Able to make DevProducts with prices in the negatives

Bug Reports Website Bugs
#1

I came across this when making my name your price products thing. When sending an HTTP Request to the url that creates a product in the universe, you can set the PriceInRobux/Tickets to a negative number. It creates the product with the negative price. Upon trying to purchase it, ROBLOX does throw an error saying that there was a problem with the purchase.

How-to:

  1. Go here, make a product with the ROBUX price of -1
  2. Try to buy it

Here are some images of it:

#2

I like how it says it’s going to increase your R$ balance :stuck_out_tongue:

However, ROBLOX should still be validating their inputs in a web request, even if it isn’t supposed to be used by things other than the website: this sort of thing is how security holes like XSS and SQL injection form.

#3

Imagine if it had worked, and players could buy it. You’d be broke :shocked: