Secondly, I've noticed that CSS file which comes with one phpBB style is 657 lines long. On the other hand, Oxygen.css alone is nearly 2000 lines long. Why is that? Also, Oxygen.css is quite cryptic to understand when compared to that phpBB style (at least to me) and I cannot find any documentation.
]]>What is your recommendation?
Also what is best to get rid of infections?
Thx.
]]>I have a hard time knowing what to search for and because of that, to find information on how to do the below:
I run a 1.2.20 forum which I want to upgrade to 1.3.4
I want to install the 1.3.4, set everything up, install templates etc. and THEN migrate the users and posts etc from 1.2.20 to 1.3.4 and switch from 1.2.20. Then the downtime would be minimal.
Any leads to instructions on how to perform this?
]]>Warning! The following errors must be corrected before your message can be posted:
* Unable to confirm security token. A likely cause for this is that some time passed between when you first entered the page and when you posted the form. Clicking "Submit" again should solve the problem.
I can't posted the new topic in the end so my forum is still empty.
2) Moreover when I do any admin task (add extension, change setting) I also get a message related to security token :
Unable to confirm security token. A likely cause for this is that some time passed between when you first entered the page and when you submitted a form or clicked a link. If that is the case and you would like to continue with your action, please click the Confirm button. Otherwise, you should click the Cancel button to return to where you were.
And this every time, even if I just log-in, so no time-out here.
Which kind of right do I need and on which folder to stop that annoying message to appears.
thanks.
Forum version : 1.3.2
My new user have not "Signature" on post.
My user in ID 353 is good but after the signature not here.
see on my post on my forum to user "Bobinge" ID 355 : Post
Thank for your help..
]]>In addition to this, I have many many custom pages on my website that use punbb's user tables and many punbb functions. For example I have custom profile pages that refer to all the $pun_user[] variables. Another example is I use some of the parsing functions when posting user content to other pages on my site.
My question is, does 1.3 still user mostly the same function names, user table names, routine names, and still reference $pun_user[] for all the user vars?
]]>
How to set up the style: go to Profile->Settings and choose "Copper" in "Available styles".
You can download the style from the Trac: "Download in other formats: Zip Archive" link at the bottom of the page.
Feel free to post your suggestions here.
]]>Does anyone here have a PunBB board that is deeply crawled by Google? I am curious to see how this software does with Google and other search engines before I use it in a production environment.
]]>I'm pleased to announce my OpenID extension for PunBB, as requested in http://punbb.informer.com/forums/topic/ … -support/. It was developed as part of my bachelor thesis. It makes use of JanRain's PHP OpenID Library 2.1.3 from http://www.openidenabled.com. Though the library itself claims to support PHP 4, the extension requires PHP 5.2 due to heavy use of object-oriented features. Because of the library being backwards compatible, it triggers some warnings when using PHP 5. I have fixed those in the library shipping with the extension; otherwise, it's unchanged.
Features
login using OpenID (more than one OpenID per account is possible, traditional password-based login too)
registration using OpenID (both SReg and AX are supported to request attributes)
add/remove OpenIDs to/from existing accounts
authentication using OpenID to change password/e-mail address (instead of entering old password)
update profile information using OpenID (again, using SReg or AX)
list of users OpenIDs in profile (private information)
administration: user search includes OpenIDs in results
administration: search for OpenIDs
English and German localisation
Future ideas
OpenID-only accounts: flag indicating if a valid password has been set, if not, hide all password input fields
sorting of OpenIDs: allow user to set order or select default OpenID to preselect
Known bugs/limitations
An attacker may learn which OpenIDs are registered and which not: a) upon login only for unregistered OpenIDs attribute requests are send, b) when adding an additional OpenID to an account, before authenticating it is first checked, if it is already registered; should this behaviour be changed to not leak any information?
CSRF form: the confirmation form provided by PunBB does not work for OpenID requests (*). However, it should never be displayed as a custom csrf token is added to each request and checked accordingly.
Timezone is not requested using AX extension: Might as well be an OP bug, as it could only be confirmed for myopenid.com, the only OP I'm aware of that supports the AX extension. Can you confirm this behaviour using another provider or do you know of any other provider supporting AX?
(*) This seems to be a rather complex issue. OPs may choose GET or POST when answering a request. When choosing POST, the csrf token that PunBB expects is (obviously) missing, so the csrf confirmation form is displayed. When PunBB generates the csrf confirmation form, it produces one hidden field per received POST parameter. But it has to add two more fields, e.g. for the csrf token. These additional fields confuse the security mechanisms of the OpenID library and the request is denied. This is most probably a library limitation and I can see no possibility for a workaround. The library uses php://input to read POST parameters, so there is no chance to remove the additional parameters before making library calls.
Tested using
PunBB 1.3, 1.3.2, 1.3.4
MySQL 5.0, 5.1
PostgreSQL 8.3
PHP 5.2
Tested providers
PHPMyID
claimid.com
meinguter.name
myid.net
myopenid.com
openid.claimid.com
pip.verisignlabs.com
xlogon.net
Changes
1.1.0: login using XRIs, changes to data format in database, some simplified code
1.0.4: tested compatibility with PunBB 1.3.0, some minor bugs fixed
1.0.3: fixed no/wrong error message displayed when trying to log in with cookies disabled
1.0.2: fixed adding of table name prefixes
1.0.1: two minor bugs managed to hide on my todo list, fixed in this version
1.0.0: first public release
Download
Download: https://dev.asdn.eu/projects/list_files/punbb-openid
Git-Repository: git://git.asdn.eu/punbb-openid
Please be aware that this is the first public release of this extension. Though I have tested everything I could think of, there may still be some bugs around, including bugs affecting the security, i.e. permitting someone to login without valid authentication etc. Feel free to use it and please report all problems you may encounter.
Regards,
Alexander
$forum_page['redirect_url'] = WWW.'viewtopic/'.$id;
$forum_page['form_action'] = forum_link($forum_url['login']);
$forum_page['hidden_fields'] = array(
'form_sent' => '<input type="hidden" name="form_sent" value="1" />',
'forum_user' => '<input type="hidden" name="form_user" value="'.$forum_user['username'].'" />',
'redirect_url' => '<input type="hidden" name="redirect_url" value="'.forum_htmlencode($forum_page['redirect_url']).'" />',
'csrf_token' => '<input type="hidden" name="csrf_token" value="'.generate_form_token($forum_page['form_action']).'" />'
);
Where i can get list of $forum_url ,or get rid off this annoying fing "Unable to confirm security token". Why the hell you really need it? Anyway $forum_url['login'] is for login form ,but i need for logout,post edit etcc.. 
Screenshot: http://www.punres.org/files/projects/pr … enshot.png
Demo: http://adi.ing.uchile.cl/~mortega/punbb … m.php?id=2
Download: http://www.punres.org/files.php?pid=373
sorry for my english 
