Security hole found on locklegion.com - fixed

Today I realised that there was a huge security hole on locklegion.com. Not a coding-wise security hole, but a general hole. You see, I let people host almost any type of file on their LockStorage account. This includes html pages. Now, I'm sure you know cookies usually have a defined domain name and path. Since the locklegion.com forums are on the root path, I can't exactly restrict the cookie to be only on the root path. Now the problem is that LockStorage files were hosted on the same domain name (www)! A quick test with an html page showed that it was extremely easy to grab anybody's cookie! All you had to do was create a "malicious" html page, and get someone who has chosen to be remembered by the forum to view the page, and BAM! You had their cookie!

I resolved this issue by messing with Apache's very powerful mod_rewrite. I set up virtual subdomains for people with LockStorage accounts. You used to be able to access a file using something like www.locklegion.com/lockstorage/trashlock/somefile.html, now the (better) way to access it is like so: trashlock.locklegion.com/somefile.html. This obviously is easier to remember, and it's not on the same subdomain, so cookies don't get sent there! Awesome! I've made it so Apache redirects any "old" attempts to grab a file, just to make sure.

If you allow people to host Flash, or HTML on your server, be extremely careful! Put them on a seperate domain name or subdomain! People will be able to grab your cookies. It's a fact.

Hey look! It's a fucking UPDATE!

Heh. I know you all hate me, I know nobody visits this damn thing, and I know people think this is just another one of those abandonblogs. Well, you are mistaken, because here is an update! Wow! A rather big update in fact.

First of all: No, I still haven't done jack shit on the project (code-wise). All I've done so far is lay out tons and tons of ideas in my head. I do love planning ahead. I haven't started coding this because I was (wrongly) focused on ArtChat, and school. I've got 4 tests on Tuesday, in case anyone cares.

Now, there are a few things I'd like to explain:

• First and foremost, I've changed my mind about the scope of this project. I sort of feel like making this an open-source and public project. That's right, I want people to look at the code and just try to find an exploit. I also might've gotten a partner: LimonLock. At first I thought he was just a script kiddie, but damn was I wrong. He seems like a great coder, and he understands my coding standards :') . I am really glad that I'll be able to get help on this.
• As I've said, I want this forum software to be completely modular. I've thought of something that I think has never been done before in the world of PHP: an actual "plug-in" system that doesn't require modification of the actual source code of the software. I was thinking of making this an event-based system. For example, when a post is made, an onPost event is dispatched to all installed plug-ins. The plug-in can then do whatever it wants with the data sent to it. Plug-ins will also be able to overwrite methods.
• I'm going to try to save as much time as I can coding this forum software. I, like a lot of other programmers, hate coding HTML forms. I hate this shit because it's so repetitive, boring and you keep forgetting shit. This is why the templating system will come "bundled" with a Form Generator, and a complex one at that. Forms will be able to have Web 2.0 - style tabs and various pages. This will all be easily doable with a simple method-based form builder. Example:
  
  $myForm = new Form();
  $myForm->Page1 = $myForm->createPage();
  $myForm->Page1->addField(TEXT, 'UserName', $userData->UserName);
  
  
  Hopefully you will have understood that this would create a new form with a text field named "UserName" with adefault value of the UserName of the current logged in person. Well you sort of get the point. Making forms is going to be easy.
• The administration panel will be a bit Web 2.0. You might know my friend ArmLock, or theDrunkMonkey, or ABoxInABox, or anything you remember him as. He's developping Olympus, and he uses a great trick to have a constant set of buttons and other stuff at the top of the page, without using frames! I hate frames, and I am probably going to use a technique of the sort to make the administration panel.
• I am not sure about this, but I was thinking of letting the admin truely customize the forum from the admin panel. For example you could easily add a new field to a user's profile, instead of having to go in the code or developp a new plugin just for a field. You'd be able to set where the field shows, wether it is user-modifiable or not, wether it's a numeric, etc, etc.
  

And that's pretty much all I can think of right now. I usually get more ideas before I fall asleep, but I just can't remember them as I'm typing this.

Please post comments of actual quality, not just mindless blabber or insults.