Sarah (sarahsrage) wrote,

Blurty staff -really- need to read this LJ security thread.
Using two huge gaping holes in the LJ engine that blurty uses, it's possible to create a self propigating thread using peoples "Friends" pages.

(Read 'Blog Virus', and 'High Security risk'.)

Perhaps a couple of patches are needed?

http://www.livejournal.com/community/lj_dev/641972.html?view=6358452#t6358452

And if you know any mods of other sites using the LJ engine, could you pass on the info?

Post a comment in response:

From:	( )	Anonymous- this user has disabled anonymous posting.
		Username:
		Username:  Password:  Login?
Subject:	No HTML allowed in subject
	No Image
	Don't auto-format:
Message:	Enter the security code below. Notice! This user has turned on the option that logs IP addresses of anonymous posters. Allowed HTML: <a> <abbr> <acronym> <address> <area> <b> <bdo> <big> <blockquote> <br> <caption> <center> <cite> <code> <col> <colgroup> <dd> <dd> <del> <dfn> <div> <dl> <dt> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr> <i> <img> <ins> <kbd> <li> <li> <map> <marquee> <ol> <p> <pre> <q> <s> <samp> <small> <span> <strike> <strong> <sub> <sup> <table> <tbody> <td> <tfoot> <th> <thead> <tr> <tt> <u> <ul> <var> <xmp>