[Rant] Forum safety in general.

[Alley]

The forum rollback was pretty bad and didn't only affect the forums. I still remember that day. On the very same day the server died, I was performing a firmware update on a first-gen SSD and it decided it wouldn't work and permanently died. How fun it was (it wasn't) when I got windows installed on my second SSD to find Disco in a vegetative state and my skype completely bombarded. The twitter account saved our ass here, we also had some fun on the temporary IRC despite all. It's true we were lucky I had a backup of the virtual machine, if I didn't I guess the community would be dead by now with everything ever done on the forums gone.

It was a good lesson though, backups of the SQL are regularly made (that's something I guess) and when I can get around buying these two 2tb drives to RAID them I'll start doing regular full backups of the VMs.

Aside of that, the title is maybe a little overdramatic. The flaw was pretty bad, that's true, however the possible damage through it was still limited. At best you could have replaced all images with cats or some other minor page-limited annoyances (or put some code that render the body in display:none lolol). That doesn't forgive it, regex and sanitization are specifically here to prevent these things from being possible and they should be used. I guess it doesn't help when mybb itself doesn't sanitize much when it comes to posts.

We actually did indirectly suffer a real XSS attack once, maybe you remember that hour where every forum page was replaced with that huge you've been hacked text. That wasn't even meant for us, some pretty clever guys wanted to target some political website and as they couldn't get access to it they somehow managed to compromise another website we too were using at the time that proposed a script to detect outdated browsers like IE6 and display a popup to prompt the user to upgrade. They compromised that script and their message ended up on hundreds of websites, including ours. This too was a good lesson, these days we are a bit too used to all these cool next-gen CDN, but what if they get compromised?

I personally don't have time to handle everything and be everywhere, so if you want to take a look at the current mycodes and ensure the regex are all properly written, you're more than welcome.

---

Alley was right.