Hacking and the Shoutbox (Help!)

[Hyperguy]

Hi!

My forum was recently hacked.

Well, sort of.

Some posted a script in the Tiny Portal Shoutbox on my forum that basically redirected people to a page saying that the page has been hacked. They put <script> tags in the shoutbox that redirected them to it.


So my question is...

Is there anyway we can set up the shoutbox so that it only supports BBCode?  As it stands it's a liability if people can simple type <script>bad stuff</script> and take advantage of this easily.

My forum's at http://forum.hyperguy.net

[G6Cad]

There have been about 4 diffrent posts about this since yesterday.
Please search and you will find the answers, also a new posted patch to day from Bloc to fix the hacking attempts.

[anunlike]

This has been addressed. Check this topic:

http://www.tinyportal.net/smf/index.php?topic=6229.0

Upload the files attached to Bloc's first post and that should fix it.


Edit: Didn't see your post, G6.

[bloc]

Hyperguy, FYI it wasn't the shouts that could be exploited, it was the name of the poster. The shouts have been strictly BBC code for quite some time.

[Crip]

If [guest shouts] are not enabled, then there is really no problem..yes??

[harzem]

If [guest shouts] are not enabled, then there is really no problem..yes??

No. They can redirect even if you don't allow guests. What I had discovered and tried in the shoutbox here was that, remember?

The new hack should be installed.

[Hyperguy]

This has been addressed. Check this topic:

http://www.tinyportal.net/smf/index.php?topic=6229.0

Upload the files attached to Bloc's first post and that should fix it.


Edit: Didn't see your post, G6.

Okay, thanks.

Hyperguy, FYI it wasn't the shouts that could be exploited, it was the name of the poster. The shouts have been strictly BBC code for quite some time.

Good to know.  Thank you very much, and especially thank you for making Tiny Portal.

If [guest shouts] are not enabled, then there is really no problem..yes??

In this case it was done by a registered member.   You have an avatar from the original Vampire Hunder D anime.  That's pretty gutsy.  What are you, some kind of monster!? D: