Hack Forums
[Feedback] BUG: Quick reply with Code inside - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hack Forums Official Information (https://hackforums.net/forumdisplay.php?fid=1)
+--- Forum: Site News (https://hackforums.net/forumdisplay.php?fid=2)
+--- Thread: [Feedback] BUG: Quick reply with Code inside (/showthread.php?tid=5945959)

BUG: Quick reply with Code inside - phlex - Feb 28, 2019

Hello,

I reported this bug when I first got here, but reported it slightly incorrectly.

First, let's take a look at what happens...
  1. You make a reply with code in it
  2. HackForums requires an anti-spam check because of the code in the text
  3. You click 'I am not a robot' and your post goes through

So, what's the problem?
Well, full reply & full edit mode does this just fine. It pops up the anti-spam check, you check it, and your post goes through.
However, quick edit does NOT trigger the anti-spam check.

If you want to test, you can. Include this in your post and then try to quick-edit it. Your edit will not go through because anti-spam is not triggered! :)
Code
<?php
header("Location: $url");
echo "<script>window.location.href = $url"; ?>
Then you can try FULL edit, and your edit WILL go through. The [code] tags are not required for this bug to occur. It happens regardless of whether code tags are used or not. Please note: This is only true if the forum wants an anti-spam check for you. As a new user, all code triggers anti-spam for me. I am not sure if long time members are exempt from anti-spam checks. If full-edit doesn't trigger anti-spam for you, then quick edit will work for you. If full edit DOES trigger anti spam for you, quick edit will definitely not work :)

The problem? It appears that the forum checks for the anti-spam measures to be validated when it receives 'iffy code' in a post.
This is problematic because there is no anti-spam measure on quick reply or quick edit meaning the post never gets edited.
A user can spend a large amount of time editing a post with code in it (with quick edit) and then submit it, just for all of their changes to be discarded.
Quick edit needs to have the anti-spam measure added to its protocol so that the post edit controller can receive the anti-spam validation code & correctly edit the post.

This also occurs any time anti-spam is triggered, or SUPPOSED to be triggered.
If the site thinks you should be spam-checked, it will show the Google captcha box. However, if you use quick edit/reply, it doesn't pop up and your post is discarded. This is not independent to including code in your post - This will occur with the quick feature any time anti-spam is required. So, this will happen a lot for new users, fast typers, and for including code.

Thank you for taking the time to read this bug report. It is easily replicated & has probably led many people to lose their quick edits without them even noticing.

RE: BUG: Quick reply with Code inside - Omniscient - Feb 28, 2019

This is controlled by Cloudflare security firewall settings. It has nothing to do with HF technically.

Quote:Quick edit needs to have the anti-spam measure added to its protocol

We can't do that. It's up to Cloudflare how it handles their firewall security.

RE: BUG: Quick reply with Code inside - phlex - Feb 28, 2019

(Feb 28, 2019 12:19 PM)Omniscient Wrote:  This is controlled by Cloudflare security firewall settings.  It has nothing to do with HF technically.


We can't do that.  It's up to Cloudflare how it handles their firewall security.

Mmm, that's unfortunate :(
So, it must be because Cloudflare triggers it on new page requests, but quick reply/edit doesn't use a new page for the user - I'm assuming it just uses AJAX.
I wonder if there's a way to make it so that detected code in the POST forces an actual POST submit instead of AJAX so that the Cloudflare catch doesn't interfere, and if so if it's even worth it. It would have to look for HTML/JS/etc code (I'm assuming Cloudflare is picking up on script tags, or angle brackets & question marks, but I'm not sure) and then instead of triggering AJAX, submitting it to the same controller manually w/ a page load that full edit does.

RE: BUG: Quick reply with Code inside - Omniscient - Feb 28, 2019

(Feb 28, 2019 01:24 PM)phlex Wrote:  Mmm, that's unfortunate :(
So, it must be because Cloudflare triggers it on new page requests, but quick reply/edit doesn't use a new page for the user - I'm assuming it just uses AJAX.
I wonder if there's a way to make it so that detected code in the POST forces an actual POST submit instead of AJAX so that the Cloudflare catch doesn't interfere, and if so if it's even worth it. It would have to look for HTML/JS/etc code (I'm assuming Cloudflare is picking up on script tags, or angle brackets & question marks, but I'm not sure) and then instead of triggering AJAX, submitting it to the same controller manually w/ a page load that full edit does.

Now you understand.

It just gets screwed up by Cloudflare and it depends on the content in the edit really. In such cases it's just best to use Full Edit. And yes unfortunately you might type out a long post and lose it.

RE: BUG: Quick reply with Code inside - phlex - Mar 1, 2019

(Feb 28, 2019 01:36 PM)Omniscient Wrote:  Now you understand.  

It just gets screwed up by Cloudflare and it depends on the content in the edit really.  In such cases it's just best to use Full Edit.  And yes unfortunately you might type out a long post and lose it.

Yes, understood ;)
I'm glad you're aware of it & I will counter the issue by making sure I use full edit/reply when I know I will most likely get a CF anti-spam due to the content.
Thanks for your replies!