New ILX Code

Message Bookmarked

Bookmark Removed

Some of you may be interested in the new ILX code that I've put together. It's hosted here, so feel free to have a look around; constructive suggestions welcome, bearing in mind I've only limited time in which to sort things out. Still more to do, but it's a start. If anyone notices any problems, please let me know. If anyone's interested, then offers of help also welcome, though I still need to work out best approach; people have suggested that process isn't perhaps the best, the way things are currently done. Maybe we can do better.

Main directory for browsing is here:

http://conversationboard.googlecode.com/svn/trunk/ILX/

But most of the action takes place in here:

http://conversationboard.googlecode.com/svn/trunk/ILX/WEB-INF/src/com/conversationboard/

If you want a copy of the code, then you'll need to use Subversion to check it out... This can be done this way, using command line Subversion.

svn checkout http://conversationboard.googlecode.com/svn/trunk/ conversationboard

― KeefW (kmw), Monday, 20 November 2006 19:23 (nineteen years ago)

http://upload.wikimedia.org/wikipedia/en/b/bc/BibleCode.png

― anticon jemima (ooo), Monday, 20 November 2006 19:28 (nineteen years ago)

*looks over html filter with fine tooth comb, remaining silent*

― roc u like a § (ex machina), Monday, 20 November 2006 19:30 (nineteen years ago)

http://sydlexia.com/imagesandstuff/cleaning2/basictraining1.png http://sydlexia.com/imagesandstuff/cleaning2/basictraining2.png

― roc u like a § (ex machina), Monday, 20 November 2006 19:31 (nineteen years ago)

CSS is shitty hipster band

― songs and ballads of the bituminous miners (sanskrit), Monday, 20 November 2006 20:30 (nineteen years ago)

are we goin all bboard syntax then?

― Britain's Obtusest Shepherd (Alan), Monday, 20 November 2006 21:18 (nineteen years ago)

Wait, we're going to BBCode? That may be the one thing that may get me to quilt ilx!

― roc u like a § (ex machina), Monday, 20 November 2006 21:22 (nineteen years ago)

What's bboard syntax?

― KeefW (kmw), Monday, 20 November 2006 21:23 (nineteen years ago)

"font-family: verdana, sans-serif;"

NO WAI

― Curt1s St3ph3ns, Monday, 20 November 2006 21:23 (nineteen years ago)

ha. psyche! is that yr idea of remaining silent? x-post

― Britain's Obtusest Shepherd (Alan), Monday, 20 November 2006 21:23 (nineteen years ago)

but it's this http://en.wikipedia.org/wiki/BBCode

― Britain's Obtusest Shepherd (Alan), Monday, 20 November 2006 21:25 (nineteen years ago)

"previously, many message boards allowed the users to include HTML, which could be used to break/imitate parts of the layout, or run JavaScript"

NO SHIT!

― Britain's Obtusest Shepherd (Alan), Monday, 20 November 2006 21:27 (nineteen years ago)

Oh weird... Yes it is like that. Though, I've never seen that before! There was me thinking I'd just made it up. Clearly, the most watertight way of stopping people screwing with HTML is to prevent people using it. So I (thought I) invented something simple that lets people do the basic things. Looks like someone's done it before me. That in itself doesn't surprise me, but the syntax is extremely similar, right enough.

http://conversationboard.googlecode.com/svn/trunk/ILX/WEB-INF/src/com/conversationboard/formatter/Formatter.java

― KeefW (kmw), Monday, 20 November 2006 21:28 (nineteen years ago)

"font-family: verdana, sans-serif;"

I guess COMIC SANS was too a obvious method for baiting all the whiners to leave?

― roc u like a ï¿½ (ex machina), Monday, 20 November 2006 21:29 (nineteen years ago)

Jon, I'd hate to see you stop using it on that basis... I thought you were keen on stopping people being able to screw with it using HTML?

― KeefW (kmw), Monday, 20 November 2006 21:29 (nineteen years ago)

yeah i see proto-bbcode stuff in Formatter.java. FWIW i think it's a fine way to go.

― Britain's Obtusest Shepherd (Alan), Monday, 20 November 2006 21:29 (nineteen years ago)

It is a fucking travesty that because someone is too stupid to even borrow a proper html filter, they have to reinvent fucking bbcode.

― roc u like a § (ex machina), Monday, 20 November 2006 21:29 (nineteen years ago)

Err that was rude, sorry

― roc u like a § (ex machina), Monday, 20 November 2006 21:30 (nineteen years ago)

and BTW, great stuff in general, keef. i'm keen to see this working. my investment in the original mess made me a little disappointed about the ground up rewrite idea. for like 3 minutes :-)

― Britain's Obtusest Shepherd (Alan), Monday, 20 November 2006 21:33 (nineteen years ago)

maybe he could borrow a proper html filter from you, encyclopedia brown!

― DOCTOR METH KING (TOMBOT), Monday, 20 November 2006 21:34 (nineteen years ago)

I like markdown better than bbcode:

http://www.michelf.com/projects/php-markdown/

― roc u like a § (ex machina), Monday, 20 November 2006 21:35 (nineteen years ago)

Results 1 - 10 of about 1,930,000 for "html filter". (0.14 seconds)

― roc u like a § (ex machina), Monday, 20 November 2006 21:35 (nineteen years ago)

Results 1 - 10 of about 147,000 for bbcode sucks. (0.28 seconds)

― roc u like a § (ex machina), Monday, 20 November 2006 21:36 (nineteen years ago)

Thanks, Alan... Err, sorry about that, but I'd appreciate help with this one assuming it all goes ahead etc.

Jon, I took a look at some HTML filters. They were all poor. Partly because (I suspect) browsers' implementation of HTML is so messed up because people have spent years writing bad HTML. If it were all XHTML then it might've been a bit easier, but everything I looked at tries to cope with what's out there at present (and fails accordingly).

On thinking about it, in my opinion, it seemed unrealistic to try and deal with the vast range of possibilities that exist in screwing with HTML, when there are only about five or six sensible things people want to do with it.

― KeefW (kmw), Monday, 20 November 2006 21:37 (nineteen years ago)

Oh no, bbcode. The keystrokes to make angle brackets are so ingrained in me, it's going to be tough to switch to square ones.

Isn't Jon the only person who ever screwed with HTML, anyway? And when was the last time he did it?

― jaymc (jaymc), Monday, 20 November 2006 21:38 (nineteen years ago)

http://www.owasp.org/index.php/Category:OWASP_Validation_Project

PERMISSION BY EXCEPTION.

― DOCTOR METH KING (TOMBOT), Monday, 20 November 2006 21:39 (nineteen years ago)

more importantly, CAN WE STILL SCREW WITH HTML ON THE NOSE BORED

― Curt1s St3ph3ns, Monday, 20 November 2006 21:39 (nineteen years ago)

jaymc, I think you forgot nested a td tag wrong. You should know all this

― roc u like a § (ex machina), Monday, 20 November 2006 21:40 (nineteen years ago)

sensible

― cousin larry bundgee (bundgee), Monday, 20 November 2006 21:40 (nineteen years ago)

there are only about five or six sensible things people want to do with it.

ding! if not italics, strikethru, bold, image, blockquote or href, BUCKET.

― DOCTOR METH KING (TOMBOT), Monday, 20 November 2006 21:41 (nineteen years ago)

Ding ding!

― roc u like a § (ex machina), Monday, 20 November 2006 21:41 (nineteen years ago)

hey, keef, you've nothing to say sorry for. i support your efforts in this, and i'll chip in if i can. i'm a total amateur FWIW.

― Britain's Obtusest Shepherd (Alan), Monday, 20 November 2006 21:41 (nineteen years ago)

Wordpress's html filter's config is really nice for what it needs to do:


$allowedtags = array ('a' => array ('href' => array (), 'title' => array ()), 'abbr' => array ('title' => array ()), 'acronym' => array ('title' => array ()), 'b' => array (), 'blockquote' => array ('cite' => array ()),
                        'br' => array(),
        'code' => array (),
                //      'del' => array('datetime' => array()),
                //      'dd' => array(),
                //      'dl' => array(),
                //      'dt' => array(),
        'em' => array (), 'i' => array (),
        'img' => array ('alt' => array (), 'src' => array () ),
                //      'ins' => array('datetime' => array(), 'cite' => array()),
                        'li' => array(),
                        'ol' => array(),
                        'p' => array(),
                //      'q' => array(),
        'strike' => array (), 'strong' => array (),
                        'sub' => array(),
                        'sup' => array(),
                        'u' => array(),
                        'ul' => array(),
        );

That's the one for my blog comments

― roc u like a § (ex machina), Monday, 20 November 2006 21:42 (nineteen years ago)

at any rate yeah haw haws @ jon immediately coming on this thread and complaining about html filters which was never a problem until... jon

― DOCTOR METH KING (TOMBOT), Monday, 20 November 2006 21:43 (nineteen years ago)

Notice that I don't allow <PRE> so people can't break formatting ;)

― roc u like a § (ex machina), Monday, 20 November 2006 21:44 (nineteen years ago)

and haw haws @ me for xposting the first time he ever actually attempts to help out by dissing his ass

― DOCTOR METH KING (TOMBOT), Monday, 20 November 2006 21:44 (nineteen years ago)

Isn't Jon the only person who ever screwed with HTML, anyway? And when was the last time he did it?

There are a number of quite significant security issues related to the use of HTML. Fortunately, we have not seen abuse of that kind before. This doesn't mean we shouldn't act to prevent it occuring in the future.

― Andrew (enneff), Monday, 20 November 2006 21:44 (nineteen years ago)

jaymc, I think you forgot nested a td tag wrong. You should know all this

I don't know what this means. All I know is that I like HTML better than BBCode.

― jaymc (jaymc), Monday, 20 November 2006 21:44 (nineteen years ago)

http://i16.photobucket.com/albums/b33/terv025/colin.gif

― roc u like a § (ex machina), Monday, 20 November 2006 21:44 (nineteen years ago)

Oh and in terms of fighting images that break the board with width and stuff, I think

img { max-width: 100% !important; }

works....

― roc u like a § (ex machina), Monday, 20 November 2006 21:45 (nineteen years ago)

Except for people using Netscape 4

― roc u like a § (ex machina), Monday, 20 November 2006 21:46 (nineteen years ago)

Markdown got put on another board I'm on, everyone hated it. I liked the idea, but it's a pain to (remember)[which] way round the links go, whereas square brackets allows you to think in HTML, at least.

― stet (stet), Monday, 20 November 2006 22:42 (nineteen years ago)

markdown sucks.

would it be hard to limit html to like six tags, and disable all css and javascript from form data? maybe it could be even easier than this substitution system. i don't really know, just thinkin aloud.

keef you obviously rule for all the work you've already put into this.

― Euai Kapaui (tracerhand), Monday, 20 November 2006 23:27 (nineteen years ago)

would it be hard to limit html to like six tags, and disable all css and javascript from form data?

Yes, it's generally much easier said than done: http://ha.ckers.org/xss.html

― Andrew (enneff), Monday, 20 November 2006 23:36 (nineteen years ago)

damn Andrew, nice link.

― DOCTOR METH KING (TOMBOT), Monday, 20 November 2006 23:43 (nineteen years ago)

Yeah, very useful if you develop web apps!

― Andrew (enneff), Tuesday, 21 November 2006 00:04 (nineteen years ago)

Also, I've not said it publicly yet, so: Keith, your code is mighty fine. Excellent work. ILX would be facing a sorry situation without your generosity!

― Andrew (enneff), Tuesday, 21 November 2006 00:07 (nineteen years ago)

whoa i never thought of some of those methods!

IMHO, this makes the case for using a library/framework to validate user input. Trying to cover every fucking method using homebrew code sucks

― roc u like a § (ex machina), Tuesday, 21 November 2006 00:21 (nineteen years ago)

Send Us Your Programs

― kingfish prætor (kingfish 2.0), Tuesday, 21 November 2006 00:33 (nineteen years ago)

dudes today I got to take a look at some of the most obfuscated, jacked up, chopped-to-pieces "user input" ever on some malcode that we picked up with BRO. Timely!

― DOCTOR METH KING (TOMBOT), Tuesday, 21 November 2006 15:55 (nineteen years ago)

Skipping 10 messages at this point... Click here if you want to load them all.

What yr describing is an appallingly common vulnverability, though.

― stet (stet), Tuesday, 21 November 2006 22:51 (nineteen years ago)

I hope you're not going to allow get method posts!!! IMHO putting the session key in the html source of a page (as a hidden form field) is BAD and cookies are GOOD

.... right right?

― roc u like a § (ex machina), Tuesday, 21 November 2006 22:55 (nineteen years ago)

Oh no, I think it'd have to be a bit more subtle than that. Only an existing admin can make an admin. You won't be able to GET or POST to *any* admin pages/servlets unless you're logged in, your session is authorized and you're appropriately defined in the roles table.

See the SecurityConstraint nodes in http://conversationboard.googlecode.com/svn/trunk/ILX/WEB-INF/web.xml

So you need to already be authenticated and authorised as an admin to make another one and authentication is done via your browser's session, which won't be passed to your geocities page.

xxx-post etc.

― KeefW (kmw), Tuesday, 21 November 2006 22:55 (nineteen years ago)

And no. No-one will see session IDs.

― KeefW (kmw), Tuesday, 21 November 2006 22:56 (nineteen years ago)

Actually, whatever session method you do use, I wager that requiring a valid session to post (even logged out) would cut down on a lot of spambots

now in response to xposts:
Only an existing admin can make an admin. You won't be able to GET or POST to *any* admin pages/servlets unless you're logged in, your session is authorized and you're appropriately defined in the roles table.

Right, what I'm describing is tricking an admin into going to a page that attempts to post to the backend, but referer checking or putting a session type mechanism in every http post would defeat that.

now xposting again:

well you need to check referers

― roc u like a § (ex machina), Tuesday, 21 November 2006 22:58 (nineteen years ago)

The session stuff is already all there. To post, you need to be authenticated and have a valid session (the latter follws on from the former).

― KeefW (kmw), Tuesday, 21 November 2006 23:01 (nineteen years ago)

WE'LL SEE

― roc u like a § (ex machina), Tuesday, 21 November 2006 23:02 (nineteen years ago)

I'm sure!

― KeefW (kmw), Tuesday, 21 November 2006 23:09 (nineteen years ago)

I think he means preventing this kind of attack:

http://p3r.net/junk/ilx.php (link amended to a script that now suffixes the post with a timestamp to avoid the duplicate message error)

― Andrew (enneff), Tuesday, 21 November 2006 23:58 (nineteen years ago)

Forcing admins to re-enter their password whenever performing admin tasks is a good way of preventing this kind of thing.

― Andrew (enneff), Wednesday, 22 November 2006 00:02 (nineteen years ago)

Another approach is generating one-time "form keys" that are associated to a particular user and activity and stored in memory. If the appropriate form key isn't posted along with the form data, the request is rejected. This is the only true way of closing this hole, and it's not terribly difficult to implement.

― Andrew (enneff), Wednesday, 22 November 2006 00:25 (nineteen years ago)

This is all done... This is the session cookie, which is invisibly passed between client and server and authenticated/authorised by the server to ensure you're doing what you're authorised to do.

― KeefW (kmw), Wednesday, 22 November 2006 00:38 (nineteen years ago)

'invisibly' in as much as we're not going over HTTPS

― KeefW (kmw), Wednesday, 22 November 2006 00:38 (nineteen years ago)

Who did the comedy hobotraveler.com signup?

― stet (stet), Wednesday, 22 November 2006 00:43 (nineteen years ago)

I was wondering about that.

― Ned Raggett (Ned), Wednesday, 22 November 2006 00:44 (nineteen years ago)

Ha, I got one of those as well. I just figured it was n*** s***k.

― Pashmina (Pashmina), Wednesday, 22 November 2006 12:41 (nineteen years ago)

i liked the old search page better.

― don weiner (don weiner), Wednesday, 22 November 2006 15:15 (nineteen years ago)

Notice how the poxy fule has virtually disappeared with it, though.

― stet (stet), Wednesday, 22 November 2006 15:42 (nineteen years ago)

Andrew otm

― roc u like a § (ex machina), Wednesday, 22 November 2006 17:03 (nineteen years ago)

one year passes...

Results 1 - 10 of about 1,930,000 for "html filter". (0.14 seconds)
― roc u like a § (ex machina), Monday, November 20, 2006 9:35 PM (1 year ago) Bookmark

― JW, Thursday, 13 November 2008 04:05 (seventeen years ago)

four years pass...

is things buggering up for everyone else?

can't post from my phone, it sends me from chrome to the generic browser and fails to load.

also SNA not refreshing, etc

― Dr Peter Who? (darraghmac), Wednesday, 7 August 2013 11:22 (twelve years ago)

What phone? What you mean not refreshing? It's being cached? You using www or not-www all the way through?

― stet, Wednesday, 7 August 2013 13:58 (twelve years ago)

its a htc, using android-standard chrome i'd imagine.

re-not refreshing, eg post to a thread and when refreshing SNA yr post doens't show up and the thread still has the last person's post/time as last entry, and the bullet-point indicator is hollow.

i do not understand anything after that in your post ?O-o?

― Dr Peter Who? (darraghmac), Wednesday, 7 August 2013 14:07 (twelve years ago)

Is your post actually being made, if you check on a desktop? I am wondering if your phone is cacheing (keeping a copy) of the Site New Answers page and just showing you that, rather than reloading it from the server with the changes.

The www/non-www bit is if you flip between www.ilxor.com and ilxor.com (perhaps by following a link someone posted to a thread) you can find yourself logged out, which causes weirdness.

― stet, Wednesday, 7 August 2013 16:05 (twelve years ago)

it's possible that the work pc is cacheing alright

re phone, i dont think so? and no i don't think i went through ilxor.com at all during the troubles

― Dr Peter Who? (darraghmac), Wednesday, 7 August 2013 16:10 (twelve years ago)

now im getting ads at the top of some threads idk

― Dr Peter Who? (darraghmac), Wednesday, 7 August 2013 16:15 (twelve years ago)

is it me stet

just tell me straight i can take it

― Dr Peter Who? (darraghmac), Wednesday, 7 August 2013 16:15 (twelve years ago)

getting ads implies you are logged out

― koogs, Wednesday, 7 August 2013 16:23 (twelve years ago)

ikr, yet i post

― Dr Peter Who? (darraghmac), Wednesday, 7 August 2013 16:37 (twelve years ago)

if you post when you're logged out it just plain won't work. This sounds deeply weird. Not to say it's not server-side, but I haven't heard anything like it from anyone else yet

― stet, Wednesday, 7 August 2013 17:04 (twelve years ago)

(Actually, that's not true about it not working -- it will attempt to work if you've saved your username/password, and sometimes does)

― stet, Wednesday, 7 August 2013 17:05 (twelve years ago)

in and about the place now from home without any issues, must just be the work browser acting up at the same time as the phone browser needing updating

― Dr Peter Who? (darraghmac), Wednesday, 7 August 2013 21:05 (twelve years ago)

scratch that ive got ads on laptop

― Dr Peter Who? (darraghmac), Wednesday, 7 August 2013 23:25 (twelve years ago)

five years pass...

Didn't know if there was somewhere more appropriate to pose this question/request/general inquiry

Would there be any support for the addition of a Pronoun field to users' Profile pages? just thought it might be a nice option for people to have assuming it's relatively easy to add (no idea if it is or not)

― wayne trotsky (Simon H.), Thursday, 15 November 2018 02:42 (seven years ago)

The main feature request thread is called “ideas for ILX”

― I have measured out my life in coffee shop loyalty cards (silby), Thursday, 15 November 2018 02:49 (seven years ago)

lmao I tried "requests" and "new" and some other shit but not "ideas." thx

― wayne trotsky (Simon H.), Thursday, 15 November 2018 02:50 (seven years ago)

Ideas for ILX

― I have measured out my life in coffee shop loyalty cards (silby), Thursday, 15 November 2018 02:50 (seven years ago)

I'd rather not formally capture PII; those who want to share pronouns can use their profile text to do so already (example in mine)

― stet, Thursday, 15 November 2018 11:38 (seven years ago)

Ahh, good idea.

― wayne trotsky (Simon H.), Thursday, 15 November 2018 13:38 (seven years ago)

also literally no-one is ever going to check a user's profile before posting to see if they have expressed a preference for pronouns, or changed their preference. (source: ppl still address me as a typographical joke from the dawn of new ILX code)

― Bing The Mighty Seat (sic), Thursday, 15 November 2018 18:37 (seven years ago)

you mean to say your username was nothing but a (sic) joke?!

― A is for (Aimless), Thursday, 15 November 2018 18:40 (seven years ago)

you're required to change your legal name to your display name after a certain number of years

― mh, Thursday, 15 November 2018 18:41 (seven years ago)

like the characters from the movie hackers

― F# A# (∞), Thursday, 15 November 2018 18:42 (seven years ago)

ppl actually call me 4cid 8urn irl

― F# A# (∞), Thursday, 15 November 2018 18:44 (seven years ago)

See, this explains so much about why I keep finding my packages in the trash.

― My mother set great store by that microwave oven! (Old Lunch), Thursday, 15 November 2018 19:19 (seven years ago)

you're required to change your legal name to your display name after a certain number of years

meh

― Bing The Mighty Seat (sic), Thursday, 15 November 2018 19:37 (seven years ago)

em haitch

― mh, Thursday, 15 November 2018 19:44 (seven years ago)

neither of them post much anymore

― Bing The Mighty Seat (sic), Thursday, 15 November 2018 19:45 (seven years ago)

it stands for "my hiatus"

― mh, Thursday, 15 November 2018 19:47 (seven years ago)

People probably call me stoop crone already so what I care

― Stoop Crone (Trayce), Thursday, 15 November 2018 22:16 (seven years ago)

You must be logged in to post. Please either login here, or if you are not registered, you may register here.