721900 - Creative Collective admin tool isn't working + security weirdness

Status: NEW

(Websites :: creative.mozilla.org, defect)

Description

[John Slater]

Hi. The Creative Collective admin tool doesn't seem to be working. I went in there to delete this image - http://creative.mozilla.org/designs/5148 - but nothing happened when I clicked the button to save my changes.

Would be great to get this fixed so it doesn't become completely overrun with spam.

Thanks!

Comment 1

[John Slater]

Copying Chris More, who found the image in the first place and has this to say:

"It looks like someone was trying to screw around by putting code into the form submission. We may want to do a security review on the website to see how it was done."

Comment 2

[Chris More [:cmore]]

You can also see that this user was trying to embed javascript into other submissions: 

http://creative.mozilla.org/people/mariogomes

Comment 3

[John Slater]

Oddly, I was just now able to go in and delete the original image and remove that user's login privileges, so I guess the admin tool works after all.

But, it seems like there might be other foul play afoot, so I'll rename this bug and keep it open.

Comment 4

[John Slater]

A couple of things:
1. The admin tool isn't working again, as noted in comment #0. This is problematic, b/c the front page contains two very inappropriate images that I'm trying to remove.
2. We're still getting examples of people trying to inject code into the site per comment #2. 

At minimum, I need to be able to pull those two images down asap. Please help!

Comment 5

[John Slater]

Attachment: security issue screenshot

Screenshot showing the security issue described in the previous comment. I was actually able to remove this one, but design 5150 still remains (wasn't able to remove that one).

Comment 6

[Chris More [:cmore]]

We are going to redirect the creative collective site to the Firefox brand site for the time being per bug 752589.