Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Newsboard – A Hacker News Clone

newsboard.robdelacruz.com

Post reply on HN
Print view View original

1–10 of 19 posts

Re: Show HN: Newsboard – A Hacker News Clone

#5

Post by DarthGhandi »

iKevinShah wrote: post #3
freetonik wrote: post #2

Looks neat and tidy. Is it open source?

The first link on the demo is this - https://github.com/robdelacruz/newsboard Seems like the source > newsboard - a bulletin board and bookmark sharing site (inspired by HackerNews)

It looks like it's using this hugo theme but I may be wrong.

https://themes.gohugo.io/hugonews/

Re: Show HN: Newsboard – A Hacker News Clone

#8

Post by jenoer »

@robdelacruz: I have a few security-related findings for you that you might want to take a look at:

- I can inject any JavaScript in Titles, Tags and possibly other locations.

- By manually changing the value of the `userid` cookie, I can log in as any user ("1" for admin). This also allows me to access the admin section of the website.

- It's highly recommended to enable "HttpOnly" for session cookies. (Secure and SameSite should also be more strict if the application allows it)

Other remarks:

- There should be a limit on the length of submission titles, these are close to infinite it seems.

Edit: It seems others are completely defacing the board by using these tricks. I just want you to know that it's not me.

Post reply on HN