Upgrade to IPB4

[Nintendo]

Sorry, I just want to say that on the mobile site that I'm on now, well, imo the word "PYRA" over thethe image of the Pyra looks horrid. Actually, overall it now looks out of wack and a little cluttered. 

 

[rygD]

I checked this thread before I posted in another, but I guess I took too long to type it up.  From the Pyra Font thread:
 

So check out that sexy new banner image up top.  I didn't see a thread about it, so I figured this was better than creating a new thread.

I like it, but some things seem off.  Giant Pyra logo next to smaller "PYRA" over top of a Pyra.  Next to the even smaller Pandora stuff, which feels a bit better balanced to me, it feels like everything is kinda doing its own thing, and not really working together.  I can understand having the Pyra stuff be bigger than the Pandora stuff.  The logo and name just don't seem to belong together.  Maybe if the "PYRA" was below the logo, or maybe even across it in a different color, and move the Pyra image to the right.  I really shouldn't be criticial, as I haven't tried to make something better, and I have no formal training or education about such things, so what I think looks right would probably look like garbage.

I feel like we have seen that font before, and I kind of like it.  Does anyone else have any thoughts on it?  Is that the official logo font, or whatever you call it?

 

[EvilDragon]

Yes, I need to spend a bit more time with this, was in a hurry

 

[Christoph.Krn]

Well, I can disable external links, but I wouldn't want to do that

No, I think you're not understanding the concept and extent of this potential problem. If the user has highly extensive control over HTML and CSS in post contents, then you can disable link options on this forum all day long, such things would still be possible.

That would be a serious problem. It doesn't matter either whether the text editor allows for direct source editing or not. If it didn't, then attackers would still be able to manipulate the submitted "source" manually. The regular "solution" would be for the server to refuse accepting incongruous user-submitted post content. It may be that the server used to do exactly that, but no longer does because of any of the changes that you've been making.

 

[Alec]

I agree

This could lead to quite a bit of abuse

 

[Christoph.Krn]

What a nice example case for CSS animations.

But seriously, this is now a confirmed severe security issue. Please change... something.

 

[TrashyMG]

trippy

 

[Nintendo]

Bouncy!

 

[fusion_power]

Something's... wrong  here right now... "  I see gigantic bouncing smileys and oversized "staff" signs under the moderators Avatar...
Seriously, if you have these  skills, better put it in improving the general forums design, there is  still  some work to do. ^^"

 

[levi]

I think when Alec upscaled his smiley gif, it seems to have affected a whole other class of gifs on this page.  It's a fun if direct example of the sort of mischeif one can get up to if one can edit the source.

Disabling the edit source button would be a good start.  Wouldn't stop the determined hacker, but until someone can come up with something that would strip all css and anything that's not a specific tag, it's a start.

 

[Christoph.Krn]

There's no such thing as "would be a good start". I cannot stress enough how much this is a severe security issue that requires urgent action.

 

[Neelix]

What I don't get is why they put aside perfectly good solution to all this.  Wasn't that the whole point of BBCode to begin with?  To allow message formatting without problems involved in allowing direct manipulation of the HTML?

-Neelix

 

[comradekingu]

All we need now is a webcounter, a 'under construction' sign, and the blink tag, and we're all set.

 

[Ziz]

For everybody, who doesn't have this nice effect, I made a video:

Try to watch in HD.

 

[FelixNemis]

Lol, this thread

 

[EvilDragon]

Well, I wanted to keep HTML source editing open until v4.1 is released, so you could post more easily (and I didn't think anyone would have used it for hacking until then), but now I'm going to disable it right away.

 

[levi]

What I don't get is why they put aside perfectly good solution to all this.  Wasn't that the whole point of BBCode to begin with?  To allow message formatting without problems involved in allowing direct manipulation of the HTML?

Not really, historically.  BBCode predates CSS and Javascript (actually it may predate the web in general - I think it started on BBSes, hence the name).  It was imagined at the time that we didn't want everyone to have to learn paragraph tags and other HTML weirdness - the same way Wiki format came about on Ward's Wiki.  That it had the side effect of keeping everyone using HTML1.0 stuff and not breaking stylesheets for everyone or embedding JS nasties was a happy accident, but a valuable one I guess.

Personally I still don't think we need BBCode back though.  If the HTML editor didn't break if you quote someone then press backspace twice it'd be fine for me and I would never need to edit the source.  Then you have to think about malicious hackers, and clean any submissions so they can't submit any nasties.  Nobody would then have to learn a dying language like BBCode then, although javascript-less users would have to submit in plain HTML.

 

[Wrath Of Khan]

I cannot seem to log in normally. I can only log in via facebook. 

 

[Neelix]

What I don't get is why they put aside perfectly good solution to all this.  Wasn't that the whole point of BBCode to begin with?  To allow message formatting without problems involved in allowing direct manipulation of the HTML?

Not really, historically.  BBCode predates CSS and Javascript (actually it may predate the web in general - I think it started on BBSes, hence the name).  It was imagined at the time that we didn't want everyone to have to learn paragraph tags and other HTML weirdness - the same way Wiki format came about on Ward's Wiki.  That it had the side effect of keeping everyone using HTML1.0 stuff and not breaking stylesheets for everyone or embedding JS nasties was a happy accident, but a valuable one I guess.

Not sure where you got that idea. According to Wikipedia BBCode was introduced in 1998,  by which time BBS systems were on the decline and were starting to be superseded by web based forum systems. 

And according to BBCode.org:  (which I can't actually link to because this @#$%^ graphical editor is on the fritz again)

BBCode was implemented as method of providing a safer and easier way of allowing posts to be formatted on forums. Before BBCode forums sometimes allowed users to include HTML code in their posts, which had many security issues (i.e. the user could execute javascript code, break the layout of the site and so on). With BBCode being parsed by the forum scripts it is easier to control what the user can do and can not do (allowing or not allowing specific BBCode tags).

 

Personally I still don't think we need BBCode back though.  If the HTML editor didn't break if you quote someone then press backspace twice it'd be fine for me and I would never need to edit the source.  Then you have to think about malicious hackers, and clean any submissions so they can't submit any nasties.  Nobody would then have to learn a dying language like BBCode then, although javascript-less users would have to submit in plain HTML.

I've never found a graphical mark-up editor yet where I didn't find it more efficient to sometimes enter and or manipulate the mark-up code directly.
I've also seen no indication that BBCode is "dying" as it's still used on forums all over the web.


-Neelix

EDIT:  GAHH!  Case in point the editor completely messed up my quote from the BBCode website, incorporating the following text into the quote...  I think I fixed it now but it's hard to tell.
 

 

[Neelix]

I cannot seem to log in normally. I can only log in via facebook. 

Did you have a different username and Display name before?  If so you need to change the username to match your Display name in order to login.   (e.g. I used to log in as talaxian,  now I have to log in as Neelix)

-Neelix