BlockyheadmanLvl 12
- Android
SquirrelGuy-5 blackhat moment
SquirrelGuy-5 blackhat moment
Yeah, this update sucks. I hate it really. I'm probably gonna leave code.org to another site because of this. I found out about it during school and now I'm really feeling sad bout' it.
I reached out to Code.org and this is what they said:
We are not currently taking submissions to the featured gallery, but we will eventually allow all students to submit their projects to be featured. Thank you for your patience while we work to get the new gallery fully functional.
It also links this article for more information.
So apparently the plan is to launch the new gallery now, and add a feature for project submissions later. The projects in the gallery will “rotate periodically throughout the year”, and anyone can suggest a project to feature as long as it doesn’t break the Terms of Service.
And naturally, there’s a catch: projects that are featured cannot be edited until they are removed. This means that if you make a really good game and manage to get it featured, you can’t change any of the code, potentially for several months. The only option is to remix, and then of course it’s not featured.
Binary_Coder I looked into it, and the way that they prevent featured projects from being edited is the frozen
property for a project's /v3/channels/ url. Manually setting the frozen
property to true
, obviously, prevents you from editing it, but also shows a "Congratulations, your project is featured" message in the "My Projects" tab.
It makes me wonder if a featured project could be edited if you simply manually disabled the frozen
property after it gets featured...
[WUT] Adam
how are you manually changing the frozen property?
ackvonhuelio You know the object that's returned from https://studio.code.org/v3/channels/channel_id? You can modify that however you like, and even add new properties that go completely unused, and then save that by sending a POST request to the same URL with that modified object as the body of the request.
They most likely removed it because of chats. Tbh, it would've been better if they removed the keyValues()
instead of removing the whole project gallery, since it'll prevent chats while projects still being able to be published. I am working on a project that's pretty big but probably only the gamelab forum gets to see it. And Retro Pong, I had 2.7k visits on that thing and I even promised to make a new ball but they'll probably never get to see it. Without keyValues()
instead of the project gallery, I would've been fine with that.
Why was I given a strike?
[WUT] Adam
huh i guess i'll have to try that out...
wait what's stopping someone from getting rid of the "id" property
bad idea ahead ... or changing the thumbnail of a featured project to nsfw stuff 😱...
ackvonhuelio You can't change the id
property. It automatically resets it to the channel ID.
[WUT] Adam
what about the bad idea
well boys, it was fun while it lasted
DragonFireGames
nuh uh
ackvonhuelio guess i gotta go to khan now
[WUT] Adam Didn't you figure it out once and then proceed to spam the public project list so bad you were called to the office at school to talk about it.
DragonFireGames No, that was figuring out how to report projects programmatically and then doing so on every public project on the site.
I win :D
[WUT] Adam Yep, that's exactly what I was thinking. If publish requests can be hacked then the frozen
property should be changeable as well. And if you can edit a featured project, that means chats are actually still possible. Crazy thing is that I had been using the API a few days ago and noticed the new frozen
property, but didn't think anything of it.
ackvonhuelio Owokoyo explained that thumbnails can be hacked (part 4), but you need an authorization token first. Once that's figured out, both the thumbnail and frozen
property should be changeable.
Binary_Coder It's also possible to just use another project's thumbnail as the thumbnail, and then setting the channel ID in thumbnailUrl
to that project. Here's the easiest way to accomplish that:
thumbnailURL
to the channel ID of the thumbnail project, and then POST it to the server.The "authorization" is really just being logged into the code.org account that owns the project.