I've implemented some extra security to the site. A hacker discovered a few exploits 2 months ago, and was kind enough to show me what the exploits were, and how to fix them. If you're reading this hacker, thanks again, and feel free to email me or contact me if you notice anything else.
If anyone notices any issues with the site that started occurring after this update, please let me know ASAP so that I can fix it.Securing the InputsI've updated the scr
ipt that analyzes and cleans any data that gets inserted into the database. I also updated the headers of the site.
Securing the PasswordsI've updated the site's password encryption. The old was very outdated. The new one makes it so much more difficult to crack a user's password.
NOTE: User passwords will
only use the new encryption after a user changes their password (and for new users). So, I highly recommend everyone update their Vizzed password at some point, if you want to ensure your account is more secure. I'll eventually make an alert that reminds each user to change their password.
HTML CleanerI'm utilizing
HTMLPurifier for most input that involves HTML. This analyzes any HTML that gets submitted to the site, removes anything that might be potentially malicious, and also fixes the HTML if there's anything broken. Inputs that would utilize this include Posts, various profile editing, etc.
This also allowed me to eliminate the z tags that sometimes get placed into various thread titles, posts and other sections of the site.
Questions? Feedback?https://www.vizzed.com/boards/thread.php?id=104561