WordPress PunBB db integration workaround

I'm not sure how great an idea it is to insert values into the Wordpress comment box like that because it doesn't seem as if that in any way stops a malintentioned user from writing their own comment form that will submit any name they wish. Also, it will cause problems if a user's name on the forum is edited.

It might be better to modify Wordpress to fetch the user ID when processing the comment and insert that in place of the name and then editing the comment display to fetch the username based upon each user ID (that could probably be done with a JOIN on the query that fetches the comments).

Ok, let's say I'm this malintentioned user. I'll view your page's source and look at the action attribute of the form and the name attributes for all the inputs. Then, I'll write my own form to match (with the name field editable), save it to my computer, open it in my browser, and let the fun begin.

The problem is that anyone can send data to a comment form, forum, etc. It's up to the site's owner or software's developer to account for this. For example, PunBB (for some forms) and many other applications use referrer checks to prevent such an attack, but referrer headers are easily spoofed (I think I read on Trac or the PunBB development blog that another system was being implemented). I'm not sure whether or not Wordpress has anything against this in place.

In short: don't send users' identities through a form. Use PunBB's integration features to determine users' identities on the page that processes the form (not the page that displays it).

If you include the proper files to integrate with PunBB as outlined in the docs, it should work. $pun_user['username'] will suffice if you want a lazy hack; $pun_user['id'] would be better but you'd need to alter the datatype of the name column in Wordpress's database and alter the query in Wordpress's comment display to join with PunBB's user table.

nice idea, i'll wait for your work

so I have now done this...took around 3 hours...I think I have made it so it is secure.

I have made it grab the avatars too which is cool.  So now you can comment on wordpress articles if you are logged into punbb or wordpress...if you are not logged in to wordpress or punbb you can't comment.

If you have an avatar in your punbb profile then it will be put next to your name in the comment, if you don't have an avatar then nothing will show.

if you are logged into wordpress and punbb at the same time then the wordpress user info is used and punbb is ignored.  As my members aren't allowed to login to wordpress (only punbb) this isn't a problem for me.

The affected files are:
wordpress/wp-comments-post.php
and
wordpress/wp-content/themes/YOUR_THEME/comments.php

Replace the 2 files:   (make sure to backup)
http://nickfranklin.googlepages.com/wp- … s-post.php
http://nickfranklin.googlepages.com/comments.php

To adapt this to your theme just see what I have done to my comments.php theme file and do the same to yours - I have commented all of my changes in both files with // CHANGED FOR PUNBB INTEGRATION or something similar so just do a search for PUNBB to see where I have made changes.

I have only tested this with wordpress 2.0.3, I am going to upgrade to 2.1 soon and I imagine it will still work fine.

Let me know what you think...cheers, Nick

edit:
I diddn't mention above that you have to include this code somewhere:

<?php
define('PUN_ROOT', '../punbb/');
include '../punbb/include/common.php';
global $pun_user;
?>

I put it near the top of my index.php wordpress theme file so that it is always there wherever I am in wordpress.

my mod has no connection or reliance on the mod you refer to ... it stands up on its own.  My mod does not integrate the wordpress login system with punbb login system.  What it does is prevent people who are not logged into punbb from making a comment on a wordpress article and also when a logged in member does make a comment it grabs their punbb username and avatar so that it gives the illusion of a bridged system.

I am not sure about using the two mods together...give it a try if you need the functions of both    the more mods you do though the harder it's going to be to upgrade.

sorry I won't be making any more changes to this mod...lack of time

bloody ur site look very good but the images padding is off in FF and IE6!

Q

Fatal error: Call to a member function rs_isEmpty() on a non-object in /home2/c/chantdeleau/www/wordpress/wp-content/plugins/wordpun/wordpun-class.php on line 292

Q