Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

user by user id exploit fixed #320

Open
TheCommCraft opened this issue Jan 1, 2025 · 12 comments
Open

user by user id exploit fixed #320

TheCommCraft opened this issue Jan 1, 2025 · 12 comments
Labels
scratch api issue Issues caused by the Scratch API itself, not by the scratchattach library

Comments

@TheCommCraft
Copy link
Collaborator

You can no longer reply to people in comment threads that haven't commented in them. This means that you can no longer use the current method to lookup usernames by user id

@TheCommCraft
Copy link
Collaborator Author

For now, I would deprecate the functionality

TheCommCraft referenced this issue Jan 1, 2025
Signed-off-by: TheCommCraft <[email protected]>
@Fluffyscratch
Copy link

Oh no, this basically kills my newest project TwT

@SpyC0der77
Copy link

What is your newest project?

@TheCommCraft
Copy link
Collaborator Author

maybe user id neighbors?

@Fluffyscratch
Copy link

No, it's a user database kinda like scratchDB but only the part about users. It takes the current number of scratch users, then check each ids until that number, and add the user's datas to the DB. I already coded the whole thing but because of that it's not working :/ But you're right, I also thinked of a user id neighbors finder project while coding it, but I won't make it until this is fixed 😞

@TimMcCool
Copy link
Owner

Oh no, that's sad. It was a useful exploit

@TheCommCraft
Copy link
Collaborator Author

TheCommCraft commented Jan 2, 2025 via email

@FAReTek1
Copy link
Collaborator

FAReTek1 commented Jan 2, 2025

one thing you can fetch with user id alone is the profile picture. that might be a little helpful if only there weren't a ton of people using the default one
e.g. https://uploads.scratch.mit.edu/get_image/user/58743127_60x60.png
the user id is 58743127

or maybe even better: https://uploads.scratch.mit.edu/users/avatars/58743127.png

@Fluffyscratch
Copy link

Oh no, that's sad. It was a useful exploit

I asked Ceebee if a replacement as an official API feature was possible through YAB (Because yes, I'm part of the YAB, allowing me to chat to some ST members). She may or may not respond, but these kind of questions often get an answer. I hope this can help :)

@SpyC0der77
Copy link

No, it's a user database kinda like scratchDB but only the part about users. It takes the current number of scratch users, then check each ids until that number, and add the user's datas to the DB. I already coded the whole thing but because of that it's not working :/ But you're right, I also thinked of a user id neighbors finder project while coding it, but I won't make it until this is fixed 😞

sortof liike https://everyuuid.com/ ??

@TheCommCraft
Copy link
Collaborator Author

TheCommCraft commented Jan 2, 2025

Oh no, that's sad. It was a useful exploit

I asked Ceebee if a replacement as an official API feature was possible through YAB (Because yes, I'm part of the YAB, allowing me to chat to some ST members). She may or may not respond, but these kind of questions often get an answer. I hope this can help :)

What is YAB

Edit: I looked it up

@FAReTek1 FAReTek1 added the scratch api issue Issues caused by the Scratch API itself, not by the scratchattach library label Jan 8, 2025
@TheCommCraft
Copy link
Collaborator Author

Oh no, that's sad. It was a useful exploit

I asked Ceebee if a replacement as an official API feature was possible through YAB (Because yes, I'm part of the YAB, allowing me to chat to some ST members). She may or may not respond, but these kind of questions often get an answer. I hope this can help :)

Did she respond?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
scratch api issue Issues caused by the Scratch API itself, not by the scratchattach library
Projects
None yet
Development

No branches or pull requests

5 participants