3 ms·

A possible security concern is that this can store arbitrary HTML, including script. http://kvak.io/?n=f9f2o1r2pd64 http://kvak.io/?n=f9f2o1r2pd64

• natpalmer1776 6y ago
  Ironic how you posted a note without a password so anyone immature enough (me) could just tamper with your example.
  • andrewla 6y ago
    That breaks the visitor counter, since it relied on updating the underlying document to update the counts! I was going to go ahead and hide the lock button entirely to avoid this attack, but decided I would get some work done today instead. EDIT: after a bit more hacking, I removed the password and hid the lock button. Nothing that would stop a determined adversary :) (Also, I kept the Khajit change in your honor)
    • levmiseri 6y ago
      Great. Thanks! Fix for this incoming. I don't want to limit HTML insertion in general, but I'll make sure scripts are not possible.