🚀 go-pugleaf

On Sat, 7 Dec 2013 01:59:08 +0000 (UTC), Lewis
<g.kreme@gmail.com.dontsendmecopies> wrote:

>In message <bgfas9...@mid.individual.net> 
>  Catriona R <catrion...@totalise.co.uk> wrote:
>
>> Never mind outside the game - beware of ingame messages too!
>> Apparently, it's possible with some addons which let people share
>> custom settings with others (via whispering a link or code), to inject
>> code which doesn't so what you might be expecting... things like, mail
>> all your gold to someone else, or trade it all to someone. Seems to be
>
>Who told you that? None of that is possible.
>
>Trades and gold mailing absolutely require a confirmation, sent by the
>server, that the client must physically click. Anyone claiming otherwise
>is either an ignorant fool or a liar.

Well, the people who it's happened to in the thread linked, seem to
think it happened... I'll believe them until proven otherwise.

>> mainly WeakAuras and maybe TellMeWhen affected at present, but by the
>> sounds of things, pretty much any similar addon which lets you share
>> codes/settings with other users is a risk. Seems it's only a problem
>> if you click the link to run it, so lesson of the day: don't accept
>> things like that from untrusted sources, just in case!
>
>> http://us.battle.net/wow/en/forum/topic/10780477954?page=1
>
>I notice there's no confirmation from a blue post.

Last post on the thread, blue response. Of course they're not going to
shout "hey this is how the exploit works" until they can fix it, as
it'll only get more people using it, but the wording of that reply
sounds like they're taking it seriously.

>I used to have an addon for my mule that automatically mailed all but
>100g to my main anytime I went to a mailbox, so I remember clearly when
>they added the confirmation.

Doesn't necessarily mean people haven't found a way round it now
though. In any case, being careful is never a bad thing, and hearing
about this is a good reminder to be careful what dodgy scripts one
chooses to accept from random people ;-)