Skip to Content
This question has been flagged
2 Replies
3554 Views
Avatar
Yenthe Van Ginneken (Mainframe Monkey)

Hi everybody

Most of you might have noticed by now some people managed to create a lot of new topics about downloading movies etc.
The interesting part is that they managed to remove a lot of code and insert only the image in to the page.
Questions overview: http://i.imgur.com/3uxdhG2.png
Detail of a topic: http://i.imgur.com/QJG5OjB.png

So the big question now is how can we remove these topics? There is no longer a report / close button for me as they removed that too..
Who should we contact that is responsible for the Odoo forums?
The last thing that I am wondering is.. how secure is Odoo really? This is yet another example of Odoo not being spam proof and being able to modify code in Odoo. This makes me doubt about the Odoo security.

With kind regards
Yenthe

Avatar
Discard
Yenthe Van Ginneken (Mainframe Monkey)
Author

Note: I've send an e-mail to support@odoo.com to report this problem.

Stephen Mack

The best that us ordinary people can do is downvote the spam when we can... that helps a lot if we all do it.

Med Said BARA

Downvoting, even deleting or blocking those users accounts will not solve the problem, cause they will create another free account and do ...what ...

Stephen Mack

solve the problem no, help yes.

Yenthe Van Ginneken (Mainframe Monkey)
Author

You are right Med it will not do a lot. But it will atleast slow them down to make a new account and closing all those topics also removes them from the list! Which keeps our forums quite clean, for now.

Med Said BARA

You are right (Stephen and Yenthe), all we have to do is to continue using our forum as usual.

Stephen Mack

odoo responded. I updated my answer

Avatar
Stephen Mack
Best Answer

UPDATE: (response from lead developer, Olivier)

Here's a summary of what we've (odoo development team) done in the last few days:

  • Deleted 52 users with negative karma, with all their posts and comments (these users have been created by real users manually, from various IPs coming from India, Vietnam, etc., most likely hacked machines).
  • Raised the karma for posting comments on other questions to 50 - new users can only post on their own (threads).
  • Fixed the error 500 when editing posts.
  • Fixed the UI problem when trying to add images (may need browser refresh with shift+f5).
  • Fixed various issues with tags when posting/editing.

The only action that is currently possible for first time users (after verifying their email) is to post new questions.

MY ORIGIONAL ANSWER:

They are using CSS to overlay their code on top of the odoo website.  As for odoo safety?  Microsoft, Unix and Apple have all had major security holes that give people root access to your system.  So far we have graffiti artists gaining access.

I contacted a lead developer and also 24 hour support.  Now it is up to them to prioritize the problem as they see fit.

Personally I prefer to see odoo getting hacked and not free user websites.  This way we can be assured that the problem will get corrected and odoo will be safer for everyone.  The forum software is only beta code 100% of odoo's design and does not have the years of experience in what people can do to break it.  And they sure are breaking it!

Avatar
Discard
Stephen Mack

I found a great plugin for firefox and chrome that allows disabling css: The Web Developer.

Yenthe Van Ginneken (Mainframe Monkey)
Author

Hmm I didn't even think about the CSS overlay. How stupid of me. Thanks for the tool. I'll check this out and any time I see spam showing up I'll close it.

Stephen Mack

No! Not stupid of you, just cleaver of them. I cleaned up about 95% of the forum, still some valid threads that I could not delete the spammers comments. I sent them to odoo support. It took me about two hours and was very very painful. Hope the decide to implement some of my suggestions: https://github.com/odoo/odoo/issues/3460

Stephen Mack

http://chrispederick.com/work/web-developer

Yenthe Van Ginneken (Mainframe Monkey)
Author

Thanks Stephen! What a handy tool... too bad I don't have 1.000 karma then I could delete all these topics and posts too. Good job on cleaning up the forum! +1 for you.

Avatar
Ermin Trevisan
Best Answer

These spammers/hackers are even smart enough to ask the forum how to earn karma: https://www.odoo.com/forum/help-1/question/how-to-earn-karma-69140

Avatar
Discard
Yenthe Van Ginneken (Mainframe Monkey)
Author

Hmm yes I saw this topic.. I could close it but I don't think it matters as he already has gotten the karma sadly..

Med Said BARA

fourgaver6513 is playing ...