As many of you know, hidden links can be a significant for threat one's security all throughout the Internet, not limited to just Epicmafia. To combat this threat, have made a greasemonkey script that will detect and alert you of any hidden links on the current page. This script works on every website, including sites that have real-time updates like Skype.
Normal links will be unaffected, links that go to a destination other than what they appear to go to are highlighted in yellow, and any links that will run JavaScript when they're clicked are highlighted in red.
Hovering over the links will also show you the real destination, or in the case of a JavaScript link, the script that will be run when you click on it.
As always, notify me of any issues or exploits you may find in the script.
well, we should test it out foxie. it'd be great help. why don't you craft a fake image, and i'll implement the code right now, see if you can spoof it. i really g2g now
nah you can't, i have some tools that check to make sure it is a proper image now. i just need to turn it on. it costs me though, because i need to make a request for each image
you can't prevent it in the bbcode/markdown itself, because i can simply host a fake image on my server that redirects to epicmafia.com/mod/action/refundgame etc
should i check every bbcode image to make sure it's an image as well? might be costly to the server but w/e. right now i just check for proper extensions, but i suppose that can be faked
correct foxie, i could reroute all the images through a central point in my server and check the destination, but it's more trouble than it's worth atm
He already has a working solution in the lobby banner images. It checks to make sure that the image is a real image. I don't see why he doesn't use it for bbcode as well.
would probably be better if they all use bbcode for consistency but they don't
image redirects can be done either way though, and they're completely unpreventable unless you check for method/csrf/referrer (yes, referrer works because it has to be routed through another domain to redirect back to em)
In "Break The Code" you have the brown then the orange in the bottom row, they both look really similar and it confused me and the person i was playing with earlier a lot.
