rulerofzu Posted February 19, 2011 Posted February 19, 2011 What would you know Kieran anyway? The fact that they are releasing updates is fine by me. Okay might not be perfect but at least its work in progress. Good luck to em. Quote
Paul Evans Posted February 20, 2011 Posted February 20, 2011 wow children, seriously that is a lot better than 2.02c as anyone here actually hacked it? or is this just a hatred on mc thing going on... List the bugs and im sure they'll be fixed immediately when they have time, i myself in the past have been rather harsh with MC but they have done alot more than people would actually think about. Mail/Events that i didn't even think was a bug lol I'm guessing id 3 was made in staff panel which means a minor issue with filtering in the user make or edit.... come on your just being picky cunts now give 'em a list of the files which allow the deletion of none existent stuff and im sure they'll get onto it Does friendslist also have the blacklist bug? (i assume they did them seperately therefore one maybe not buggy). This obviously is a demo i mean they ain't released it for download therefore it is a demo, they did also say hack it which i ain't seen happen as of yet i just see afew people bitching about losing money and finding any excuse to disrespect the hard work put into the patch. I assume everyone will think ill be one of the people dissing on this but really they have quite well patching the forum issues, cmarket, itemmarket and various other files. Anyone actually hacked it? They even patched the quote issue on forums LOL and i thought i was the only one who figured that one out (bet alot of you claim that one now) Good work MCC really... Don't believe someone actually banned the admin account... seriously how childish are some of you, do you need your hand holding or them to suspend functions just so you don't hurt yourselfs? Quote
Dominion Posted February 20, 2011 Posted February 20, 2011 paul... He must be feeling ill or something ;). You are right, but I still would like to see an example of a file as I said before. Quote
Paul Evans Posted February 20, 2011 Posted February 20, 2011 yeah actually me too i would love to see a snipet from maybe the forum.php mid section just too see what they've done, but yeah every script has bugs which is why they do testing which is what this post is all about so i don't see why all the flaming is even relivent personally i'd delete them but take the bad with the good. Danny seriously grow up. Quote
Equinox Posted February 20, 2011 Posted February 20, 2011 The blank name was me. On register. trim() Nuff said. Quote
Paul Evans Posted February 20, 2011 Posted February 20, 2011 ah EQ no surprise it was you lol yeah trim would be a good idea on reg filtering/staff name edits and preferences still no hacks, must of done something right :) Quote
Equinox Posted February 20, 2011 Posted February 20, 2011 I didn't try to be honest, I just signed up under " " << spaces and tried a simple SQL injection on preferences, but they use regex there. Looks as if it's the one from MWG, I think it has been us who have secured McCodes :p Quote
rulerofzu Posted February 20, 2011 Posted February 20, 2011 $username = trim(filter_input(INPUT_POST, 'name', FILTER_SANITIZE_STRING)); Check the length if you feel the need and you could take it further to disallow - _ etc Quote
Djkanna Posted February 20, 2011 Posted February 20, 2011 Don't trim the username period, unless you check that it isn't empty first. Quote
rulerofzu Posted February 20, 2011 Posted February 20, 2011 Maybe I misread the discussion. Wasnt it on trim the username of whitespace? I was thinking on the presumption if its completely empty then it would throw an error anyway. Quote
sniko Posted February 21, 2011 Posted February 21, 2011 Paul, i agree BUT i suggested those things for them to fix, not as hacks, but primarily as bugs, as it is a demo of the patch, they would need to sort some of the things out, for example the admin account is banned, how will they demo the admin if they cannot do anything with it... see where im coming from? I agree with Paul that mccodes did a good job - so, well done to them. -sniko Quote
Equinox Posted February 21, 2011 Posted February 21, 2011 I disagree. McCodes have made an effort, yes. And they deserve something for that. But their clients have gone years with the previous crappy code, (I wont call it crappy now as I haven't seen it). And Paul, I don't know how the buttocks of McCodes tastes, but it must do something for you as you used to slate it and put it down, all of a sudden you've changed? I smell something funny, and apparently so do you, eh? ;) So yes, Dabs and CB, congratulations for finally doing the right thing. And I'm sure your continued efforts to make McCodes better will go well, so long as you don't leave it for another few years :p All the best Quote
Paul Evans Posted February 21, 2011 Posted February 21, 2011 simpler solution would be add strlen into reg to disallow single space name and i believe they use regex which only allows a single space at one given time so would it then be possible to make the name ' a ' which in my eyes isn't actually a bug it's just inventive name making. EQ i almost cried when i read your last post i love it i really do yeah im sure there is a reason for my recent review of MC scripts but that's mainly due to the amount of work i've done with mc scripts in the past i personally would know exactly how hard they worked on this new patch and appreciate it entirely, if you want to call me a brown nose for actually reviewing the situation then go ahead but you did actually say you registered and tried one exploit in preferences... does that even give you the right to warent a opinion on the script? (no offense intended i love you all but come on) They worked hard yes maybe it took them a while to actually get with the program but as of lately i believe they have done more work than they did in the 6+ years they weren't around. They offer actual support now and are taking into note peoples complains and peoples wants for mcv3 they are even patching mcv2 so that older users who are waiting won't have to pay out hundreds of dollars to people who may not even secure the script properly. Personally i'd trust the retailer over the freelancer anyday (i know im the freelancer) they have tried and like i've said afew times earlier no bugger has hacked it yet... so why complain. Danny, i didn't actually see what you said but got a issue why not PM me. Sniko, you a good lad actually seeing the bigger picture. i do wish the MC team all the best Also incase anyone is trying to get in touch with me i'd like to inform everyone that my Motherboard blew (LOL) so im finally going to upgrade (i had this horrid emachine esys motherboard). Personally i think the only people who will complain about this are the people who have/do security for mcv2 games as the only way you'll get business is if you work for people without a mc license which i don't see many besides maybe a few doing. wow i've typed alot but without a pc is boring as hell lol COD BO FTW! Although some people may actually only be disliking this due to the time frame it took them to do it but you really have to admit they finally did it and considering they have only been back like 6-8 months they have done quite abit in that time frame. Quote
Equinox Posted February 21, 2011 Posted February 21, 2011 As a contributor to McCodes (by posting on their forums and helping people out) I have a every right to my opinion. Now, I still think it's you that has been working with McCodes to secure their site and it's funny how your opinion of them just changes, don't say it's because you appreciate that they've finally done what they are supposed to do because that's bull :p If Dabs testicle gave off heat, I'm sure you'd have a red cheek. Something isn't right with you, you're doing something for/with them and if you are, why don't you just tell people? No one will care. Anyway, you no where I am on MSN if you want to dispute this more, and just make me reiterate my point more of how I'm right. :) Quote
Danny696 Posted February 21, 2011 Posted February 21, 2011 My opinion of this is 5 years too late. How long have they been back? they've not had 5-8 months. My suspision is either you secured it, or your wanting someting, like moderationship, so you look good. Or both, so why not cut out the BS yeh.. Quote
Paul Evans Posted February 21, 2011 Posted February 21, 2011 my opinion mainly comes from the future projects i will be undertaking with my own engine which is why i have a somewhat less sceptical opinion. When they sort out the few bugs left in the script im sure many of the long time clients/new clients will appreciate it greatly i don't really see a downside to this patch. Give me one reason why this script is worse than original mcv2.0 without it actually effecting yourself. I still can't see anyone claiming a hack as of yet and it's been up since friday which goes to show it's rather strong scripting behind the previous hacked files. The pros to this patch are that clients of MC won't have to rely on freelancers to secure their script and therefore are getting value for their money. If they have made this much effort on v2 im sure v3 will be quite amazing. EQ LOL Dabs you considering posting a snipet? i would really like to see this also. Quote
Equinox Posted February 21, 2011 Posted February 21, 2011 Even opening 1 McCode file and changing a single line is an improvement, so it's worse in no way.... "rather strong scripting" - HA, thanks. I really did need that laugh today, You made me wipe a tear from my eye. The reason the scripts security hasn't been compromised is because no one with sufficient knowledge is trying it, it brings no benefit to them. Maybe you'll get the odd newbie who try's changing their name to something basic like a single quote, or maybe an SQL Injection attempt of some simple standard. McCodes wouldn't stand a chance against someone who has been testing script security for years and has great knowledge. They've stopped script kiddies, and that's all these games are targeted by Quote
Dominion Posted February 21, 2011 Posted February 21, 2011 my opinion mainly comes from the future projects i will be undertaking with my own engine which is why i have a somewhat less sceptical opinion. When they sort out the few bugs left in the script im sure many of the long time clients/new clients will appreciate it greatly i don't really see a downside to this patch. Give me one reason why this script is worse than original mcv2.0 without it actually effecting yourself. It effects their “long term clients” more then anyone else... Now what they have done is made is easier for competition to pop up using mccodes. Not saying it's bad but you did ask for a way it effects people. More games will now pop up with no imagination or customization put in. I still can't see anyone claiming a hack as of yet and it's been up since friday which goes to show it's rather strong scripting behind the previous hacked files. Unlike last time where people sat down, and spent the day attacking it, this time people have just looked or maybe tried copy, and paste attacks... less effort does not mean more secure. Correct me if anyone has spent hours trying to attack this site. If they have made this much effort on v2 im sure v3 will be quite amazing. Really? Your really going to sit there, and say that? When was v2 released again?You're right it's a good start, but they still need to do a lot more to get there image anywhere near what you seem to now believe it is. Dabs you considering posting a snipet? i would really like to see this also. So would I if they are willing to post a file. Now lets all play nice... no one can deny it's at least a starting point to improving what they had. Quote
Danny696 Posted February 21, 2011 Posted February 21, 2011 Paul, why would you need a snippet of code, you did it. Bit silly really :s And as dom pointed out, your the only one who ever actually hacked it. Quote
sniko Posted February 21, 2011 Posted February 21, 2011 Thanks Paul. Also, why can people just be happy that the McCodes team are actually back and updating their scripts, rather than just flame at them, it's like, you aren't happy because its not secure, but then again, once they have/in the process of securing it, your not happy. So, either way, your acting like a dumb mofo, why are you not happy when its secure, because you want it to be secure, but, still, your flame once it is. Gay much. Just my view, not to be taken to heart, apart from, be happy that they are trying/succeeding to secure their scripts. -sniko Quote
The Spirit Posted February 21, 2011 Posted February 21, 2011 Well done mccodes, looking forward to seeing the code. On a side note: Has Jordan left? havent seen a post from him in ages Quote
Djkanna Posted February 21, 2011 Posted February 21, 2011 Hmm... I'm more inclined to agree, to little to late but at least it's finally over with. Quote
Paul Evans Posted February 21, 2011 Posted February 21, 2011 @ Daniel - I have been a member of CE/MWG for about 5 years roughly and never once asked to be a moderator (yet i was once a moderator of the tv shows section) so i don't see where your going with that but seriously do you have to just post rubbish on topics i mean i did actually say contact me via pm if you have a issue... Also where did dom actually say i was the only one to ever hack MC? @ dom - I actually do believe mcv3 structure is going to be rather good if they take into consideration all the ideas which were posted on here, i think i actually contributed to some ideas myself. My script actually has afew of the ideas which people posted which is why i believe if they do it right it will be quite good. (I put in afew of the ideas before they were posted and afew when they were posted in a seperate forum topic). Why don't people actually try hacking it then, i surely will spend quite afew hours trying to on thursday... @ EQ - Well to be honest for some of the fixes on the forum they would need semi strong coding. Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.