Asking God for education, it was cracked_html/css_WEB-ITnose

In the bbs system, the address bar where you leave a message will display a uid=11. Change it to 12 and the user will be changed. Then I found a windowopen method to let it display the address bar but cannot operate it. I think I am smart. Yes, but it was broken yesterday. I copied the address in the address bar, opened a new window, and pasted it. I wiped it, and I was able to enter it and change it. Now I'm looking for a method and additional instructions for the last code. I'm a novice.

Reply to the discussion (solution)

Wait for the master

I don’t understand what you are talking about, just hide it

bbs system Click the "Message" link to open a new window, and then the address in the address bar will have a uid= (an id you log in to). I can change it to the id of another registered user. , (just change the uid number to the ID registered by another user). In order to avoid this situation, I used a window method. The address cannot be changed, but I can copy the address in the address bar and put it in It can be changed on a new website. Please find a way to hide the last uid in the address bar

Isn’t it detailed enough this time? If you still can’t understand, I have no idea
Just I can post pictures

Isn’t it detailed enough this time? If you still can’t understand it, I have no choice
I can only post pictures

Just change it if you want. Use that id as the current user, and use session or cookie to record the current user

http://localhost:8080/Lyblt/jsp/addmessage.jsp?uid=17
This is what I clicked on, I want After leaving a message, the link will be transferred to another user after changing the uid=17 to 16. How can I hide it?

bbs system Click the "Message" link to open a new window, and then The address in the address bar will have a uid= (an id you log in with) at the end. I can change it to the id of another registered user (just change the uid number to the id registered by another user) , in order to avoid this situation, I used a window method. The address cannot be changed, but I can copy the address in the address bar and put it on a new URL, and then it can be changed. Please find a way to change the last address in the address bar. Just hide the uid

You can only leave a message after logging in. Generally, you use a server-side session or an encrypted cookie to verify your identity. This method of yours obviously has many loopholes. .

/jsp/addmessage.jsp?uid=<%=userinfo.getUser_id() %>
This is a hyperlink. How to make the uid of the address bar=<%=userinfo.getUser_id ()%>Hide it and prevent it from being output in the address bar. How should I write it? After answering it, I will close the post.

/jsp/addmessage.jsp?uid=<%=userinfo.getUser_id() %>
This is a hyperlink, how to make the uid=< in the address bar ;%=userinfo.getUser_id()%>Hide it and prevent it from being output in the address bar. How should I write it? After answering it, I will close the post.

Try window.showModalDialog()
Do not display the address bar directly

window.open('a.html','aa','location=no') ;
Or use open and add parameter location=no which will not display the address bar

It is recommended to use the second one
because showModalDialog is not supported at all in chrome37

/jsp/addmessage.jsp?uid=<%=userinfo.getUser_id() %>
This is a hyperlink. How to hide uid=<%=userinfo.getUser_id()%> in the address bar Don't let him output it in the address bar. How should I write it? After answering it, I will close the post.

Does the poster know what session is? If not, go and learn it