GetManialinks

Trackmania Forever public API and its open source PHP SDK.

Moderator: NADEO

Post Reply
User avatar
w1lla
Posts: 2377
Joined: 15 Jun 2010, 11:09
Location: Netherlands
Contact:

GetManialinks

Post by w1lla » 07 May 2011, 21:22

Hi,

Im testing each feature of the web services but there might be a huge flaw inside the get($code) of getting manialinks.

This is a way for hackers to get data from other manialinks.

A good example is the manialink of intr and oliverde8.

If i follow the link of intr it will only show me code from manialib and the manialink from oliverde8 will show me an default xml message but by showing the source code i can completely "copy" his her manialink.

I think it is not right to show a manialink's url only to the respective owner.
TM² Info
SM Info
QM Info

OS: Windows 10 x64 Professional
MB: MSI 970A-G46
Processor: AMD FX-6300 3500 mHz
RAM Memory: 16 GB DDR3
Video: SAPPHIRE DUAL-X R9 280X 3GB GDDR5
KB: Logitech G510s
Mouse: Logitech G300s
Mode Creation
ManiaScript Docs

User avatar
farfa
Nadeo
Nadeo
Posts: 601
Joined: 14 Jun 2010, 16:15
Location: In front of your hood with one lap late

Re: GetManialinks

Post by farfa » 08 May 2011, 06:21

This feature is already public ;)
But for your manialinks a tip is better, look to the User-Agent, and display nothing if the User-Agent is not GameBox
Also known as: satanasdiabolo

User avatar
fastforza
Posts: 859
Joined: 15 Jun 2010, 11:19
Contact:

Re: GetManialinks

Post by fastforza » 09 May 2011, 10:13

On a side note (with what Farfa said), you can still bypass the User-Agent with the User Agent firefox plugin. Install it, add a new agent; call it GameBox and you're good to go. And I just did this with the ManiaLib demo. :lol:

It would be nice if the URL was removed, but don't forget there are also manialinks which use absolute URL's by design.
Mania Exchange - Share your maps!

ASUS Maximus IV GENE Z / i7 2600K 3.40Ghz QC / 16GB G.Skill Ripjaws DDR3 / GTX 560 Ti

Need technical help for ManiaPlanet? Click here. :)

User avatar
gouxim
Nadeo
Nadeo
Posts: 1188
Joined: 14 Jun 2010, 17:20

Re: GetManialinks

Post by gouxim » 09 May 2011, 10:19

There's no point in removing the URL because it's already public. The user-agent stuff is more for user-friendly-ness than security, since there's no security whatsoever : just like you can get the HTML code of a webpage, you can get the XML code of a Manialink page.
Please do not PM for support. Instead, create a thread so that everyone can contribute or benefit from the answer! 8-)

User avatar
fastforza
Posts: 859
Joined: 15 Jun 2010, 11:19
Contact:

Re: GetManialinks

Post by fastforza » 09 May 2011, 10:20

Fair point, alrighty then. ;)
Mania Exchange - Share your maps!

ASUS Maximus IV GENE Z / i7 2600K 3.40Ghz QC / 16GB G.Skill Ripjaws DDR3 / GTX 560 Ti

Need technical help for ManiaPlanet? Click here. :)

User avatar
w1lla
Posts: 2377
Joined: 15 Jun 2010, 11:09
Location: Netherlands
Contact:

Re: GetManialinks

Post by w1lla » 09 May 2011, 10:22

Well or designers make a reroute just like it's done in manialib when other people are trying to acces the url.
TM² Info
SM Info
QM Info

OS: Windows 10 x64 Professional
MB: MSI 970A-G46
Processor: AMD FX-6300 3500 mHz
RAM Memory: 16 GB DDR3
Video: SAPPHIRE DUAL-X R9 280X 3GB GDDR5
KB: Logitech G510s
Mouse: Logitech G300s
Mode Creation
ManiaScript Docs

User avatar
gouxim
Nadeo
Nadeo
Posts: 1188
Joined: 14 Jun 2010, 17:20

Re: GetManialinks

Post by gouxim » 09 May 2011, 10:37

w1lla wrote:Well or designers make a reroute just like it's done in manialib when other people are trying to acces the url.
In ManiaLib, we do User-Agent based check to redirect the user that uses a browser:

http://code.google.com/p/manialib/sourc ... ck.php#120 (line 120).

But this was done more for user-friendlyness (if you type the URL in your browser you have a page with a TMTP link instead of a weird XML page) than for security (because there's nno security).

Even with that you can easily get the XML code of a page if you do a request with a overriden user-agent, with simple tools such as https://chrome.google.com/webstore/deta ... bgofnpcjmb
Please do not PM for support. Instead, create a thread so that everyone can contribute or benefit from the answer! 8-)

User avatar
destroflyer
Posts: 124
Joined: 16 Jun 2010, 22:17
Contact:

Re: GetManialinks

Post by destroflyer » 09 May 2011, 16:30

I've just seen this, too... Maybe you could allow only a few users access to the URLs?
Because I'm sure, this would ruin all manialinks with costs - It would be a five-minute-work to create a script that downloads all maniacode-stuff for free...
(Example: http://www.mania-community.de/showthrea ... #post18644)

I don't know, if this is a good idea - But if it's already public, there's no other way...

User avatar
gouxim
Nadeo
Nadeo
Posts: 1188
Joined: 14 Jun 2010, 17:20

Re: GetManialinks

Post by gouxim » 09 May 2011, 17:09

gouxim wrote:There's no point in removing the URL because it's already public. The user-agent stuff is more for user-friendly-ness than security, since there's no security whatsoever : just like you can get the HTML code of a webpage, you can get the XML code of a Manialink page.
Please do not PM for support. Instead, create a thread so that everyone can contribute or benefit from the answer! 8-)

Post Reply

Return to “Trackmania Forever Web Services”

Who is online

Users browsing this forum: No registered users and 1 guest