There's 1 security fix and 1 breaking change (previous shouted links will look funny)

Not work

I think a fix would be to pass back a new CSRF token in the XML, perhaps each time, and update this with javascript in the DOM. This should solve the problem.

I'm not sure what your plan/workflow is but it'd be really useful for the project for you to pass these fixes you're making back as pull requests on github

Thanks
Andy

Right now, when you leave the shoutbox open long enough, it'll eventually "crash" and stop working, due to a CSRF token mismatch. The reason this is happening is because a static CSRF token is being compared to one that gets generated on each poll and each new message (so basically, every 1.6 seconds). In simpler terms, each time it checks for new shouts or adds a new one, it'll check these two tokens, and eventually the static one will lag behind, and mismatch.

The comparison's in data.php on line 26:

$_GET['csrf_token'] != generate_form_token('./extensions/shoutbox_pun/data.php')

I understand that the reason for this is to help prevent cross-site attacks, and in this specific case, prevent bad people from posting shouts to your shoutbox without your permission. Does anyone have any idea on how to get around this? It looks like one solution is to regenerate the static token before it expires, but the token is generated via php code, and only gets called on page refresh. The alternative is to remove the check.

This problem also occurs with base PunBB functions, like modifying settings in the admin panel. The site gets around it by prompting you to confirm your action. I haven't looked at the code, but I imagine during this time, they regenerate the token, and then the action passes the check and goes through. But we can't do that with shouts, unless we force a page refresh every ~30 minutes.

Would be totally grateful for any help on this. Thanks!

helliax wrote:

I've managed to implement username links, but I'm trying to figure out the best way to go about tying it to an option, so it can be turned on and off through the forum settings.

Right now, the link is generated in the javascript. Specifically, the getHTMLFromMessage() function in shoutbox-pun.js. So in other words, I can't access the PHP config values directly. One way I figure I can do it, is to create a hidden <input /> that has the value, and grab that value from javascript. But that seems really hackish. Does anyone have any suggestions, or just other mods to check out, to see how they did it?

I forked andrew's project so I can work on it without messing up his project, so you can look at the code I have now: https://github.com/helliax/shoutbox_pun. Preferably, all my major changes will get turned into options, so we end up with one mod instead of two with just minor differences.

Why not add the option in the XML output in data.php? getShouts could have an additional <options> bit.

Please feel free to submit a pull request once the changes are done

This is sort of so obvious now I don't know why I didn't think of it immediately at the time. Thanks!

I've managed to implement username links, but I'm trying to figure out the best way to go about tying it to an option, so it can be turned on and off through the forum settings.

Right now, the link is generated in the javascript. Specifically, the getHTMLFromMessage() function in shoutbox-pun.js. So in other words, I can't access the PHP config values directly. One way I figure I can do it, is to create a hidden <input /> that has the value, and grab that value from javascript. But that seems really hackish. Does anyone have any suggestions, or just other mods to check out, to see how they did it?

I forked andrew's project so I can work on it without messing up his project, so you can look at the code I have now: https://github.com/helliax/shoutbox_pun. Preferably, all my major changes will get turned into options, so we end up with one mod instead of two with just minor differences.

Why not add the option in the XML output in data.php? getShouts could have an additional <options> bit.

Please feel free to submit a pull request once the changes are done

Right now, the link is generated in the javascript. Specifically, the getHTMLFromMessage() function in shoutbox-pun.js. So in other words, I can't access the PHP config values directly. One way I figure I can do it, is to create a hidden <input /> that has the value, and grab that value from javascript. But that seems really hackish. Does anyone have any suggestions, or just other mods to check out, to see how they did it?

I forked andrew's project so I can work on it without messing up his project, so you can look at the code I have now: https://github.com/helliax/shoutbox_pun. Preferably, all my major changes will get turned into options, so we end up with one mod instead of two with just minor differences.

Don't forget to implement BBCode too!

I think that's kinda tricky! BBCode wasn't intended for single line 'shouts'. I can see the URL tag being useful but aside from that I think it's just going to give people power to annoy