Purr: a simple Scratch URL shortener

kccuber

NFlex23 wrote:
Are you making sure to go to www.purr.ml? It works perfectly for me –

ok i found the issue here. going to just this

purr.ml

is causing the issue. you should set up a redirect for purr.ml to www.purr.ml

NFlex23

Deleted

Last edited by NFlex23 (Sept. 9, 2021 12:14:45)

NFlex23

kccuber wrote:
NFlex23 wrote:
Are you making sure to go to www.purr.ml? It works perfectly for me –
ok i found the issue here. going to just this
purr.ml
is causing the issue. you should set up a redirect for purr.ml to www.purr.ml

I might switch.

Edit: currently in the process of switching.
Edit again: Never mind, replit only supports CNAMEs.

Last edited by NFlex23 (Sept. 8, 2021 21:08:18)

PoIygon

YESSSSS I GOT A GOOD REDIRECT WITH A BAD URL
www.purr.ml/vaan

linearlemur

You should just randomly generate URLS.

Ciyob86

Ciyob86 wrote:
NFlex23 wrote:
Looks like someone is trying to make redirects to other pages lol:

You should use fluffyscratch authentication to log usernames.

Post Bump

Last edited by Ciyob86 (Sept. 9, 2021 00:42:25)

Chiroyce

No one saw this?!

Chiroyce wrote:
I FOUND a vulnerability!!
Harakou wrote:
True, though it seems like the other example only allowed Scratch links too. Personally I don't see it as a big problem since there's relatively little chance of nefarious use,
Harakou's URL can no longer work, right? Now how do I tell you how this is caused?

gdpr5b78aa4361827f5c2a08d700

Chiroyce wrote:
No one saw this?!
Chiroyce wrote:
I FOUND a vulnerability!!
Harakou wrote:
True, though it seems like the other example only allowed Scratch links too. Personally I don't see it as a big problem since there's relatively little chance of nefarious use,
Harakou's URL can no longer work, right? Now how do I tell you how this is caused?

that's not a vulnerability, it's just a bug

Chiroyce

potatophant wrote:
that's not a vulnerability, it's just a bug

How? They shared a screenshot of quite a lot of the short URLs, so I could just delete the others as well, but I didn't. Since I wanted to tell them about it. It is vulnerable now.
unless they add auth for the /delete post request endpoint

DispIay

how do you login to the admin panel?

Chiroyce

DispIay wrote:
how do you login to the admin panel?

You cannot, only @NFlex23 can.

DispIay

Chiroyce wrote:
DispIay wrote:
how do you login to the admin panel?
You cannot, only @NFlex23 can.

im trying to look through the code and im trying to figure out what
if request.form == os.environ:
means

Last edited by DispIay (Sept. 9, 2021 08:36:27)

Chiroyce

DispIay wrote:
im trying to look through the code and im trying to figure out what
if request.form == os.environ:
means

Basically request.form contains what the user entered, and os.environ is the password, if what the user entered matches the password, they're give access to the admin panel

DispIay

Chiroyce wrote:
DispIay wrote:
im trying to look through the code and im trying to figure out what
if request.form == os.environ:
means
Basically request.form contains what the user entered, and os.environ is the password, if what the user entered matches the password, they're give access to the admin panel

I figured out something, There’s a thing at the top called “import os” and I think the password is in there. All I need to know is where “os” is. Also it’s if request.form['pass'] == os.environ['PASS']:

Also this is the HTML for the page but with random python bits in it.
<form action=“/delete” method=“POST”>
<ul>
{% for item in lst %}
<li>{{item}} <input type=“checkbox” name=“checks” value="{{item}}“></li>
{% endfor %}
</ul>
<br>
<input type=”submit“ value=”Delete selected URLs">

Last edited by DispIay (Sept. 9, 2021 09:16:25)

Harakou

DispIay wrote:
Chiroyce wrote:
DispIay wrote:
im trying to look through the code and im trying to figure out what
if request.form == os.environ:
means
Basically request.form contains what the user entered, and os.environ is the password, if what the user entered matches the password, they're give access to the admin panel
I figured out something, There’s a thing at the top called “import os” and I think the password is in there. All I need to know is where “os” is. Also it’s if request.form['pass'] == os.environ['PASS']:

That's the Python module os. It's getting the value of an environment variable, so you're not going to find it in the code.

DispIay

Harakou wrote:
DispIay wrote:
Chiroyce wrote:
DispIay wrote:
im trying to look through the code and im trying to figure out what
if request.form == os.environ:
means
Basically request.form contains what the user entered, and os.environ is the password, if what the user entered matches the password, they're give access to the admin panel
I figured out something, There’s a thing at the top called “import os” and I think the password is in there. All I need to know is where “os” is. Also it’s if request.form['pass'] == os.environ['PASS']:
That's the Python module os. It's getting the value of an environment variable, so you're not going to find it in the code.

B r u h

NFlex23

DispIay wrote:
Harakou wrote:
DispIay wrote:
Chiroyce wrote:
DispIay wrote:
im trying to look through the code and im trying to figure out what
if request.form == os.environ:
means
Basically request.form contains what the user entered, and os.environ is the password, if what the user entered matches the password, they're give access to the admin panel
I figured out something, There’s a thing at the top called “import os” and I think the password is in there. All I need to know is where “os” is. Also it’s if request.form['pass'] == os.environ['PASS']:
That's the Python module os. It's getting the value of an environment variable, so you're not going to find it in the code.
B r u h

I'm not going to make it easy for you to hack purr, am I? I'll probably add sha256 hashes for more security too. (Chiroyce's idea)

NFlex23

Chiroyce wrote:
potatophant wrote:
that's not a vulnerability, it's just a bug
How? They shared a screenshot of quite a lot of the short URLs, so I could just delete the others as well, but I didn't. Since I wanted to tell them about it. It is vulnerable now.
unless they add auth for the /delete post request endpoint

Deleted, wrong post replied to.

Last edited by NFlex23 (Sept. 9, 2021 12:06:08)

NFlex23

Chiroyce wrote:
potatophant wrote:
that's not a vulnerability, it's just a bug
How? They shared a screenshot of quite a lot of the short URLs, so I could just delete the others as well, but I didn't. Since I wanted to tell them about it. It is vulnerable now.
unless they add auth for the /delete post request endpoint

Nevermind, I think having an admin panel is a bad idea.

Last edited by NFlex23 (Sept. 9, 2021 11:43:53)

Quantum-Cat

I think it would be better if it included the ID of a project/studio to at least have some kind of knowledge on where the link is taking you.

Discuss Scratch