Recent changes to bugs

XSS-vulnerability base/admin/login.php?arsc_message=

2011-06-02T15:23:14Z

Your application contains lot of input validation bugs, which lead to XSS-vulnerabilities. One example:

http://www.reallysimplechat.org/chat/base/admin/login.php?arsc_message=<SCRIPT SRC=http://example.org/xss.js></SCRIPT>

Could you go trough your application and add proper validation to the code, thank you!

Several security vulnerabilities

2011-06-02T15:04:54Z

Have you already fixed these issues in some version?

http://www.htbridge.ch/advisory/xss_in_a_really_simple_chat_arsc.html
http://www.htbridge.ch/advisory/multiple_sql_injections_in_a_really_simple_chat_arsc.html

If I am correct there is no CVE-identifier for these yet, because htbridge does not know how to do security advisories well. Did you already get notified about these vulnerabilities?

smilie list in help window missing images

2009-11-29T20:38:54Z

smilies are not shown as images except the last one.
Solution: insert one line in arsc_smilies_replace

// Replace smilies with image tag //FIXME: Move into API
// RN: fixed: reset($smilies); inserted since of copy of smilie
// arrays points beyond $key in help.php
function arsc_smilies_replace($text, $smilies, $smilies_pfad)
{
reset($smilies);
while (list($key, $val) = each($smilies))
{
$text = str_replace($val, "<img src=\"".$smilies_pfad.$key.".gif\" border=\"0\" alt=\"".$val."\">", $text);
}
return $text;
}

Poor internationalization support in chatrooms

2008-01-13T00:31:11Z

ARSC 3.1-rc1-p1 has absolutely unacceptable support for international characters. Using htmlentities() to process any most of the user input is way too restrictive, and it breaks UTF8.

The patch attached here adds basig UTF-8 support to ARSC by:
* replacing all references to htmlentities() with references to htmlspecialchars();
* transcoding all translations into UTF-8;
* adding a .htaccess file as a quick'n'dirty workaround for the chat window ignoring charset setting set in a translation. This file could be removed after applying the patch if the default charset has been set elsewhere and/or the file causes trouble (e.g. the "Server misconfiguration" error).

It also raises the ARSC version from 3.1-rc1-p1 to 3.2-rc1.

To fully support Unicode (and get rid of that workaround), some more stuff needs to be done, but it should be done by someone with better knowledge of this particular peace of code, or more free time. :)

User + Pass letters - Special chars. Bug

2006-01-13T15:11:46Z

Version: v3.1-rc1 and v3.1-rc1-p1

When signing up for a registered nickname all those
accounts which use special characters (e.g.: space,
point, semikolon, underline, plus, ...) in their
usernames and / or password are invalid.
Every try to login results in "invalid user and pass"
error.

(Note: With standart letters "a-z", "A-Z" and "0-9"
everything is working fine)

System Doesn't Repeat Whispers Containing Apostrophes

2005-10-10T22:45:31Z

On an installation of ARSC 3.0.2RC2, typing a whisper
that contains an apostrophe character (') results in
the system NOT showing you the message that you typed.
If you type the same string WITHOUT the apostrophe, the
system shows you the message.

Confirmed on multiple computers with different
browsers, and even confirmed on the demo installation
of 3.0.2RC2 provided.

XMLHttpRequest version is buggy in Safari

2005-08-24T07:50:45Z

Safari displays a lot of 'null' strings in the chat
message frame. Solution was sent in by Greg Elin.

/move broken in v3.0.2-rc2 ?

2005-08-06T10:33:42Z

Hi!

It seems that /move is broken in v3.0.2-rc2

For example: /move user testroom gives this interesting response:
"User user leaves the room Free For All and enters room ."

Note, that the destination room is missing.

The to-be-moved user gets lots and lots and lots of error messages
like these (if the php error display option is on):

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL
result resource in [...]/arsc/base/inc/api.inc.php on line 137

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL
result resource in [...]/arsc/base/inc/api.inc.php on line 379

Best regards,
Daniel

Error in SQL query

2005-06-09T18:25:03Z

In the file api.inc.php (369)
SELECT id, message, user, flag_ripped, flag_gotmsg,
flag_moderated, sendtime, timeid FROM
arsc_room_free_for_all FORCE INDEX(PRIMARY) WHERE id >
'21' ORDER BY id ASC

produce an error:
RROR 1064: You have an error in your SQL syntax near
'INDEX(PRIMARY) WHERE id > '21' ORDER BY id ASC' at line 1
mysql> SELECT id, message, user, flag_ripped,
flag_gotmsg, flag_moderated, sendtime, timeid FROM
arsc_room_free_for_all WHERE id > '21' ORDER BY id ASC;

I deleted 'FORCE INDEX(PRIMARY)' and it works

error/safari bug

2005-05-04T15:33:50Z

We've installed the chat, and everything works fine...in IE,
Firefox,Netscape. But in Safari, users get kicked off with any
activity...if any [refresh] link is clicked, if another user enters or
adds a chat entry, etc.
The error message given is:

"You were kicked out of the chat by an operator, probably due to
behaviour that was not according with the rules of this chat, or
because your session has timed out.
Return to the login page "

Is this a known bug? Is it being worked on?
Thanks for any help.
farrah@blast.com