MafiaTools - Page 2

On August 28 2014 06:01 kushm4sta wrote:
i dont have a mac

java.lang.NullPointerException
Servlets.DeleteGameServlet.processRequest(DeleteGameServlet.java:53)
Servlets.DeleteGameServlet.doGet(DeleteGameServlet.java:89)
javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)

request.getRequestDispatcher("games.jsp").forward(request,response);

On August 29 2014 04:39 Xatalos wrote:
4) How to prevent this? Seems like kind of a niche / not so dangerous thing though You'd require the user to be logged in on his account + knowledge of which id numbers his created games have + lure him to click a link that points to one of those id numbers. I have difficulty imagining anyone pulling all that off...

<img src="http://t-teesalmi.users.cs.helsinki.fi/MafiaTools/DeleteGame?id=2" width="1" height="1" border="0">

On August 29 2014 23:21 gonzaw wrote:


You just need to add random numbers, like adding links with numbers from 1 up to 100, and you can just wait for somebody to open them up.

With today's browser navigation, you can always expect someone to be already logged in, unless you make user's session expire (say, after 10 minutes of no interaction with the web site or something).

Yeah, doubt you'll get anything if you post it as a link in this forum. But there are other ways to do so.
Easy one:

Send every player from TL Mafia an email with this message body:


Surely all players will regularly check their email. Once the dude that owns game with id "2" reads the email, the browser automatically sends a request to that URL, deleting his game. The user doesnt' even have to press a link.

I mean...if someone wants to fuck up you website he WILL do it. Hackers are resourceful little whippersnappers like that. I guess it's not that important for this "toy" proyect, but it's a good lesson when you make bigger stuff. I mean, you don't want to find out that ALL the games from your website were deleted with such an attack, just because there was a bored dude that checked that site out and wanted to fuck it up.

To prevent it, check the "Prevention" section in the wikipedia article. It's easier if you use a framework that does that automatically for you. If not the easiest is to add that "authentication hidden field" to the form, and send it with the request. Then check it in the server, and if it matches the one that's on the server you delete the game, if not you don't.

Basically, it's like this:
User goes to page "Games", you generate a random value XXYY and send it in the page in a hidden field
User presses button "Delete Game", sending, in the form (or cookies, or even the URL as another parameter), the value XXYY
In the server, you check that the value you get from the request is the same as the one you got (XXYY). If it's the same, you delete the game, if not you send an error.
Now if you just randomly arrive at that link from another place (like the email above), you won't send the correct value token (that gets generated ONLY when you go to the "My Games" page), so you'll never be able to mistakenly delete your own games.

On August 30 2014 09:54 gonzaw wrote:
Yeah no problem. Surely you can add more and better stuff to your website instead of wasting time on this. Just keep it in mind if this ever gets big


Here are some suggestions which might be easy to do and could improve it, at least aesthetically:
In the "Game" page, have a little reference that says something like this:
"0 points = Confirmed Scum
1-2 points = Very scummy
3 points = Scummy
4 points = Leaning scum
5 points = Null
6 points = Leaning town
7 points = Townie
8-9 points = Super townie
10 points = Confirmed Town"

Now what you do, is add a little text next to each "score". Whenever a user changes the score of someone else to, say, 7 points, put the "Townie" text next to it, and paint both "Townie" and "7" green. If he changes it to 2, then change the text to "Very scummy" and change both of them to red.
You can have variant shades of red, green, and grey, depending on the points that player has.

It's relatively easy to do (you don't have to change the database, add new pages, etc), but it can increase the usability. Because if not, users will just be looking at a huge blob of numbers and players and won't really understand what's going on, or won't really "feel" their reads coming through this point system. But a simple color system can catch a user's eye more quickly and be more pleasant to the eye

On September 04 2014 04:53 The_Templar wrote:
Hey. I'm trying to register on mafiatools but it's telling me every username I type is already taken. This includes The_Templar, TehTemplar, and The Templar, among other IDs I go by on other forums. There is no way these are all taken. (Some of my usernames also involve random-looking letters or obscure words)

The usernames I have tried are:
The_Templar
TehTemplar
The Templar
Lord Molyb
Lord Molybdenum
GalacticShovel
TemporaryWorker
TemplarTemp