Zombie Lane (Facebook game) uses URLs to send in game items called Gifts.
Therefore the game normally locks out specific items until the player has reached a specific character level.
For instance a user should be level 30 before being able to send +7 energy to another user. Using the URLs below allows you to circumvent this.
As of version 1.1.8 of the game this is still a security hole that has not been patched.
Originally I was pretty psyched to create an application that would allow other ZL players to easily do this as well. The problem comes in the form of time. Already wasted 3 hours making a solution specific to me (a single webpage with 32 ZL players that when I click on their 32×32 pixel FB photo an individual page loads prompting 7 pop up windows to send all 7 items to that specific user). So now I click on 32 images and some super crude Javascript window.open pop ups do the work for me. Of course I had to tell my browser to allow pop ups and each browser has limits on the number of pop ups it will allow (Chrome allowed me to load 25 before it blocked further, Firefox 4 blocked after 20 and Internet Explorer 8 allowed me to open all 192 pages while almost freezing my 8GB RAM, 6 core computer). I couldn’t find where to alter these limits.
If anyone is interested in making an app that would take advantage of these links would have to consider these points:
- Facebook vanity / username URLs won’t work
&recipient=some.name.that.you.chose won’t work. So you’ll have to convert vanity names to UIDs.
- Possible TOS issues
I skimmed through both Facebook Developer TOS and Zombie Lane TOS and didn’t see anything that would be an issue. After all these are using URLs that are publicly available.
- Pop Ups
To open the URLs you will need to use pop ups. No one likes pop ups. Every browser has pop up blockers enabled and it will be a hassle to have people unblock them.
- Storing User Facebook Friends
If you make it web based you are going to have to keep track of who people want to send to, otherwise they will have to enter this information every time. So now you have to handle the privacy issue. You can encode the data, but the average user is still going to be suspicious of your intent.
- Webbased vs Standalone
So PHP, Javascript, FBML, Ruby. Now you need hosting or you have to have people trust a EXE. Fun times.
- Digital Chocolate changes exploit in next version and you wasted a huge amount of time
THIS.
So what do I suggest. Just use the URLs for yourself for now.
Shotgun
+3 Energy
+5 Energy
+7 Energy
Blueprint
Grenade
Land Mine
Shotgun
http://apps.facebook.com/zombielane/SendGift?gid=Shotgun&request_type=GiftRequest&recipient=580606262
Energy +3
http://apps.facebook.com/zombielane/SendGift?gid=EnergyCola&request_type=GiftRequest&recipient=580606262
Energy +5
http://apps.facebook.com/zombielane/SendGift?gid=EnergyCola2&request_type=GiftRequest&recipient=580606262
Energy +7
http://apps.facebook.com/zombielane/SendGift?gid=EnergyCola3&request_type=GiftRequest&recipient=580606262
Blueprint
http://apps.facebook.com/zombielane/SendGift?gid=Blueprint&request_type=GiftRequest&recipient=580606262
Grenade
http://apps.facebook.com/zombielane/SendGift?gid=Grenade&request_type=GiftRequest&recipient=580606262
Land Mine
http://apps.facebook.com/zombielane/SendGift?gid=LandMine&request_type=GiftRequest&recipient=580606262
How the links look. Replace the &recipient= at the end to the UID of your friend.
To find this I made this really quick. Enter a vanity name and it will show you the user ID number.
All that is left to do is to create a list of links that you can click on. You’ll have to look into HTML or Javascript
HTML Example
<a href=’http://apps.facebook.com/zombielane/SendGift?gid=Shotgun&request_type=GiftRequest&recipient=580606262′>Shotgun</a>
Javascript Pop Up Example
<script language=”javascript”>window.open(‘http://apps.facebook.com/zombielane/SendGift?gid=Shotgun&request_type=GiftRequest&recipient=580606262′,”,’width=350,height=200′)</script>
Hope this helps.
Recent Comments