[color=blue][b]Description:[/b][/color] Actually our current js linker, especially the one on the current generator has a security hole that makes people be able put some kinda malicious script by inserting it through the comment. Notice this part on the generated code.. [quote]<a href='URL OF JS' id='cradle'></a>[/quote] that's the thing.. u can actually insert the same id on comment usually by inserting fake image with js on it. [color=blue][b]Suggestion:[/b][/color] Linker Users, for security reason, kindly set your comment setting to [color=white][b]never approve comments automatically[/b][/color]. To those who dont have any idea on how to do this, [color=blue][b]Please follow this instruction:[/b][/color] [quote]- Login your friendster account - Click your account setting [url=http://www.friendster.com/editaccount.php][color=yellow]here...[/color][/url] - Set the comment setting like the image bellow : [color=black]--[/color][img]http://h1.ripway.com/crazydavinci/thecradleboard/comments.gif[/img] - Click Save[/quote] Also never forget to always check the comments before approving. If you see anything like this on the comment (on the html code or view source): [quote][color=orange]id='cradle'[/color][/quote] Just delete that comment and send us the profile of the one who sent it. Send it Here: [url=http://the-cradle.users-board.com]The Cradle Forum[/url] [b][color=orange]Another Suggestion[/color][/b] : put your cradle links in the about me section, it could be in about me box or who i want to meet. That would screen comments since about me section comes before comments but the import codes can only stay in the media box. So you should break apart the generated code from the generator into two parts. First, this part on your media box : [quote]<style type='text/css'>@impo\rt url(http://the-linker.bravehost.com/The-Cradle/reload.swf);</style>[/quote] an this on about me/who i want to meet : [quote]<a href='[color=yellow]URL OF YOUR JS[/color]' id='cradle'></a>[/quote] Thanks to [b]Shakiro[/b] for this... [color=blue][b]Note:[/b][/color] Just try to inform u the fact here.. Angell actually has already known about this and still experimenting with the solution to make the linker safer from profile defacing. [color=red][b]The Cradle Administrative Team[/b][/color]

Last edited by November (2008-05-26 00:49:04)