've found the source of the error. it's a security feature that needs to be tweaked. it is not forum software related.


Return to “Forum How-to's”

Who is online

Users browsing this forum: No registered users and 1 guest