[bfwall]

Hi, I created tribute.work out of boredom and need help preserving the forum's legacy. :mouse:

We need to:

* Add more retired members to gallery
* Get more domains ( rip.bf / farewell.bf )
* Take feedback and Improve or whatever

---

[tail]

"The Legacy" LMAO

[nofucksg1ven]

most disliked : kilob and puppy, thanks

"Preserving The Legacy." is crazy tho

[xz9]

i really like the fact you're leaking users ip addresses in the comments api
https://sadsyqmvkgzetphptuol.supabase.co...406b94342a
[{"id":"6a51e45a-562a-4681-9193-8c4bcab20202","member_id":"10521227-d84a-44a7-b9f0-9b406b94342a","content":"Time wasting faggot","user_ip":"162.83.154.79","created_at":"2025-02-10T23:35:22.426555+00:00","likes":[{"count": 0}]}]

[bfwall]

i really like the fact you're leaking users ip addresses in the comments api 
https://sadsyqmvkgzetphptuol.supabase.co...406b94342a
[{"id":"6a51e45a-562a-4681-9193-8c4bcab20202","member_id":"10521227-d84a-44a7-b9f0-9b406b94342a","content":"Time wasting faggot","user_ip":"162.83.154.79","created_at":"2025-02-10T23:35:22.426555+00:00","likes":[{"count": 0}]}]

Talk is cheap.. Send patches.

---

most disliked : kilob and puppy, thanks

"Preserving The Legacy." is crazy tho

I can give you admin access add kilob and puppy memorials

[breacher222]

i really like the fact you're leaking users ip addresses in the comments api 
https://sadsyqmvkgzetphptuol.supabase.co...406b94342a
[{"id":"6a51e45a-562a-4681-9193-8c4bcab20202","member_id":"10521227-d84a-44a7-b9f0-9b406b94342a","content":"Time wasting faggot","user_ip":"162.83.154.79","created_at":"2025-02-10T23:35:22.426555+00:00","likes":[{"count": 0}]}]

LOL  get pwned noooooooob

---

I posted
"How can u make this website so insecure and put it on BF wow . this comment just hacked you"

then I learned

/rest/v1/comment_likes?select=*
SELECT is whats used to displayed rows of data. You can select ALL data (not in a dict/list) by simply writing *. If its inside a list then you must first specificy the list name then add *.
The original request looked like this:
/rest/v1/comment_likes?select=comment_id&user_ip=eq.91.171.219.43

Also the operator EQ can be changed to things like GT (greater than) LT (Less than)

This is all product of usually a GRAPHQL backend. With enough looking you could possibly find his Graphql playground exposed.

The Authorization Header is useless and doesnt make a diference.


Im done looking but yea this is basically a HoneyPOT for any FED that doesnt even own the site since they can look at everyones IPs. You should not have that displayed at the VERY LEAST

[xz9]

i really like the fact you're leaking users ip addresses in the comments api 
https://sadsyqmvkgzetphptuol.supabase.co...406b94342a
[{"id":"6a51e45a-562a-4681-9193-8c4bcab20202","member_id":"10521227-d84a-44a7-b9f0-9b406b94342a","content":"Time wasting faggot","user_ip":"162.83.154.79","created_at":"2025-02-10T23:35:22.426555+00:00","likes":[{"count": 0}]}]

LOL  get pwned noooooooob

supabase apis are retarded lmao literally no authorization is needed