raecer
Member
- Messages
- 46
- Points
- 6
This is what is being supplied to indiegala servers when a giveaway is created:
gameid: appid from specific steam store app
gamesid: the serial key
gametitle: "headline" for giveaway (can't usually be changed)
gameimg: link to indiegala game server image (can't usually be changed)
game_steam_url: url to steam game
text: description of giveaway
duration: length of time for giveaway
level_threshold: which level threshold giveaway is (can't usually go above your own level)
A malicious user can change any and all of these inputs. The user below chose to change the gameimage and headline, probably for his own amusement.
Example:
Indiegala should look over the input validation or other security for this or at least remove redundant values. You probably don't need to know both appid and the steam url and you definately don't need to know both appid and the link to a gameimage if you set it up decently.
Since i'm not a bastard, i have not checked what happens if you supply a different steam url and appid. Potentially, depending on how it's set up you could receive the xp from one game, while entirely representing another game. You can be sure people are either already trying or doing this.
At the very least your customers will have a bad experience if you allow things like the link above to happen.
Thats what i think anyway.
gameid: appid from specific steam store app
gamesid: the serial key
gametitle: "headline" for giveaway (can't usually be changed)
gameimg: link to indiegala game server image (can't usually be changed)
game_steam_url: url to steam game
text: description of giveaway
duration: length of time for giveaway
level_threshold: which level threshold giveaway is (can't usually go above your own level)
A malicious user can change any and all of these inputs. The user below chose to change the gameimage and headline, probably for his own amusement.
Example:
Indiegala should look over the input validation or other security for this or at least remove redundant values. You probably don't need to know both appid and the steam url and you definately don't need to know both appid and the link to a gameimage if you set it up decently.
Since i'm not a bastard, i have not checked what happens if you supply a different steam url and appid. Potentially, depending on how it's set up you could receive the xp from one game, while entirely representing another game. You can be sure people are either already trying or doing this.
At the very least your customers will have a bad experience if you allow things like the link above to happen.
Thats what i think anyway.
