Dinocanid
02-08-2018, 09:39 PM
After installing the script, there's quite a bit of things that need to fixed right out of the box either because it causes an error or it's a security hole, and they're all common issues:
Renaming config_adopts to config. I know it's the last instruction you get after installing, but it feels like something that should be already done.
The "usergroup mod" error (http://mysidiaadoptables.com/forum/showthread.php?t=4009&highlight=membercreator), in which the script tries to fetch a usergroup that doesn't exist.
A user being able to register with the name "SYSTEM" (http://www.mysidiaadoptables.com/forum/project.php?issueid=46).
"rn" being deleted. (http://www.mysidiaadoptables.com/forum/project.php?issueid=56) I'm sure there's a reason for it being there, but it seems to cause more problems than it fixes. Some other measures should probably be taken to prevent users from inserting harmful code.
This bug (http://www.mysidiaadoptables.com/forum/project.php?issueid=54) with the myadopts page.
Being able to read/edit/delete another user's PM (http://www.mysidiaadoptables.com/forum/project.php?issueid=57) as long as you have the URL (I had to add this to my site, since it does indeed allow this on a fresh install)
Sure users could just apply these fixes themselves, but it's jarring when there are things you have to fix immediately after installing -- or as soon as possible to avoid exploits. (and it's pretty easy to agree that the "rn" bug is the most annoying thing ever)
Renaming config_adopts to config. I know it's the last instruction you get after installing, but it feels like something that should be already done.
The "usergroup mod" error (http://mysidiaadoptables.com/forum/showthread.php?t=4009&highlight=membercreator), in which the script tries to fetch a usergroup that doesn't exist.
A user being able to register with the name "SYSTEM" (http://www.mysidiaadoptables.com/forum/project.php?issueid=46).
"rn" being deleted. (http://www.mysidiaadoptables.com/forum/project.php?issueid=56) I'm sure there's a reason for it being there, but it seems to cause more problems than it fixes. Some other measures should probably be taken to prevent users from inserting harmful code.
This bug (http://www.mysidiaadoptables.com/forum/project.php?issueid=54) with the myadopts page.
Being able to read/edit/delete another user's PM (http://www.mysidiaadoptables.com/forum/project.php?issueid=57) as long as you have the URL (I had to add this to my site, since it does indeed allow this on a fresh install)
Sure users could just apply these fixes themselves, but it's jarring when there are things you have to fix immediately after installing -- or as soon as possible to avoid exploits. (and it's pretty easy to agree that the "rn" bug is the most annoying thing ever)