very very small CMS

On Sat, 2008-07-19 at 17:17 -0400, tedd wrote:
> At 4:38 PM -0400 7/19/08, Robert Cummings wrote:
> >On Sat, 2008-07-19 at 16:31 -0400, tedd wrote:
> > > No problem -- I had the data backed-up anyway. I figured that someone
> >> would do what you did and I was ready for it -- it was easy enough to
> > > fix.
>
> -snip-
>
> >What do you mean backed up? I just replaced the filler data on the page
> >with some filler JavaScript that basically did the following:
> >
> ><script>document.body.innerHTML = 'Rob was here';</script>
> >
> >I didn't do anything to your server files. It was easily remedied by
> >loading the page with JavaScript disabled.
> >
> >I hope you didn't think I tainted your filesystem. I wouldn't do that
> >even as a joke.
>
> Well, that's not what happened. All the data shown here --
>
> http://www.webbytedd.com/a/easy-page-db/
>
> -- is pulled directly from my database.
>
> When you put:
>
> <script>document.body.innerHTML = 'Rob was here';</script>
>
> into the first paragraph and filled the remaining paragraphs with
> large hunks of text and clicked "save", all the previous data was
> replaced with your additions. Everything I had there was gone.
>
> When I inspected the dB, the only data there was yours.

:)

> Fortunately, I had created a sql dump before showing this page to
> anyone because I knew that whatever anyone put into that page, would
> go directly into my dB -- so I expected some changes. I just had not
> expected such a large change nor someone placing code in it.
>
> As you can imagine, it could have been a lot worse for me -- so
> thanks for enlightening me as to hazards of leaving something that
> insecure open for inspection.

Wasn't it just placeholder data? It looked like latin.

Cheers,
Rob.
--
http://www.interjinn.com
Application and Templating Framework for PHP

At 5:24 PM -0400 7/19/08, Robert Cummings wrote:
>Wasn't it just placeholder data? It looked like latin.
>
>Cheers,
>Rob.

Rob:

Yes, it was placeholder data. It was --

http://www.lipsum.com/

-- data with images and titles and such. It was designed to look like
a normal web page.

However, what you did was replace everything. Fortunately, you didn't
replace it with evil code. :-)

I was hoping for discussion rather than a surprise. But, no harm done.

Cheers,

tedd

--
-------
http://sperling.com http://ancientstones.com http://earthstones.com

On Sat, Jul 19, 2008 at 8:37 PM, tedd <tedd.sperling@gmail.com> wrote:

> At 5:24 PM -0400 7/19/08, Robert Cummings wrote:
>
>> Wasn't it just placeholder data? It looked like latin.
>>
>> Cheers,
>> Rob.
>>
>
> Rob:
>
> Yes, it was placeholder data. It was --
>
> http://www.lipsum.com/
>
> -- data with images and titles and such. It was designed to look like a
> normal web page.
>
> However, what you did was replace everything. Fortunately, you didn't
> replace it with evil code. :-)
>
> I was hoping for discussion rather than a surprise. But, no harm done.
>
> Cheers,
>
> tedd
>
> --
> -------
> http://sperling.com http://ancientstones.com http://earthstones.com
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
my firefox is not happy finding the site..IE and Opera are both good with
it...Dunno if this is my problem or something funky in the site?

--

Bastien

Cat, the other other white meat

At 8:42 PM -0400 7/19/08, Bastien Koert wrote:
>
>my firefox is not happy finding the site..IE and Opera are both good
>with it...Dunno if this is my problem or something funky in the site?
>
>--
>
>Bastien

Bastien:

Which site?

tedd

--
-------
http://sperling.com http://ancientstones.com http://earthstones.com

On Sat, 2008-07-19 at 17:17 -0400, tedd wrote:
> At 4:38 PM -0400 7/19/08, Robert Cummings wrote:
> >On Sat, 2008-07-19 at 16:31 -0400, tedd wrote:
> > > No problem -- I had the data backed-up anyway. I figured that someone
> >> would do what you did and I was ready for it -- it was easy enough to
> > > fix.
>
> -snip-
>
> >What do you mean backed up? I just replaced the filler data on the page
> >with some filler JavaScript that basically did the following:
> >
> ><script>document.body.innerHTML = 'Rob was here';</script>
> >
> >I didn't do anything to your server files. It was easily remedied by
> >loading the page with JavaScript disabled.
> >
> >I hope you didn't think I tainted your filesystem. I wouldn't do that
> >even as a joke.
>
> Well, that's not what happened. All the data shown here --
>
> http://www.webbytedd.com/a/easy-page-db/
>
> -- is pulled directly from my database.

I see you now only use the POSTed data to display the destination page.
But you don't actually save it to the database. Nice try with "Scubby"
btw ;) Not sure if you've ever heard of Tor.

Cheers,
Rob.
--
http://www.interjinn.com
Application and Templating Framework for PHP

At 10:08 PM -0400 7/19/08, Robert Cummings wrote:
>I see you now only use the POSTed data to display the destination page.
>But you don't actually save it to the database. Nice try with "Scubby"
>btw ;) Not sure if you've ever heard of Tor.
>
>Cheers,
>Rob.


Rob:

I knew as soon as I put in "Scubby", you would find a way around it. :-)

No, I don't save anything to the dB anymore. Like I said, next time
I'll put in a login and ask people not to change stuff too much --
after all, the end-user should be someone who wants his web site to
look good instead of something else.

No, I never heard of "Tor" -- what's that?

Cheers,

tedd


--
-------
http://sperling.com http://ancientstones.com http://earthstones.com

On Sat, 2008-07-19 at 22:17 -0400, tedd wrote:
> At 10:08 PM -0400 7/19/08, Robert Cummings wrote:
> >I see you now only use the POSTed data to display the destination page.
> >But you don't actually save it to the database. Nice try with "Scubby"
> >btw ;) Not sure if you've ever heard of Tor.
> >
> >Cheers,
> >Rob.
>
>
> Rob:
>
> I knew as soon as I put in "Scubby", you would find a way around it. :-)
>
> No, I don't save anything to the dB anymore. Like I said, next time
> I'll put in a login and ask people not to change stuff too much --
> after all, the end-user should be someone who wants his web site to
> look good instead of something else.
>
> No, I never heard of "Tor" -- what's that?

An anonymous proxy... http://www.torproject.org/

Essentially, I can connect to remote sites and appear to come from an IP
other than my own. Or in the case of Doctor Who, or originally, the
Black Donelleys... it allows me to watch restricted media on broadcast
station websites (such as the BBC or NBC) that do geo-IP filtering :)

Cheers,
Rob.
--
http://www.interjinn.com
Application and Templating Framework for PHP

On Sat, Jul 19, 2008 at 9:28 PM, tedd <tedd.sperling@gmail.com> wrote:

> At 8:42 PM -0400 7/19/08, Bastien Koert wrote:
>
>>
>> my firefox is not happy finding the site..IE and Opera are both good with
>> it...Dunno if this is my problem or something funky in the site?
>>
>> --
>>
>> Bastien
>>
>
> Bastien:
>
> Which site?
>
>
> tedd
>
> --
> -------
> http://sperling.com http://ancientstones.com http://earthstones.com
>

http://www.webbytedd.com/a/easy-page-db/

but it looks like its a gmail issue...not hanlding the link
correctly..strange

--

Bastien

Cat, the other other white meat

At 9:07 AM -0400 7/20/08, Bastien Koert wrote:
>On Sat, Jul 19, 2008 at 9:28 PM, tedd
><<mailto:tedd.sperling@gmail.com>tedd.sperling@gm ail.com> wrote:
>
>At 8:42 PM -0400 7/19/08, Bastien Koert wrote:
>
>
>my firefox is not happy finding the site..IE and Opera are both good
>with it...Dunno if this is my problem or something funky in the site?
>
>
>Which site?
>
>
><http://www.webbytedd.com/a/easy-page-db/>http://www.webbytedd.com/a/easy-page-db/
>
>but it looks like its a gmail issue...not hanlding the link correctly..strange


My FF on the Mac deals with it.

Also, if you'll note all my stuff validates -- that cuts down on
browser problems.

Cheers,

tedd

--
-------
http://sperling.com http://ancientstones.com http://earthstones.com

2008/7/18 OOzy Pal <oozypal@gmail.com>:
> Hello
> I am looking for a simple php CMS. Can anyone help?
>


you can try those:

http://www.cmsmadesimple.org/

--
Scripts: http://www.spacemarc.it