Show HN: Profile.io - Profiles for Developers

Re:Show HN: Profile.io - Profiles for Developers by dannyr on Friday March 11, 2011 @07:38PM (#2315542)

Fixed. Let me know if we missed anything.

I wish we could use Django's autoescape filter but App Engine's SDK ships with just 0.96 by default.

We can only upgrade to a later version of Django in Prod and not locally.

[ Parent | on HN ]

Re:Show HN: Profile.io - Profiles for Developers by StavrosK on Saturday March 12, 2011 @05:50AM (#2316586)

You really need to use Django-nonrel, it's at 1.3b and awesome. I use it for http://www.yourpane.com and it works fantastically well.

[ Parent | on HN ]

Re:Show HN: Profile.io - Profiles for Developers by Xk on Friday March 11, 2011 @07:42PM (#2315555)

Usernames aren't sanitized yet. (As is visible with the '<asdf' in the 'foobar' link above.)

EG: http://profile.io/xss2

[ Parent | on HN ]

Re:Show HN: Profile.io - Profiles for Developers by qeorge on Friday March 11, 2011 @09:37PM (#2315789)

Also, you missed the login form (both in the header and on http://profile.io/login). Its echoing the username directly, e.g., "Username <script>alert(1)</script> was not found"

[ Parent | on HN ]