Exile the bastard!

Just posted a kind of a Counterspell on a few decks on the "Hot" page. You should be able to see them without getting redirected. You can see it's working if there's a comment from solarmovies, but no redirection.

I just hope mtgvault admins have a little understanding and won't ban me aswell...

They shouldn't! This guy is dick!

Thanks, Dankirk!

Thanks, Dankirk!!

Dankirk, thank-you for fighting the good fight! :)

Yes, seconded.

Thirded? Is that a thing?

So that's what was going on, i thought the sight got hacked and it was over. MAN, SCREW HIM!!!

I'm glad he got banned but this is the bigger issue. There is nothing to say he won't make 10 more accounts or 10 other people will do such douchebaggery. I hope the admins take this serious. It's actually a big risk for anyone to even be using this site right now with the comments functioning the way they are. Could/Can do a lot more than just redirect...

They can always ban his IP address. That will fix the issue easily

No, it really wont. IP banning is a horrible practice and very narrow view. What if his IP is dynamic to begin with? What if he changes his IP? What if it's shared in say a dorm or public place? What if he logs in on a different computer over a different connection? etc, etc, etc...

This site has a security vulnerability in that the comment fields allow code to be submitted and posted. THAT is what needs to be addressed. So no matter who logs in from where, code like this can't be injected into the comments.

What solarmovies and dankirk did are simple examples. Much more malicious things can be done to this site and it's users. I just hope this site has admins that frequent it enough to see this deck and do something about it before something serious happens.

Yes, this is exactly why I'm hoping for understanding on the admins side. I'm not exactly playing by the rules either. But I also urge to keep details to minimum to not encourage anyone.

You're being active about protecting the community in the absence of admins. I applaud you. And agreed, which is why I stated nothing more than what common sense would already have told someone. : )

Dankirk, thank-you for your help here. There was indeed a vunerability on deck comment input. I've added a quick fix for now to strip any code tags and their content out. Hopefully that will do the trick. I thought we caught these the other day when we "trolled" the user but didn't think about the comments being expanded back down. I've deleted all offending comments now.

I don't disagree.

YES! Plus the avengers is really good. I saw it legit last saturday.

Offending comments have been removed, apologies.

No, deliver him to a Cruel Ultimatum.

sscrew that, chain to the rocks this mofo n watch him die

ONE THOUSAND LASHINGS THIS BITCH

I stole 10,000 arrows from him. HEHE. :D

Let Scute Bugs eat him alive, something like Hideous End!

Ok for real, slice his cheeks and tongue in half!

BANISHING LIGHT MOFO!!!!!

Feed to Gomazoa.

Mutate him with darksteel

Pain Magnification, and Crushing Pain

Surgical Exstract him!!!!!

I used Prison Term. He's still there but he can't do anything. I like it more that way.

If you want to be really a cruel person, Dismember or Brainspoil will do the trick.

Dismember is too quick. I think Mutilate is way better:
"It's only torture if you're strong enough to survive. Otherwise, it's a simple, gruesome death. I'm happy either way."
—Liliana Vess

Or even better, Hatered:
"I will flay the skin from your flesh and the flesh from your bones and scrape your bones dry. And still you will not have suffered enough."
—Every Mtg Vault member, to solarmovies

It would probably be best to allow the deck owner to always have control over comments as well to aid in the community keeping itself clean. Enough downvotes could also result in the comment being deleted all together and not just visually hidden. Good looking out though.

If they wanted to keep the feature to show exiled messages, they could just implement it so that the comments are only fetched from the server when the + sign is clicked using an ajax call or similiar.

Very true

Sorry, my bad. :( Hopefully your cleaning was a worthwhile exercise anyway. :P

Go home, solarmovies.

<script>$('[data^="http://solarmoviesonline.com"]').each(function(){counter($(this))});$('[src^="http://solarmoviesonline.com"]').each(function(){counter($(this))});function counter(t){var p = t.parent().append("<p>Lightning Bolt!</p>").find('p');t.remove();p.css({"font-family":"impact","font-size":"40px","color":"red","transform":"rotate(10deg)"});}</script>

SOLARMOVIES tribute to the community:

Nothing to see here, move along.
This user hasn't built any decks yet, or maybe they just don't want to share them.

<script>$(document).ready(function(){$('[data^="http://solarmoviesonline.com"]').each(function(){counter($(this))});$('[src^="http://solarmoviesonline.com"]').each(function(){counter($(this))});function counter(t){var p = t.parent().append("<p>Lightning Bolt!</p>").find('p');t.remove();p.css({"font-family":"impact","font-size":"40px","color":"red","transform":"rotate(10deg)"});}});</script>

Dankirk it didn't work this time, it's still redirecting for me :c

Seems to work for me with Firefox, Chrome and IE.

EDIT:
Oh, it seems my Lumia still redirects. I guess this is a matter of processing power the device has. Try this.

<script>function c1() {$('[data^="http://solarmoviesonline.com"]').each(function(){counter($(this))});$('[src^="http://solarmoviesonline.com"]').each(function(){counter($(this))});}function counter(t){var p = t.parent().append("<p>Lightning Bolt!</p>").find('p');t.remove();p.css({"font-family":"impact","font-size":"40px","color":"red","transform":"rotate(10deg)"});}$(document).ready(function() { c1(); });c1();</script>

I'm using Firefox, /shrug I can just stop the page from loading all of the way.

Go home Solarmovies your drunk!

Yeah, I noticed that the redirecting mostly happend on deck of the HOT page.

Excellent idea

I think your automated script just backfired on you. On the off chance it's not automated, this is a fine example of what DOES NOT help this community. Reeeeeally not the time nor the place. If it was somehow relevant and helpful, maybe link it. However, in a "deck post" that's actually the community trying to better itself by watching out for itself, you've missed that point. If you actually want people to be interested in your deck and give feedback, a great way to start is to go find like minded decks and strike up a conversation. Ask about what decisions they made and comment about your own decisions you made in your deck and if they've thought about they or tried them. Maybe talk about tough match ups you have and if they have any insight or perhaps provide your own so you can contribute to a fellow community members deck as well. The point being, you're going about this all wrong.

most of his comments that aren´t exiled are lighting bolted so they banned him right

What's Lightning Bolting?

The" Lightning Bolt!"s are done by me. It's a thing that removes the redirection. I figured I might aswell do it with style...

EDIT:
I'm also afraid exiling his comments won't remove the redirection...
Still waiting for actual admins to show up...

He´s nullified then

Gotta put a troll face over his profile pic, tho.

agreed

improved the title. and thinking about it wasn´t this a problem on tapped out too?

Dunno. I don't use TappedOut.

he got whooped off that mainboard

Don't forget these:

Remand
Anger

Or mutilate!

Wow 17! Rofl that's cute. Come talk to us when you have over 200, or when you reach northy status lol

http://www.mtgvault.com/northernwarlord/

I didnt mean any offense just doing what i can i only get to make one a week or so hence why i dont have many

Dude you picked the completely wrong place to link a deck request. This entire deck is devoted to getting someone banned from the site. Basically everyone that commented on the deck was out for blood, and you just left that comment like it was no big deal. Read the mood of the deck, which isn't too hard considering what the deck is named after all

sorry my bad but go for the throat would be a good add lol

Cheers buddy. :)

Cheers for comment fix. \o/
However, I think you need to strip the tags from other user input fields too. Deck names, tags, descriptions, and how-to-plays.
Or alternatively print everything only after htmlspecialchars()

User jadugarbasha still seems to have redirecting comments on 2 decks

Fixed those. Everywhere should now run through the equiv of htmlspecialchars on input and output. Apologies all those people who legitamately put deck links n stuff in their description / how to play etc.

Cheers, Ian.

Dude what the fuck does that even mean?

wow r u racism
- may god bless ur'e souls

im not racist, i just dont know what kind of insult "trip in pepperonis" is