February 15th, 2020 at 1:21 AM
I just finished a full on round of as much penetration testing as possible. Tried throwing script, onchanges, onclicks, rogue characters, whatever I could think of. Did it in the class fields, in the ACP, in the announcement, in the usergroup fields, and anywhere else that I could possibly think of. Things that take numeric values even, things that aren't even the announcement.
It even sanitizes the username if a user's username is javascript. MyBB doesn't even allow this, but if they found a way to change their username to javascript characters and tried to run it past the {username} tag, BAM won't even let this one past.
It passed with flying colors. This thing has full support for HTML for everything except javascript and rogue stuff.
It even sanitizes the username if a user's username is javascript. MyBB doesn't even allow this, but if they found a way to change their username to javascript characters and tried to run it past the {username} tag, BAM won't even let this one past.
It passed with flying colors. This thing has full support for HTML for everything except javascript and rogue stuff.
