Snitz Forums 2000
Snitz Forums 2000
Home | Profile | Register | Active Topics | Members | Search | FAQ
Username:
Password:
Save Password
Forgot your Password?

 All Forums
 Help Groups for Snitz Forums 2000 Users
 Help: MOD Implementation
 Security hole for Private Messages Mod
 New Topic  Topic Locked
 Printer Friendly
Author Previous Topic Topic Next Topic  

SiSL
Average Member

Turkey
671 Posts

Posted - 25 September 2005 :  12:48:31  Show Profile  Visit SiSL's Homepage
Since you can type many names, side to side on 'Send to' box, you can as well override limit of PM's per person...

For example, SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL,SiSL

will kinda override (eg.10) pm limit and can also cause mayhem in users pm's or your database sending thousands of messages to single person.

First Sento box is limited with maxlength property. However that does not stop 'problem users' to override code as well.

Best solution will be in codes, checking duplicate entries recreating another sendto list:

Here is code

Find below line in privatesend_info.asp:

			'############## End PM all members ###################
			arrNames = split(Request.Form("sendto"), ",")
			'############### PM all members one line ###################



Just Type following below this line before 'end if':

			' ############# CHECK SAME MEMBER FOR SECURITY #################
		
			NewCleanNameList = ""
			for i=0 to ubound(arrNames)
		 		if InStr((lcase(NewCleanNameList)& ","),(lcase(trim(arrNames(i)))&",")) Then
		 				' DoNothing
		 		Else
		 			if NewCleanNameList <> "" Then 
		 					NewCleanNameList = NewCleanNameList & ","
		 			End If
		 			
		 		  NewCleanNameList = NewCleanNameList & trim(arrNames(i)) 
		 		End If
			next
		
			set arrNames = nothing
			arrNames = split(NewCleanNameList, ",")
			' #################################################


Hope it helps..


CHIP Online Forum

My Mods
Select All Code | Fix a vulnerability for your private messages | Avatar Categories W/ Avatar Gallery Mod | Complaint Manager
Admin Level Revisited | Merge Forums | No More Nested Quotes Mod

Edited by - SiSL on 25 September 2005 13:46:32

ruirib
Snitz Forums Admin

Portugal
26364 Posts

Posted - 25 September 2005 :  12:56:44  Show Profile  Send ruirib a Yahoo! Message
Have you actually tried doing that?


Snitz 3.4 Readme | Like the support? Support Snitz too
Go to Top of Page

SiSL
Average Member

Turkey
671 Posts

Posted - 25 September 2005 :  12:57:33  Show Profile  Visit SiSL's Homepage
Reached to 195 message over 50 message limit with "," ofcourse. Simply need a check code over array.

CHIP Online Forum

My Mods
Select All Code | Fix a vulnerability for your private messages | Avatar Categories W/ Avatar Gallery Mod | Complaint Manager
Admin Level Revisited | Merge Forums | No More Nested Quotes Mod

Edited by - SiSL on 25 September 2005 12:58:24
Go to Top of Page

ruirib
Snitz Forums Admin

Portugal
26364 Posts

Posted - 25 September 2005 :  12:58:23  Show Profile  Send ruirib a Yahoo! Message
Were they sent, or did it fail?


Snitz 3.4 Readme | Like the support? Support Snitz too
Go to Top of Page

SiSL
Average Member

Turkey
671 Posts

Posted - 25 September 2005 :  12:58:58  Show Profile  Visit SiSL's Homepage
All sent, you can try as well, try sending yourself ;)

CHIP Online Forum

My Mods
Select All Code | Fix a vulnerability for your private messages | Avatar Categories W/ Avatar Gallery Mod | Complaint Manager
Admin Level Revisited | Merge Forums | No More Nested Quotes Mod
Go to Top of Page

ruirib
Snitz Forums Admin

Portugal
26364 Posts

Posted - 25 September 2005 :  13:03:28  Show Profile  Send ruirib a Yahoo! Message
I understand your concern, but we never had such a situation being reported.


Snitz 3.4 Readme | Like the support? Support Snitz too
Go to Top of Page

SiSL
Average Member

Turkey
671 Posts

Posted - 25 September 2005 :  13:15:30  Show Profile  Visit SiSL's Homepage
Yes, I found it after asking my users to fill their PM boxes with messages to test PM pages performance. Still does not hurt to make a self-check code cleaning names from duplicates.

CHIP Online Forum

My Mods
Select All Code | Fix a vulnerability for your private messages | Avatar Categories W/ Avatar Gallery Mod | Complaint Manager
Admin Level Revisited | Merge Forums | No More Nested Quotes Mod

Edited by - SiSL on 25 September 2005 13:16:02
Go to Top of Page

SiSL
Average Member

Turkey
671 Posts

Posted - 25 September 2005 :  13:40:06  Show Profile  Visit SiSL's Homepage
Added code finally.

Best to take caution before an unwanted thing happen :)

CHIP Online Forum

My Mods
Select All Code | Fix a vulnerability for your private messages | Avatar Categories W/ Avatar Gallery Mod | Complaint Manager
Admin Level Revisited | Merge Forums | No More Nested Quotes Mod
Go to Top of Page

SiSL
Average Member

Turkey
671 Posts

Posted - 25 September 2005 :  15:00:54  Show Profile  Visit SiSL's Homepage
Wondering if I should write entire code again, too much dependency on ADODB recordset and do-loops

CHIP Online Forum

My Mods
Select All Code | Fix a vulnerability for your private messages | Avatar Categories W/ Avatar Gallery Mod | Complaint Manager
Admin Level Revisited | Merge Forums | No More Nested Quotes Mod

Edited by - SiSL on 25 September 2005 15:03:57
Go to Top of Page

Etymon
Advanced Member

United States
2385 Posts

Posted - 29 September 2005 :  22:57:26  Show Profile  Visit Etymon's Homepage
Keep working on it. If one person needs it, perhaps others will too.

Thanks for the update!

Etymon
Go to Top of Page
  Previous Topic Topic Next Topic  
 New Topic  Topic Locked
 Printer Friendly
Jump To:
Snitz Forums 2000 © 2000-2021 Snitz™ Communications Go To Top Of Page
This page was generated in 0.46 seconds. Powered By: Snitz Forums 2000 Version 3.4.07