you are welcome… will be considered in future as nice upgrade (or new plugin)…

Apparently a user has figured out how to make it look like someone thanked him, so he has been creative in what the thank says.  Is there a way to stop this?

stop what??  details would be nice…

Mr Papa said
stop what??  details would be nice…

He was able to thank himself and edit what’s inside the thank. 

You will have to explain that one too me… 

First users cannot thank themselves… just tested to be sure…

Second, the thank text is not part of the post and thus cannot be edited…  its only added at display time…

so do you have an example of this?

okay, I can see a way you could ‘hack’ the javascript code and trick it into thanking itself (the js is local client so no server risk)… 

but still not sure I see a way to accomplish changing the thanks text… so example would still be nice…

Mr Papa said
okay, I can see a way you could ‘hack’ the javascript code and trick it into thanking itself (the js is local client so no server risk)… 

but still not sure I see a way to accomplish changing the thanks text… so example would still be nice…

I just sent you a PM with a screenshot.  

lol… that is not a thanks…  the user simply copy the html for a thanks, pasted it into a post and saved…  you can verify that by checking the actual post content (either edit the post or look in the database)…   I dont believe the post thanks plugin was not used to create that…  and so he didnt hack the js either… but interestingly enough, I was able to replicate such an action, so will put out an update after some testing of the fix… but wont help users doing creative posts…

nothing we can do about that since a user can make up whatever post content they want…  up to moderators to check the content…  or moderate his posts…  you could use the warnings and suspensions plugin to deal with unruly…

Mr Papa said
lol… that is not a thanks…  the user simply copy the html for a thanks, pasted it into a post and saved…  you can verify that by checking the actual post content (either edit the post or look in the database)…   I dont believe the post thanks plugin was not used to create that…  and so he didnt hack the js either… but interestingly enough, I was able to replicate such an action, so will put out an update after some testing of the fix… but wont help users doing creative posts…

nothing we can do about that since a user can make up whatever post content they want…  up to moderators to check the content…  or moderate his posts…  you could use the warnings and suspensions plugin to deal with unruly…

Honestly, it doesn’t bother me.  It looks just like the Thanks, except for the text.  I just wanted to make sure that someone can’t backdoor…

Here’s the code used when I checked the edit:

<div class="spThanksList">The following users say thank you to Pakoon for this useful post:
<p>Pakoon</p>
</div>

yeah, that was my point…  if you see it when editing the post, its not from the Thanks plugin…  Its not part of the post content and wouldnt show up…

the trouble maker simply copied the code from the thanks display below a post and pasted it into his own post as content…  and edited…

since its not really a thanks, it wont show in his reputation either…