Actual un-clickable button (for real this time)!

Disclaimer!

There always has been (and always will be) ways to bypass this since devtools is more powerful than JavaScript itself. Don't expect it to be actually "unclickable"!

After seeing

's post, I realized that there are soo many ways to bypass the "clicking" for his project.

I decided to take matters into my own hands and actually make my button "un-clickable". None of the methods described in invisibleone's post works now (not even mine)!

See if you can get this button >:)

Oh and BTW:

Calling the function or alerting the message that the function alerts is not counted as the solution. I can't stop liars, but if you find a way around it then please tell me.

People who have clicked the button (legitimately. Those who don't post their reasons or their reasons aren't valid (AKA: they aren't actually clicking it) won't get on the "leaderboard"):

Wilke000
1andonlyaether
Codemonkey51
DSAEvan
darkdarcool
DrakeFletcher2

Ok so many people are doing it. Great guys!

I'm not going to add any more because so many people are doing it.

I am so proud of you replers! You are all such great critical thinkers!

Keep in mind guys that I can only do so much because most browsers give you more control over JavaScript than JavaScript itself...

Oh, wow

I have found and prevented at least 4 methods of clicking the button via cheats since I made this post:

Focusing the element using HTMLButtonElement.prototype.focus()
Mutating globalThis.requestAnimationFrame
Tabbing/editing the tab index
Modifying the size/position of the element (to make it stay in one place)
Right clicking

Ok guys

You now can't use window.alert :D

Ahh, yes. Now I can tell who actually clicked it and who didn't >:)

Oh and guys... the message saying "lol nice try guys ;D" means you didn't get it.

Fixed the right click hack >:D

(Possibly) also fixed the right clicking address bar cheat :D (button will be disabled. You can click it, but no "You got me!")

Yoo guys, if the button is gray that is on purpose. It's disabled when the web page loses focus (to prevent the right click cheat... which still works ARGH).

You got me guys, I can't defend this button forever :(

Voters

134 more...

Comments

hot new top

Very relevant...

LOL!

SO TRUE!

Btw I love science as well...

xkcd. Very funny.

hm...

if you wanted it to be unclickable that bad, just give the button the disabled attribute, <button disabled>Cant Click</button> and disable attribute changing.


HTMLElement.prototype.setAttribute = function() {
    alert("Sike Gottem");
}

this is very good.

faxxxxxxxx

you can bypass this

Ok ez fix >:)

Btw glad to see you back buddy!

Oh, wait... it's already fixed because I froze HTMLButtonElement, so it should prevent setAttribute from being changed... oh wait I forgot to freeze the prototype! Thanks :)

And yea you could have the disabled attribute, but there is supposed to be a chance to click it without the obvious.

Also, alert won't work cuz it's inside a code block and is not in globals.

Lmao, HTMLElement#setAttribute actually looks up the prototype until it finds Element#setAttribute ;)

The bypass from there is simple:


Element.prototype.setAttribute.call(button);

JS cannot be sandboxed by itself, it's hell to try.

Thanks

Too, true.. too true.

Can't I delete setAttribute tho?

I guess?

Well, I mean.. imagine if you had even more control (over the client's computer) with JS... it would be a nightmare.

Someone thought they could prevent ending processes in NodeJS (or more or less they were kidding).

I don't like NodeJS for a thousand reasons, among them, the execution of un-sandboxed JS, with higher privilege than browser JS.

~~Oh shoot, seems like that sounds like a perfect use case for Wasm though, since it's always safe.~~

Btw, you need SES in order to sandbox your button... otherwise, I could just assess a new Element from another window if I wanted to.

Actually, no, you just stright-up can't defend that button.

Prob not... :(

ive been fumbling with it for a few minutes now and cant find anything, good job!

~~My military strategies have worked well~~

Or you can use touchscreen

make the repl disable the button if the user is on mobile, im sure you can find ways to detect this by searching google :)

mabe :)

This is kinda ded ngl.

I clicked it!

Edit: the button doesn't move unless you move your mouse first, so memorize where the button 'spawns' and move your cursor there. Then reload the page using a keyboard shortcut.

Yeah this works haha

Noooo the zoom-in and then zoom-out strategy doesn't work anymore...

I used your stratigies to do it lolll

Got it! Go to the project page, hover cursor in the middle of the screen, scroll down, move cursor directly below button, scroll back up (without moving mouse) and click!

Also, right-click method still works for me.

Hm, try now. it shouldn't work...

I prevented context menu, so it shouldn't bring up the menu for anyone...

Yeah now it is blocked

Hehehe I on iOS with no access to any js terminal have clicked the button ;)

[ad removed by a moderator]

It's great

! But no ads

:O HOW
I have been tapping away at this on my iPad and it hasn't worked

Idk how

:O
magic

I am sorry

-cough- literally just dragged my mouse out scrolled down and clicked it lol

I got it first try. LOL!

gru

ill make a actual unclickable button. no tab spoofing or reload clicking or that stuff. ill make it truly unclickable

Not really possible, but ok!

The button will always be clickable :/

maybe your definition of clickable is different than mine. what is your definition of clickable?

Able to be clicked.

If you make it in JavaScript then the client user will almost always have more power over the program than JavaScript itself.

Like xxpertHacker said, it's hell to try to sandbox JavaScript

what is sandboxing javascript?

https://stackoverflow.com/questions/7043882/what-actually-is-sandboxing-in-javascript

Basically trying to lock out external resources from meddling with the script.

In this case, trying to prevent the user from editing the code.

oh thats decently simple. you just have to make it so that none of the elements appear on inspect

ok i fixed reload spoofing

and to fix the thing of moving faster than it can detect i just stopped the button moving with your mouse

That's not rlly possible...

whats not possible?

fixing reload spoofing?

i also fixed inspect opening using keyboard shortcuts

That's not possible, actually.