syncostories / synco Goto Github PK

const admins can be .pushed to

To Reproduce
Steps to reproduce the behavior:

1. Enter admins.push("somebody") and check out the result

How to test

1. Open Synco and click create story
2. Open console and type in localStorage.name = "<whatever name>"
3. Click create, it will now post with the modified name

How to fix

firebase.auth().onAuthStateChanged(function (user) {
  setInterval(function () {
    if (firebase.auth().currentUser) {
      if (localStorage.name !== user.email.replace("@fakeemail.com", "")) {
        signout()
      }
    }
  }, 100)
})

@TelOfLolth and @prealge This is a major security issue, place this code at Line 20 of db.js

You are using a <tag> HTML tag for your stories tags. You should be using <span>, <i>,<div> or another non-custom tag. Only use a custom tag if no other solution exists (e.g. TIAPP files <ticon> tags, used for icon class and meant to be fake). If there is a specific reason (like the one above) for this, close and comment this issue!

I noticed, @prealge , that the box for Apocalypse has disappeared. I can see in db.js that it looks like you tried to set up a sysem where it displays the stories from the DataBase, but this obviously doesn't work right now. Also, could you give me access to the FireBase.

Thanks,
@coffee-media

What are the JSON security rules for Synco? (The Rules tab on the DB)

You can't create new stories anymore. I see no error in the code, but obviously, it's either that or something with Firebase.

When you type in an already published story, it automatically sets the cursor to the start It might have something to do with the following code.

document.getElementById("story-text-area").onkeyup = saveStory;

Implementing a New Icon System
Hey, @prealge, I think it might be time to start using a new icon database. One that is already out there. Our current one, the one that you made, is fine and all, but either we're going to need to seriously update it, or we should consider my suggestion.

From,
@TelOfLolth