Because Spain won, jQuery: Novice to Ninja is free for 24 hours
31–40 of 70 posts
Re: Because Spain won, jQuery: Novice to Ninja is free for 24 hours
#32Re: Because Spain won, jQuery: Novice to Ninja is free for 24 hours
#33Re: Because Spain won, jQuery: Novice to Ninja is free for 24 hours
#34I gave them my email with a plus sign in it, and I was surprised that the web form accepted it and I got the email. However, clicking on the link they emailed me, which had my email (and therefore the plus sign) in the url, broke their site and just sent me back to TFA. Nice bugs guys.
Re: Because Spain won, jQuery: Novice to Ninja is free for 24 hours
#35Re: Because Spain won, jQuery: Novice to Ninja is free for 24 hours
#36Re: Because Spain won, jQuery: Novice to Ninja is free for 24 hours
#37Re: Because Spain won, jQuery: Novice to Ninja is free for 24 hours
#38Re: Because Spain won, jQuery: Novice to Ninja is free for 24 hours
#39The email address you enter won't matter. Just put in any valid email address you want and then visit http://sale.sitepoint.com/claimpdf.php?email= with the email address you entered appended to the end.
In that vein, http://sale.sitepoint.com/claimpdf.php?email=foo%40bar.com is now a direct download link :)
Re: Because Spain won, jQuery: Novice to Ninja is free for 24 hours
#40Interesting book, I just wish it didn't use the .html() function that much, especially the .html(externalInput) pattern - it's a great way to open XSS (cross-site scripting) vulnerabilities on your page unless you're very careful and the author apparently doesn't warn the reader to be careful.
For my product, I have a web app that does 100% of the rendering in Javascript so I use html() a lot. I adhere by the rule that I don't trust anything that comes from the client so I'm curious to learn what the security problem may be.
Thanks.