5 ms·

So, I will change the secret word for now (1-2 hours) to fix some stuff the user mention here (thanks!). And to the one who post the snake game, stop it, I need

So, I will change the secret word for now (1-2 hours) to fix some stuff the user mention here (thanks!). And to the one who post the snake game, stop it, I need to code! ;) After then, the word will be the same as before.

Visurox 4y ago
Filter for username and text is online, thanks to the users! hackernews is the secret word again. :)
- tln 4y ago
  Is it working? I've got my code ready:) <style>#b{--s:12vmin;--w:100vmin;--h:calc(var(--w) / 2);position:relative;width:var(--w);height:var(--w);margin:auto;animation:spin 4s linear infinite;transform-origin:center}@keyframes spin{100%{transform:rotate(360deg)}}#b b{font:var(--s) monospace;height:var(--h);position:absolute;width:var(--s);left:calc(var(--h) - var(--s)/ 2);top:0;transform-origin:bottom center}</style><div id=b><script>for(i in s="because circular reasoning works ",s)b.innerHTML+=`<b style="transform:rotate(${360*i/s.length}deg)">${s[i]}`</script>
  - Visurox 4y ago
    would be work.
kris_wayton 4y ago
Since you can insert arbitrary JS, it feels like you could write a loop that ajax posts a bunch of new webspaces when someone visits a webspace. Might look into protecting againt that.
- Visurox 4y ago
  Just for now. Later after the beta (which is nearly finished) no extern stuff will work, just the basics. But you’re absolutely correct!
- Visurox 4y ago
  src and href are now forbidden tags. should be filter out the most crap.
  - tekni5 4y ago
    The site doesn't seem to work, says "Wrong secret word" for hackernews. Is there a list of pages people have made? So with out src & href you can't have links, seem like a massive limitation. Was trying to a submit a personal site with external links, guess it's no use now.
    - kris_wayton 4y ago
      There's srcset, and things like generating content with JS, inline css base64 images (background: url(data:...), and lots of other loopholes. The author is going to re-live a lockdown path many others have gone through ;)
    - Visurox 4y ago
      The prob is, when you allow clickable links, you cant count the spam sites or with evil code.

Visurox 4y ago

Filter for username and text is online, thanks to the users! hackernews is the secret word again. :)

tln 4y ago
Is it working? I've got my code ready:) <style>#b{--s:12vmin;--w:100vmin;--h:calc(var(--w) / 2);position:relative;width:var(--w);height:var(--w);margin:auto;animation:spin 4s linear infinite;transform-origin:center}@keyframes spin{100%{transform:rotate(360deg)}}#b b{font:var(--s) monospace;height:var(--h);position:absolute;width:var(--s);left:calc(var(--h) - var(--s)/ 2);top:0;transform-origin:bottom center}</style><div id=b><script>for(i in s="because circular reasoning works ",s)b.innerHTML+=`<b style="transform:rotate(${360*i/s.length}deg)">${s[i]}`</script>
- Visurox 4y ago
  would be work.

kris_wayton 4y ago

Since you can insert arbitrary JS, it feels like you could write a loop that ajax posts a bunch of new webspaces when someone visits a webspace. Might look into protecting againt that.

Visurox 4y ago
Just for now. Later after the beta (which is nearly finished) no extern stuff will work, just the basics. But you’re absolutely correct!
Visurox 4y ago
src and href are now forbidden tags. should be filter out the most crap.
- tekni5 4y ago
  The site doesn't seem to work, says "Wrong secret word" for hackernews. Is there a list of pages people have made? So with out src & href you can't have links, seem like a massive limitation. Was trying to a submit a personal site with external links, guess it's no use now.
  - kris_wayton 4y ago
    There's srcset, and things like generating content with JS, inline css base64 images (background: url(data:...), and lots of other loopholes. The author is going to re-live a lockdown path many others have gone through ;)
  - Visurox 4y ago
    The prob is, when you allow clickable links, you cant count the spam sites or with evil code.