Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

4chan source code leaked (2010)

pastebin.com

Post reply on HN
Print view View original

21–30 of 114 posts

Re: 4chan source code leaked (2010)

#21

Post by linuxydave »

phpnode wrote: post #9
Villodre wrote: post #3

It seems that it's too terrible to be the true code. "if($_COOKIE['4chan_auser']", "extract($_POST); extract($_GET); extract($_COOKIE);"

this makes it even more likely that it's the real code. Let's face it, no one is expecting a shining example of software design and architectural brilliance here

The original 4chan code was in Japanese and moot used Babelfish to try figure out what did what. From what I remember, the original Futaba code is just as bad (http://www.2chan.net/script/). It's no secret that 4chan is cobbled together with glue and string, moot has said this several times before.

Re: 4chan source code leaked (2010)

#22

Post by spoiler »

mandalar12 wrote: post #14
NewsReader42 wrote: post #6

if(isset($_COOKIE['4chan_auser'])&&isset($_COOKIE['4chan_apass'])){ $user = mysql_real_escape_string($_COOKIE['4chan_auser']); $pass = mysql_real_escape_string($_COOKIE['4chan_apass']); } HAHAHAHAAHAHAHAHAA Steal a cookie, gain access.. WTF

Does it mean that the password is stored in the cookie or I am missing something ?

It's probably a hashed version. It would be horrendous if it was actually stored in plain text.

Re: 4chan source code leaked (2010)

#24

Post by odonnellryan »

kawsper wrote: post #15
NewsReader42 wrote: post #6

if(isset($_COOKIE['4chan_auser'])&&isset($_COOKIE['4chan_apass'])){ $user = mysql_real_escape_string($_COOKIE['4chan_auser']); $pass = mysql_real_escape_string($_COOKIE['4chan_apass']); } HAHAHAHAAHAHAHAHAA Steal a cookie, gain access.. WTF

Aren't you able to hijack sessions on most webpages if you stole session cookies?

The real problem is: "extract($_POST); extract($_GET); extract($_COOKIE);"

For more information on extract: http://www.php.net/extract

Re: 4chan source code leaked (2010)

#25

Post by tluyben2 »

ledneb wrote: post #11
spoiler wrote: post #5

Earlier quoted context omitted.

> It seems that it's too terrible to be the true code. 1. It's written in PHP. Finding a good PHP developer is nigh impossible (there are exceptions, like always). 2. I expected worse, to be honest.

No serious, modern PHP developer writes code like this. If it were a code sample for any respectable PHP job, it would be a massive "do not hire" flag.

I think you live in Lala land. I too hope this, but it's wishful thinking; by far most I encounter in the wild write like this and worse (this actually works for instance).

Re: 4chan source code leaked (2010)

#26

Post by MichaelGG »

Villodre wrote: post #3

It seems that it's too terrible to be the true code. "if($_COOKIE['4chan_auser']", "extract($_POST); extract($_GET); extract($_COOKIE);"

What's wrong with the if cookie check? Don't the following conditionals for the mode make sure they still cannot post, which is the point? And the rest of the code is still run so any other security checks are still performed.

extract is one of those moronic things though that only exists to create security holes and other bugs.

Re: 4chan source code leaked (2010)

#27

Post by pearjuice »

This is not leaked recently but spread today which caused people to believe it was looted during the 4chan hack earlier today. The 4chan administration has been awkwardly silenced about the compromised 4chan website, but this isn't one of the reasons.

http://9ch.in/overscript/ http://9ch.in/overscript/files/yotsuba.txt

Post reply on HN