Advanced user tutorial

Where is the advanced user tutorial mentioned under badges?

Thank you.
~rob~

solid question. my sites white now

@Kaptenrobert you should have gotten a pm from the bot about how to complete the tutorial or some shit.

Thank you, Phil!

What a player

its even got the logo lmao

I have been made aware of a certain hack. Users, who have not yet completed the tutorial, can get a fraudulent certificate by some trickery.

Note this address: https://namafia.com/discobot/certificate.svg?date=Jul+03+2018&user_id=11
Just replace date and user_id.

Of course, you do not get the badge for doing this.
Credits to nmagane for discovering this hack. His user profile is present in the fraudulent certificate.

.

I feel like that’s an edge case thing that should be fixed but why lol

its made that way so that certificates aren’t handled server-side. discobot/narrative-bot is just a enabled-by-default plugin :slight_smile:

wish i could generate random certificates tho hehe. would be cool to make some for a mafia league.

Well I meant I’m sure the URL could check if user has badge. Or 404 or something ya know.

Your literally passing in the user id can’t you validate it.

yeah we could by forking narrative bot and modifying https://github.com/discourse/discourse/blob/master/plugins/discourse-narrative-bot/plugin.rb#L75 but theres bigger fish to fry like the mafia category functionality.

Yeah it’s not something to worry about. Literally not our problem. I don’t want to patch core.

i want to patch core actually, to get free access to discourse-league (usually 100/y). it would replace the website donator thing spitwad set up haha. the dudes only requirement is contributing to his repo or core once and having proof of the merged pull.

Making pull request against core vs patching it are two different things.



pretty easy to get a minor pull merged here, just gotta write a ruby test and call it a FIX, but im not concerned about it for now anyways because i got other shit lol

autoembed for github should really put the page title in there so you know im linking the PRs page.