MatrixWorkz opened this issue on Aug 23, 2009 · 3 posts
MatrixWorkz posted Sun, 23 August 2009 at 3:12 PM
Ok I was told we could add HTML to our notes section but apparently that's limited to just links. All Form data required for adding a donate button for paypal is stripped out as you post the notes. I did discover, however, that if you enable comments on your freebies you CAN post your PayPal Donate button in the comments section of your freebies. This however leaves me wondering what other kind of possible mischief can occur in your comments section if left enabled.
EnglishBob posted Sun, 23 August 2009 at 5:32 PM
This used to be a problem in the gallery comments - people could post just about anything they wanted, including JavaScript - but that facility was removed. It would be a backward step if that same old code had resurfaced in the freestuff section.
You should bring this to the attention of the site programmers via mail to admin (at) renderosity (dot) com. They're going to be busy, come Monday morning. :)
Miss Nancy posted Mon, 24 August 2009 at 2:20 PM
the paypal donate button may just be an inline img link comprised of elementary html, e.g.:
which is not a security risk IMVHO. assuming they haven't already patched this, I reckon I could post png/jpeg files, swf files or any kind of distracting anim gif img in the comments if I were sufficiently evil, which I ain't.
