unknown scratch pages

Jeffalo

DifferentDance8 wrote:
jellyfishfisher56 wrote:
download.scratch.mit.edu - not a download page, just says “Scratch On!”, not sure what this is used for
my (slightly far-fetched) theory is an april fools page that never got cleaned up

no, it just hosts some scratch related pdfs and things.
https://download.scratch.mit.edu/CreativeCoding.pdf
https://download.scratch.mit.edu/ScratchReferenceGuide14.pdf
https://download.scratch.mit.edu/idc07.pdf

INSERT-USER_NAME

Does anybody know if there's a URL that contains the ban page?

medians

Crispydogs101 wrote:
How come no one found http://scratch.mit.edu/projects/andresmh/104 ? It's very well known and common.

Uhm, that’s just a redirect because that’s how the 1.x project page urls were.

octopuswinslow

what is handdelete.cur?

infinitytec

I think staging.scratch.mit.edu used to be a thing. IIRC when they were doing some significant updates once it was up and functional. A couple of us in the ATs had some fun with it.

octopuswinslow

are

https://scratch.mit.edu/js/polyfill.min.js

https://scratch.mit.edu/js/common.bundle.js

https://scratch.mit.edu/js/splash.intl.js

and

https://scratch.mit.edu/js/splash.bundle.js

known? and if they are, what do they mean?

Last edited by octopuswinslow (April 14, 2023 02:53:09)

PizzaPizza72

infinitytec wrote:
I think staging.scratch.mit.edu used to be a thing. IIRC when they were doing some significant updates once it was up and functional. A couple of us in the ATs had some fun with it.

There was a Wayback Machine snapshot of it from 2015. It looks identical to the Scratch homepage.
(Except the Scratch logo is missing)

Last edited by PizzaPizza72 (April 14, 2023 02:55:35)

CST1229

INSERT-USER_NAME wrote:
(#582)
Does anybody know if there's a URL that contains the ban page?

Pretty sure there isn't one.

octopuswinslow wrote:
(#586)
are (snip) known? and if they are, what do they mean?

Script files used by 3.0 pages (minified and bundled for faster loading times):

https://scratch.mit.edu/js/polyfill.min.js has code for supporting older browsers
https://scratch.mit.edu/js/common.bundle.js has code that is common to every 3.0-styled page
https://scratch.mit.edu/js/splash.intl.js contains language text (or strings) for the home page and a few other things
https://scratch.mit.edu/js/splash.bundle.js contains code for the home page

scratchusername40

statistics apis:
- https://scratch.mit.edu/statistics/data/daily/
- https://scratch.mit.edu/statistics/data/monthly-ga/
- https://scratch.mit.edu/statistics/data/monthly/
might be fun to do something with these

-gr

oops cst1229 found it before me

Last edited by -gr (May 9, 2023 16:14:51)

PaperMarioFan2022

Bump

PlNG_

https://scratch.mit.edu/accounts/check_password/

PaperMarioFan2022

PlNG_ wrote:
https://scratch.mit.edu/accounts/check_password/

Okay, never saw that one before, what is that even suppose to be used for anyway? That literally has nothing to do with Scratch.

CST1229

PaperMarioFan2022 wrote:
(#593)
PlNG_ wrote:
https://scratch.mit.edu/accounts/check_password/

Okay, never saw that one before, what is that even suppose to be used for anyway? That literally has nothing to do with Scratch.

That was probably used back in the 2.0 alpha (to gate it behind a password).

Last edited by CST1229 (May 27, 2023 18:33:15)

PlNG_

CST1229 wrote:
PaperMarioFan2022 wrote:
(#593)
PlNG_ wrote:
https://scratch.mit.edu/accounts/check_password/

Okay, never saw that one before, what is that even suppose to be used for anyway? That literally has nothing to do with Scratch.
That was probably used back in the 2.0 alpha (to gate it behind a password).

Probably more

mybearworld

It just seems to check if the password is your password

WojtekAdvanced

I POSTED THIS ON MY ALT BECAUSE I SEEM IT'S TOO DANGEROUS TO EXPOSE.

CST1229 wrote:
INSERT-USER_NAME wrote:
(#582)
Does anybody know if there's a URL that contains the ban page?
Pretty sure there isn't one.

octopuswinslow wrote:
(#586)
are (snip) known? and if they are, what do they mean?
Script files used by 3.0 pages (minified and bundled for faster loading times):
https://scratch.mit.edu/js/polyfill.min.js has code for supporting older browsers
https://scratch.mit.edu/js/common.bundle.js has code that is common to every 3.0-styled page
https://scratch.mit.edu/js/splash.intl.js contains language text (or strings) for the home page and a few other things
https://scratch.mit.edu/js/splash.bundle.js contains code for the home page

i found admin things on the homepage,
but might get me banned so i didn't place it here, but the /scratch_admin/ directory exists,
anyways going into it redirects to /, aka the homepage of Scratch, but only on it's subdirs,
the directory itself goes into the 404 page, but it might depend on the Scratch Team status.

found these, but via the homepage JS:
removed, because i do not like bans very much
if a st member sees this, please move some code for the homepage because it actually exposes too much

Last edited by WojtekAdvanced (May 27, 2023 19:26:23)

Jeffalo

WojtekAdvanced wrote:
please move some code for the homepage because it actually exposes too much

the javascript bundle is from the github repo which has more stuff if you're interested? https://github.com/scratchfoundation/scratch-www

its all intentional though. the real admin things are not publicly exposed like that.

WojtekGame

Jeffalo wrote:
WojtekAdvanced wrote:
please move some code for the homepage because it actually exposes too much
the javascript bundle is from the github repo which has more stuff if you're interested? https://github.com/scratchfoundation/scratch-www

its all intentional though. the real admin things are not publicly exposed like that.

it shouldn't but CTRL + F and typing admin and seeing the uri value (which is just an URL) exposes the urls, however yes.

Jeffalo

WojtekGame wrote:
it shouldn't but CTRL + F and typing admin and seeing the uri value (which is just an URL) exposes the urls, however yes.

this is quite common for modern javascript apps. the way bundles works means extra client side code is exposed to users. but this isn't a huge issue as longa as the actual server side measures are put in place.

Discuss Scratch