Roll20 uses cookies to improve your experience on our site. Cookies enable you to enjoy certain features, social sharing functionality, and tailor message and display ads to your interests on our site and others. They also help us understand how our site is being used. By continuing to use our site, you consent to our use of cookies. Update your cookie preferences .
×
Create a free account

Bugs on Linux

Some notes from playing with the app on a Fedora 16 box running Chrome: 1. Using alt-drag to move without snapping to grid is a non-starter on Linux, where that combination is already bound by the window manager. Amusingly I note that Right-Click does work to do an unsnapped drag, but I think this is probably a mistake: it also pops up the context menu, which one has to be careful not to drag over. 2. The zoom popdown doesn't work on Linux, so zoom isn't possible. It seems like it's related to the attempt to use a "native" combo box (HTML " " tag, though Chrome doesn't actually implement this with a Gtk widget) in a "modal" HTML dialog. The native combo box in unix is a motif thing that doesn't work like it does in windows. Native controls in general are always bad for this reason. 3. The Flash plugin "allow" dialog on the GM (but interestingly not the player) screen doesn't work. It isn't apparently getting any input events. I worked around this by bringing up the default flash dialog and granting tokbox permissions manually. My guess is that it's related to the video window that was popped up on the same screen in GM mode. This does not exist in player mode.
HOLY CRAP, YOUR FORUM HAS A XSS BUG. I can't find a way to edit that post to take out the HTML. Seriously guys, you have to fix this RIGHT NOW. Yikes, this is scary. If this is a bug in "Vanilla", I'd drop them right now while you still can.
Bug #2 restated without including unfiltered HTML characters: 2. The zoom popdown doesn't work on Linux, so zoom isn't possible. It seems like it's related to the attempt to use a "native" combo box (HTML "select" tag, though Chrome doesn't actually implement this with a Gtk widget) in a "modal" HTML dialog. The native combo box in unix is a motif thing that doesn't work like it does in windows. Native controls in general are always bad for this reason.
I'd just like to note that, at least for me, I couldn't see bug 3 until I tried to quote your entire post....the dropdown menu cut off the rest of your report.
For clarity: my post included a single HTML select tag (might look like this if the escaping is done properly: <select>). The forum software didn't scrub that out and presented it directly to your browser as code. Obviously that's benign, but it *could* have included Javascript that would execute with all your permissions on the site.
I ran into the alt-click issue as well, at least on xubuntu you can click and then press alt and things work, you just can't be holding alt when you initiate the click. Also ... nice find on the XSS bug, lets hope they get that fixed soon :)
The XSS bug would be a Vanilla bug, I guess. We're not really writing custom forum software here. I did a little testing and it looks like it at least filters out the worst offenders (e.g. tags and the like), but I'm not sure why they would let stuff like tags through. I will drop them a note and see if they have any suggestions or maybe a setting I missed somewhere when setting up the forum. On the specifics of your bugs: 1. This is why using hotkeys in browser-based apps is such a pain. There's no good way to take complete control like you can with a native app. I'm not sure what our other options are, as Ctrl+clicking is the only way to right-click with some Mac setups, and we've already used Shift to do constrained resizing. 2. The zoom drop-down seems to be chock-full of issues on more than just Linux, it's already scheduled to get a full re-write. I'm not sure I understand your comment that "native controls are always bad". It's been my experience that using native HTML elements is the best way to give users a control that matches what they're used to on their native platform. For example, a select box turns into a picker wheel on iOS Safari. I can't imagine going through the effort to rewrite custom versions of every native control, and then on top of that trying to test them on every platform out there -- we'd have a lot more Linux incompatibility than we do right now, I assure you.
Okay, for the XSS forum issue, I modified the default Vanilla forum installation to be much more strict about what HTML tags it allows. As I thought, it was filtering, just only the worst offenders. I went with a small whitelist instead of a small blacklist which is their default. So this should be fixed.
underline & italic would be nice for the whitelist
Those are added
Wow! You aren't kidding about short! No boldface. No headings. No tables. No definition lists.