Does the signature field actually allow HTML?

Post Reply New Topic

When I edit my profile it says "Type your signature with HTML coding"... but when I use HTML it is rendered bare... unprocessed.

I was going to suggest experimenting. But you said it yourself it renders it bare. In that case, well it renders it bare and you answered your own question.

I know there are ways to modify custom rank and screw up WP, but I don't know the specifics. Once I know more about web coding I shall try it lol, although only temporarily just to see if I can

It doesn't allow HTML - the documentation is out of date and probably refers to the original phpBB codebase. Only plain ASCII and emoticons from the basic site set are allowed.

We can also prevent members from setting a custom rank...

Once I know a huge lot more about web coding I wil haxx0r WP, restore my custom rank and self-appoint myself admin

Seriously though, do you mind if I try and reverse changes as soon as I find something? I am just that curious and it would be 10 seconds of disturbance tops. I did try injecting html and javascript but didn't get anywhere (although I only have the most basic knowledge of javascript, anyway)

You're very much not going to like what happens after you do that.

Edit: BTW php, sql, js injeciton aren't going to work. If the app doesn't catch/sanitize it - other things will.

Wait, you mean this site is actually secure, and not a wall about to collapse? In that case, keep it.

Though +1 to the not liking line.

"After I do that"? Does that mean it is actually possible to get away with it even for a little while? Yeah, I figured you'd be the one who would put a stop to such hijinks.

And I was not talking about taking over the site in the second paragraph btw, just about seeing what kind of custom rank modifies the layout of the actual site. And why.

What you're really asking is if it's possible for this site to be hacked. The answer is yeah, it probably is. We've tried very hard to identify and plug security issues, and none of the common attack vectors (injection, xss, etc) are possible - but there's bound to be something we've missed.



I take a "scorched earth" policy toward people who harm my customers' sites. But there has been at least one person who has given themselves admin/mod access to the site, although not maliciously.



I can't speak for Alex or the mods, but from my perspective, and the perspective of my company, I welcome people to test the security of the site/server(s) (or indeed any of our sites and/or servers) and let us know what you find. As long as you don't do anything to cause harm, you will be thanked for your help.