Neowin External Login Tool

[easternBrain]

nice work timdorr (Y)

[JMann Veteran]

Sietse created it. :rolleyes:

[Tim Dorr Veteran]

Sietse created it. :rolleyes:

585409014[/snapback]

No, I did :huh:

[linked]

Yeah, Tim coded it.

It says in the example, "Example code by Sietse", but that doesn't mean he coded the tool.

Tim, care to edit the example to clarify what it's saying? Almost fooled me, too, excpet I knew better ;)

[+chorpeac MVC]

I think there may be a bug with this tool guys. I am trying to figure out if the username is being sent correctly for a user who has a character like ? in their name.

What encoding is used? Is the HTML returned from a request encoded?

For example, if the user logging in is UserA?

If I use utf-8, then no character is returned and I just get UserA

If I use utf-7, then I get this and I get UserA

If I use ASCII, then I get a ? and I get UserA?

[JMann Veteran]

Sorry Tim. :blush:

[McGazza]

Sietse created it. :rolleyes:

585409014[/snapback]

Sietse does back end coding Jmann, i doubt he made it!

[+chorpeac MVC]

I think there may be a bug with this tool guys. I am trying to figure out if the username is being sent correctly for a user who has a character like ? in their name.

What encoding is used? Is the HTML returned from a request encoded?

For example, if the user logging in is UserA?

If I use utf-8, then no character is returned and I just get UserA

If I use utf-7, then I get this and I get UserA

If I use ASCII, then I get a ? and I get UserA?

585724876[/snapback]

Any Neowin coders know about this??

[JMann Veteran]

Chor, PM Timdorr or Sietse and Toxikk, they should know. Doubt they would look at this, too many threads everywhere. :)

[+chorpeac MVC]

Chor, PM Timdorr or Sietse and Toxikk, they should know. Doubt they would look at this, too many threads everywhere. :)

585734914[/snapback]

I already did, but I will try one more time.

[+chorpeac MVC]

Timdorr or NeowinCoder, Could you look at the post 3 levels up (previous page)? I've tried to PM you all, but I don't think they are getting to you.

[Tim Dorr Veteran]

There's no encoding used, I don't believe. It's whatever is in the database. Look at how IPB handles it.

[+chorpeac MVC]

There's no encoding used, I don't believe. It's whatever is in the database. Look at how IPB handles it.

585798060[/snapback]

Well if I don't use any encoding, then I am getting names without the special characters. If I use encoding, then I get some value in the position of the special character, but I can't decode it.

Is anyone else using this tool? Can anyone else confirm that users who have special characters in their name are coming across ok?

I may be wrong, but you might have to encode it so it comes across ok.

Anytime you have a whitespace or weird character in the URL of your browser, it is converted(encoded) so it can be set across the net ok. We might need to do the same for this...

[The_Decryptor Veteran]

Have you tried using ISO-8859-1 encoding, that's what the neowin pages use.

[+chorpeac MVC]

Have you tried using ISO-8859-1 encoding, that's what the neowin pages use.

585802012[/snapback]

Hmm.. I'll play with that and see what I can do with it. Thanks for the tip

[+chorpeac MVC]

Have you tried using ISO-8859-1 encoding, that's what the neowin pages use.

585802012[/snapback]

Are you sure? I don't see the ? character in that list

http://en.wikipedia.org/wiki/ISO_8859-1

[The_Decryptor Veteran]

yeah, neowin does use Latin-1 (ISO-8859-1) (view page source, it's in the content-type header tag)

the problem is i dont know how the script handles internationalised characters (im guessing the TM symbol was entered as Unicode), i also have no idea how it translates between Unicode and Latin-1 (e.g. how it handles wide characters) but it does look like it doesnt support wide characters (cause it's handling the two bytes separatly, not as one wide character)

Edit: ok, reading the wiki more, if the symbol isn't unicode, it's a problem with codepages, ISO-8859-1 doesnt have the TM symbol, but Windows-1252 does have it, the problem is that they are basically the same, so web browsers (and im guessing other apps) treat them as such. ISO-8859-1 has a range of control characters (which are invalid in HTML) while Windows-1252 has characters there (including the TM symbol)

Edited April 20, 2005 by The_Decryptor

[+chorpeac MVC]

yeah, neowin does use Latin-1 (ISO-8859-1) (view page source, it's in the content-type header tag)

the problem is i dont know how the script handles internationalised characters (im guessing the TM symbol was entered as Unicode), i also have no idea how it translates between Unicode and Latin-1 (e.g. how it handles wide characters) but it does look like it doesnt support wide characters (cause it's handling the two bytes separatly, not as one wide character)

Edit: ok, reading the wiki more, if the symbol isn't unicode, it's a problem with codepages,  ISO-8859-1 doesnt have the TM symbol, but Windows-1252 does have it, the problem is that they are basically the same, so web browsers (and im guessing other apps) treat them as such. ISO-8859-1 has a range of control characters (which are invalid in HTML) while Windows-1252 has characters there (including the TM symbol)

585802611[/snapback]

Well just for S&G, let me try using that Windows-1252 instead... :)

[+chorpeac MVC]

HAHAHAHA....You are the man of the hour Dude. Can I get a round of applause for The_Decryptor!! :jump: :punk: :fun:

[The_Decryptor Veteran]

Well, i guess Windows-1252 was the right encoding. :yes:

And thanks btw, at least you got it working. :yes:

[JMann Veteran]

Excellent, I am glad we got this bug fixed. It was really the hardest one we had to get done. Excellent!

[Milan -]

cool, thisnis veyr good :happy: i could use it to attract people to neowin from my website which is coming soon

www.milanmehta.net/.co.uk :yes:

[+chorpeac MVC]

Does the tool indicate if a user is a subscriber? If so, where? Is it a boolean?

[yman]

The query string parameter for the url in the login forum is vulnerable to XSS injection.

This could allow someone to steal cookies using javascript.

[yman]

(bump)

This is serious, you can atleast acknowledge the bloody vuln.