- 18 Jun, 2017 1 commit
-
-
Lester Chan authored
-
- 06 Jun, 2017 1 commit
-
-
Lester Chan authored
-
- 01 Jun, 2017 1 commit
-
-
Lester Chan authored
-
- 27 May, 2017 1 commit
-
-
Lester Chan authored
-
- 26 May, 2017 2 commits
-
-
Lester Chan authored
-
Lester Chan authored
-
- 25 May, 2017 2 commits
-
-
Lester Chan authored
-
Lester Chan authored
-
- 11 May, 2017 2 commits
-
-
Lester Chan authored
-
Lester Chan authored
-
- 24 Apr, 2017 1 commit
-
-
Lester Chan authored
-
- 31 Mar, 2017 6 commits
-
-
Lester Chan authored
-
Lester Chan authored
-
Lester Chan authored
-
Lester Chan authored
-
Lester Chan authored
-
Lester Chan authored
-
- 15 Mar, 2017 1 commit
-
-
Lester Chan authored
Update wp-polls.php
-
- 14 Mar, 2017 1 commit
-
-
Steve Bruner authored
Allow filtering of the poll results markup.
-
- 12 Mar, 2017 1 commit
-
-
Lester Chan authored
-
- 09 Mar, 2017 1 commit
-
-
Lester Chan authored
-
- 31 Jan, 2017 2 commits
-
-
Lester Chan authored
-
Lester Chan authored
Fix percentage calculation error
-
- 19 Jan, 2017 1 commit
-
-
Lester Chan authored
-
- 18 Jan, 2017 1 commit
-
-
Lester Chan authored
-
- 08 Dec, 2016 1 commit
-
-
Lester Chan authored
-
- 19 Oct, 2016 4 commits
-
-
Lester Chan authored
-
Lester Chan authored
preventing cross site voting & validating answers [Updated]
-
Monroe Clinton authored
-
Monroe Clinton authored
There is a current flaw in wp-polls that allows people to embed the following into a page: http://example.com/wp-admin/admin-ajax.php?action=polls&view=process&poll_id=POLLID&poll_POLLID=ANSWER&poll_POLLID_nonce=POLLNONCE This allows exploiters to get votes from people who have not even visited the WordPress site. I exploited this on a WordPress site, and got 318k votes by embedding the link into various forum signatures. However, since the poll answer is a GET variable, the actual answers went to 0%. It is because the votes were not counted as answers, but still added to the total votes. I added an if statement that checks if the poll answer is legitimate. This prevents fraudulent answers, and cross site voting.
-
- 18 Oct, 2016 1 commit
-
-
Monroe Clinton authored
There is a current flaw in wp-polls that allows people to embed the following into a page: http://example.com/wp-admin/admin-ajax.php?action=polls&view=process&poll_id=POLLID&poll_POLLID=ANSWER&poll_POLLID_nonce=POLLNONCE This allows exploiters to get votes from people who have not even visited the WordPress site. I exploited this on a WordPress site, and got 318k votes by embedding the link into various forum signatures. However, since the poll answer is a GET variable, the actual answers went to 0%. It is because the votes were not counted as answers, but still added to the total votes. I added an if statement that checks if the poll answer is legitimate. This prevents fraudulent answers, and cross site voting.
-
- 30 Aug, 2016 1 commit
-
-
Lester Chan authored
-
- 12 Jul, 2016 1 commit
-
-
Vincent Liou authored
Fix percentage calculation error when multiple choices is allowed.
-
- 29 Jun, 2016 4 commits
- 08 Jun, 2016 1 commit
-
-
Lester authored
-
- 17 Apr, 2016 2 commits
-
-
Lester Chan authored
-
Lester Chan authored
-