FAQ  •  Register  •  Login

sam686 on Current Players

Forum rules
This forum is for technical discussion only. If you are interested in gameplay or client-side issues, please post in Bitfighter Features.
<<

Unknown

User avatar

Posts: 183

Joined: Mon Mar 08, 2010 4:48 pm

Post Mon Nov 15, 2010 8:55 pm

sam686 on Current Players

User Control Panel - 0 new messages - FAQ - Members - Logout [ Unknown ]
Servers Online: 10
Current Players: sam686, Zapgamer!,

That is what the current players list shown above the forums looks like in my browser. WTF? Why only sam686?
<<

sam686

User avatar

Posts: 468

Joined: Fri Oct 15, 2010 8:53 pm

Location: United States, South Dakota

Post Mon Nov 15, 2010 9:11 pm

Re: sam686 on Current Players

I named myself <font size=10>sam686</font> in game.
<<

sam686

User avatar

Posts: 468

Joined: Fri Oct 15, 2010 8:53 pm

Location: United States, South Dakota

Post Mon Nov 15, 2010 9:30 pm

Re: sam686 on Current Players

At first, I had a question why everything inside < > characters gets deleted when displaying current players. Then I found it is doing HTML code in web page. When my name was "<font size=10>sam686</font>", it shows up in the web page as
sam686

And If i named myself as "<font color=0000FF>sam686</font>" my name becomes blue in the web site.
<<

raptor

Posts: 1044

Joined: Mon Oct 11, 2010 9:03 pm

Post Tue Nov 16, 2010 12:00 am

Re: sam686 on Current Players

And for an excellent example of XSS (cross-site scripting) hack, set your username to something like this:
  Code:
<p onclick='alert(\"yo\")'>dbuck

and then click on your name in the list at the top of the forum.

:]

D
<<

watusimoto

Site Admin

Posts: 1558

Joined: Tue Feb 23, 2010 7:07 pm

Location: Quartz's mom's house

Post Tue Nov 16, 2010 12:06 am

Re: sam686 on Current Players

Yeah... so I'd better fix that.
<<

Whittling While

User avatar

Posts: 235

Joined: Wed Apr 07, 2010 10:22 am

Location: Minnesota

Post Tue Nov 16, 2010 2:07 pm

Re: sam686 on Current Players

NO! Don't fix that Wat! That's really neat! It could have potential!
Premier Cloaker
"Time is an illusion; lunchtime, dually so."
<<

watusimoto

Site Admin

Posts: 1558

Joined: Tue Feb 23, 2010 7:07 pm

Location: Quartz's mom's house

Post Tue Nov 16, 2010 3:48 pm

Re: sam686 on Current Players

That's exactly the problem.
<<

sam686

User avatar

Posts: 468

Joined: Fri Oct 15, 2010 8:53 pm

Location: United States, South Dakota

Post Tue Nov 16, 2010 4:23 pm

Re: sam686 on Current Players

To fix, try this javascript code.
  Code:
str1=data.players[i];
str1=str1.replace("&","&amp");
str1=str1.replace("<","&lt;");
The html code will convert it back and display the exact name ( <b> < &#99 ).

I found a new problem, putting a quotation mark ( " ) once in a name will cause the status "server online" and "current players" to completely disappear, but will reappear when the player with a quotation mark leave. It is something to do with trying to read this data at http://bitfighter.org/bitfighterStatus.json
<<

watusimoto

Site Admin

Posts: 1558

Joined: Tue Feb 23, 2010 7:07 pm

Location: Quartz's mom's house

Post Tue Nov 16, 2010 4:32 pm

Re: sam686 on Current Players

If you look at http://bitfighter.org/statusWidget.htm, you'll see that the code is fixed there, and that file gets included in the header of the forums. The problem is that the stupid forums get cached, and so far, despite clearing the cache about 20 times, I've been unable to get the new code to load.

So... the fix is coming. I'll look at the quote issue as well.
<<

raptor

Posts: 1044

Joined: Mon Oct 11, 2010 9:03 pm

Post Tue Nov 16, 2010 4:36 pm

Re: sam686 on Current Players

The problem is that the stupid forums get cached, and so far, despite clearing the cache about 20 times, I've been unable to get the new code to load.

If you have access to the HTTP response headers try setting:
  Code:
Cache-Control: no-cache
<<

sam686

User avatar

Posts: 468

Joined: Fri Oct 15, 2010 8:53 pm

Location: United States, South Dakota

Post Tue Nov 16, 2010 5:18 pm

Re: sam686 on Current Players

watusimoto wrote:If you look at http://bitfighter.org/statusWidget.htm, you'll see that the code is fixed there, [...]

I just took a look at the source, and found this
  Code:
$("#widgetOutput").append(data.players[i].replace(/</g,"&lt;").replace(/&/g,"&amp;"));

The "&" needs to replace first. if "<" replace first, then "&", then "<" becomes "&amp;lt;" and HTML outputs as "&lt;".

When "&" replace comes first, then "<" should be "&lt;" and HTML output "<". Test this by putting "<b>" in player game name.
<<

watusimoto

Site Admin

Posts: 1558

Joined: Tue Feb 23, 2010 7:07 pm

Location: Quartz's mom's house

Post Tue Nov 16, 2010 6:26 pm

Re: sam686 on Current Players

Well... I think it's fixed, except for dbuck's name which maybe killing the whole display...
<<

sam686

User avatar

Posts: 468

Joined: Fri Oct 15, 2010 8:53 pm

Location: United States, South Dakota

Post Tue Nov 16, 2010 6:30 pm

Re: sam686 on Current Players

home page have the same (edit: same old) problem. http://bitfighter.org
Last edited by sam686 on Tue Nov 16, 2010 7:06 pm, edited 1 time in total.
<<

watusimoto

Site Admin

Posts: 1558

Joined: Tue Feb 23, 2010 7:07 pm

Location: Quartz's mom's house

Post Tue Nov 16, 2010 6:32 pm

Re: sam686 on Current Players

Yes it does. One thing I need to do is make that read from the same file as the one in the forums does. That one is done with a copy of the code, and needs a bit of attention.
<<

sam686

User avatar

Posts: 468

Joined: Fri Oct 15, 2010 8:53 pm

Location: United States, South Dakota

Post Tue Nov 16, 2010 6:51 pm

Re: sam686 on Current Players

google chrome web browser, javascript console.
statusWidget.htm:39 Uncaught SyntaxError: Unexpected token )

When i view http://bitfighter.org/statusWidget.htm
<<

raptor

Posts: 1044

Joined: Mon Oct 11, 2010 9:03 pm

Post Tue Nov 16, 2010 6:56 pm

Re: sam686 on Current Players

Well... I think it's fixed, except for dbuck's name which maybe killing the whole display...

Gotta love them semi-colons.

I suggest you do sanitization server side before it is displayed in browser. Like have php (or what ever is handling the requests/responses) prepare any strings before sending it over the internet.
<<

watusimoto

Site Admin

Posts: 1558

Joined: Tue Feb 23, 2010 7:07 pm

Location: Quartz's mom's house

Post Tue Nov 16, 2010 7:12 pm

Re: sam686 on Current Players

I was thinking the same thing. In 14.0, quotes will be disallowed in usernames, so part of the problem will be handled that way.
<<

sam686

User avatar

Posts: 468

Joined: Fri Oct 15, 2010 8:53 pm

Location: United States, South Dakota

Post Tue Nov 16, 2010 8:14 pm

Re: sam686 on Current Players

This is not fixed, try this.
  Code:
//Currently, wrong?
$("#widgetOutput").append(data.players[i]).replace(/&/g,"&amp;").replace(/</g,"&lt;");
//right
$("#widgetOutput").append(data.players[i].replace(/&/g,"&amp;").replace(/</g,"&lt;"));
//wrong order, < becomes &amp;lt;
$("#widgetOutput").append(data.players[i].replace(/</g,"&lt;").replace(/&/g,"&amp;"));
<<

watusimoto

Site Admin

Posts: 1558

Joined: Tue Feb 23, 2010 7:07 pm

Location: Quartz's mom's house

Post Wed Nov 17, 2010 1:53 am

Re: sam686 on Current Players

OK, it is now fixed on the server side by dbuck. This was a very interesting thread. It may also explain why sometimes the widget appears dead -- perhaps a player was using a name that made it conk out.
<<

Whittling While

User avatar

Posts: 235

Joined: Wed Apr 07, 2010 10:22 am

Location: Minnesota

Post Wed Nov 17, 2010 2:01 pm

Re: sam686 on Current Players

:'(
Premier Cloaker
"Time is an illusion; lunchtime, dually so."
<<

watusimoto

Site Admin

Posts: 1558

Joined: Tue Feb 23, 2010 7:07 pm

Location: Quartz's mom's house

Post Wed Nov 17, 2010 2:20 pm

Re: sam686 on Current Players

In 014, we'll have verified names, and when I get the stats moved from a text file to a proper database, we could style player names differently based on their level of play. Or something.
<<

Whittling While

User avatar

Posts: 235

Joined: Wed Apr 07, 2010 10:22 am

Location: Minnesota

Post Wed Nov 17, 2010 3:58 pm

Re: sam686 on Current Players

:D
Premier Cloaker
"Time is an illusion; lunchtime, dually so."
<<

amgine

Posts: 1398

Joined: Thu Apr 19, 2012 2:57 pm

Post Thu Sep 27, 2012 3:54 pm

Re: sam686 on Current Players

a shame i made my name alwasy be white now its not.
Bitfighter Forever.

Return to Technical Discussion

Who is online

Users browsing this forum: No registered users and 1 guest