Holy shit, code.org is fucked for good

SquirrelGuy-5 blackhat moment

I reached out to Code.org and this is what they said:

We are not currently taking submissions to the featured gallery, but we will eventually allow all students to submit their projects to be featured. Thank you for your patience while we work to get the new gallery fully functional.

It also links this article for more information.

So apparently the plan is to launch the new gallery now, and add a feature for project submissions later. The projects in the gallery will “rotate periodically throughout the year”, and anyone can suggest a project to feature as long as it doesn’t break the Terms of Service.

And naturally, there’s a catch: projects that are featured cannot be edited until they are removed. This means that if you make a really good game and manage to get it featured, you can’t change any of the code, potentially for several months. The only option is to remix, and then of course it’s not featured.

Binary_Coder I looked into it, and the way that they prevent featured projects from being edited is the frozen property for a project's /v3/channels/ url. Manually setting the frozen property to true, obviously, prevents you from editing it, but also shows a "Congratulations, your project is featured" message in the "My Projects" tab.

It makes me wonder if a featured project could be edited if you simply manually disabled the frozen property after it gets featured...

ackvonhuelio You know the object that's returned from https://studio.code.org/v3/channels/channel_id? You can modify that however you like, and even add new properties that go completely unused, and then save that by sending a POST request to the same URL with that modified object as the body of the request.

They most likely removed it because of chats. Tbh, it would've been better if they removed the keyValues() instead of removing the whole project gallery, since it'll prevent chats while projects still being able to be published. I am working on a project that's pretty big but probably only the gamelab forum gets to see it. And Retro Pong, I had 2.7k visits on that thing and I even promised to make a new ball but they'll probably never get to see it. Without keyValues() instead of the project gallery, I would've been fine with that.

Why was I given a strike?

seek spamming i think

But hey everyone, if you want to see projects before the incident, just use magical "WayBack Machine"

ackvonhuelio You can't change the id property. It automatically resets it to the channel ID.

[WUT] Adam
what about the bad idea

well boys, it was fun while it lasted

DragonFireGames
nuh uh

ackvonhuelio guess i gotta go to khan now

[WUT] Adam Didn't you figure it out once and then proceed to spam the public project list so bad you were called to the office at school to talk about it.

DragonFireGames No, that was figuring out how to report projects programmatically and then doing so on every public project on the site.

I win :D

[WUT] Adam Yep, that's exactly what I was thinking. If publish requests can be hacked then the frozen property should be changeable as well. And if you can edit a featured project, that means chats are actually still possible. Crazy thing is that I had been using the API a few days ago and noticed the new frozen property, but didn't think anything of it.

ackvonhuelio Owokoyo explained that thumbnails can be hacked (part 4), but you need an authorization token first. Once that's figured out, both the thumbnail and frozen property should be changeable.