Byond members

ID:133959
 
Aug 30 2007, 8:15 pm
THe owners of the game should get extra options in hub like allowing javascript or flash !!

i personally don't use a member page alot but extra stuff in hub will promote alot more buy from my view !
Aug 30 2007, 8:50 pm
Javascript and Flash were disabled because they pose a security threat, they can both be used to steal login cookies from users.
Aug 31 2007, 12:34 am
In response to Nadrew
Nadrew wrote:
Javascript and Flash were disabled because they pose a security threat, they can both be used to steal login cookies from users.

Would it be possible to disable the functions in Javascript that could do that and just allow safe functions? Say, disable your security threat functions and your redirect functions and give access to Javascript. Because, that'd be pretty hot.

As for flash, pfft, that'd just bug the crap out of me. But if Javascript has a fighting chance, I'll fight for it. =P
Aug 31 2007, 4:51 am
In response to Tiberath
Tiberath wrote:
Nadrew wrote:
Javascript and Flash were disabled because they pose a security threat, they can both be used to steal login cookies from users.

Would it be possible to disable the functions in Javascript that could do that and just allow safe functions? Say, disable your security threat functions and your redirect functions and give access to Javascript. Because, that'd be pretty hot.

Nope. That would require parsing far more sophisticated than anything we've got, and it'd be a brittle solution as JavaScript changes all the time.

Lummox JR
Aug 31 2007, 4:57 am
In response to Lummox JR
Lummox JR wrote:
Nope. That would require parsing far more sophisticated than anything we've got, and it'd be a brittle solution as JavaScript changes all the time.

Lummox JR

Nuts.

Well, there is always PHP image files to make minor cool things (like the IP box on my blog).

But with that, Javascript might change, but the function names for cookie security wouldn't change that often (or at all?) would they?
Aug 31 2007, 5:01 am
In response to Tiberath
Tiberath wrote:
But with that, Javascript might change, but the function names for cookie security wouldn't change that often (or at all?) would they?

Exploits are such that there's no predicting their behavior or which ones will pop up. We decided it wasn't worth the risk of letting users publish their own JavaScript there.

Lummox JR