Attachment Mod 2.0.1 by Frank H (Page 13 of 21)

Nothing new. ((
I've just installed thiz mod, without any other mods

Hi,

I did a mod to Attachment Mod 2.0.1here : http://georezo.net/forum/download.php

If you are interested i can give the code to Franck.

Cheers

Fred

I need time to translate it, but i ll do it ! In case on emergency please let me know

Hey Frank H

We are running a PunBB forum, and have installed your attachment mod, all seems fine but we are getting this error message...  bill the guy that knows more than me in this area sent me this to post

MySQL 4.1.21-log    Rows: 52846    Size: 4.18 MB
Operating system: Linux   PHP: 5.1.5   PunBB 1.2.7

We do have a Image Upload mod running, but thats working fine...

Notice: Undefined index: attach_cur_version in
/www-vhost/www.hed.swin.edu.au/design/nidr/forum/plugins/AP_Attachment_Mod.php on line 1090

Config table has been updated and new tables have been added.  Folder with
long random name was created in the attachments folder

If you have any ideas we would love to know any angles we need to look at... and if you need any more info I will try to get it...   we have looked over the "Installing the mod on PunBB 1.2.6+" site trying to work this bug out...

Our small forum is at
http://www.hed.swin.edu.au/design/nidr/forum/

Regards
Volker

Frank H, something like hdiff for updated (NULL byte exploit) AP_Attachment_Mod would be very nice

no hdiff(don't have it installed), but a simple cut'n paste

Find (line 879)

    // rewrite stuff from POST variables
    $form['use_icon'] = intval($_POST['use_icon']);
    $form['icon_folder'] = $_POST['icon_folder']; //later strip out all < > | ? * " from the string, to try to up the safety
    $form['icon_extension'] = $_POST['icon_extension']; //later strip out all \ / < > | ? *  from the string, to try to up the safety
    $form['icon_name'] = $_POST['icon_name']; //later strip out all \ / < > | ? *  from the string, to try to up the safety
    $form['create_orphans'] = intval($_POST['create_orphans']);
    $form['always_deny'] = $_POST['always_deny']; //later strip out all \ / < > | ? *  from the string, to try to up the safety
    $form['max_size'] = intval($_POST['max_size']);
    $form['basefolder'] = $_POST['basefolder']; //later strip out all < > | ? * " from the string, to try to up the safety

Replace with

    // rewrite stuff from POST variables
    $form['use_icon'] = intval($_POST['use_icon']);
    $form['create_orphans'] = intval($_POST['create_orphans']);
    $form['max_size'] = intval($_POST['max_size']);
    // remove unallowed chars
    $attach_replace_matches = array('<','>','|','?','*',"\0"); //strip out all < > | ? * NULL from the string, to try to up the safety
    $form['icon_extension'] = str_replace($attach_replace_matches,'',$_POST['icon_extension']);
    $form['icon_name'] = str_replace($attach_replace_matches,'',$_POST['icon_name']);
    $form['always_deny'] = str_replace($attach_replace_matches,'',$_POST['always_deny']);
    $attach_replace_matches[] = '"'; // add the " to unallowed chars
    $form['icon_folder'] = str_replace($attach_replace_matches,'',$_POST['icon_folder']);
    $form['basefolder'] = str_replace($attach_replace_matches,'',$_POST['basefolder']);

That should make the poison null vulnerability a thing of the past

you probably have safemode on the server, you must disable it to get uploads to work (and you need to run install_mod.php sucessfully before using viewtopic.php)

no im getting this error...

PunBB reported: Unable to add column "attach_always_deny" to config table

I'm having an issue where I don't get the correct number of 'choose file' or 'browse' buttons on the new post page.  In the mod settings I have set this to 5 for all users but I only get one browse button.  The code doesn't seem to check if multiple browse buttons are required

        <fieldset>

                    <legend><?php echo $lang_attach['Attachment'] ?></legend>

                    <div class="infldset">

                        <div class="rbox">

                            <input type="hidden" name="MAX_FILE_SIZE" value="<?php print $attach_size; ?>" /><input type="file" name="attached_file" size="80" tabindex="<?php echo $cur_index++ ?>" /><br />

                            <?php echo $lang_attach['Note'] ?>

                        </div>

                    </div>

                </fieldset>

I went back to the install instructions and belive I did everything correctly - can you see what I have missed?

Thanks in advance

@volker: First off, it will only show one upload field, to add more files you need to edit the message. (I don't like javascripts, as I find it to bloat everything, and you might have 100 allowed files for some groups (admins are unlimited), and it shouldn't add one field for each ... + it's less code with this solution)
From the readme.txt

##                    And as a further upgrade, posts are no longer limited to
##                    one attachment per post. I still have a limit of one file
##                    per opportunity (i.e. one on post creation, rest on edit),
##                    but the admin set the limit of max files per post, a per 
##                    group and per forum basis.

Secondly, it sounds like you've missed a step in the edit.php file, recheck that all edits are in the file.

--------------------------------------------------------------------------------------------

@Everyone: I'm REALLY busy at work at the moment, and will be for at least until the end of the year, so I might be slow at answering questions. I hope you all will understand.
I was planning on releasing an 'intermediate' release for 1.2.13 (as there has been a lot more questions lately, a bunch seemingly related to safemode on, that I guess some hosts has started to used recently + using the mod with a bunch more mods, I'm sorry for yo uaffected by this, that I haven't found time to look deeply into this) ...

Anyhow, considering that PunBB 1.3 is somewhere in the horizon, I'm not sure I'll have the energy to do it, as it will all change to that release, but still be compatible with the already saved files from the current mod.
(I'll try to do an easy installing extension out of it, but it will require some work, and if you can wait for PunBB 1.3 + time needed for me to fix the extension, it might be a bit easier for you if you wait for that, and perhaps only need to upload, change permissions, run the installer)...

Do note that I'm not saying you shouldn't use this mod, I'm just saying it probably will be a much easier thing to use as an extension ... and if you feel you don't like editing the 50 or so steps, you might be able to cope until PunBB 1.3

Now I need to eat something and head off to bed, so I can get up tomorrow morning

ok here's our hack for edit.php

this gives ALL users the same permissions regarding attachments within the edit page. Not ideal obviously but we didn't see it as a major issue as guest can't get to the edit page and we are happy for members to delete their own attachments and add more

----FIND

<li><a href="help.php#smilies" onclick="window.open(this.href); return false;"><?php echo $lang_common['Smilies'] ?></a>: <?php echo ($pun_config['o_smilies'] == '1') ? $lang_common['on'] : $lang_common['off']; ?></li>
                        </ul>
                    </div>
                </fieldset>

------AFTER ADD
//hard code attach settings and grab existing attachments for this post
$attach_allowed=true;
    $attach_allow_delete=true;

    $attach_allow_owner_delete=true;

    $attach_allow_upload=true;

    $attach_allow_size=$pun_config['attach_max_size'];

    $attach_per_post=5;
    $attach_allowed=true;
$attach_output='';
$attach_output_two='';
    $result_attach=$db->query('SELECT af.id, af.owner, af.filename, af.extension, af.size, af.downloads FROM '.$db->prefix.'attach_2_files AS af WHERE post_id=\''.$id.'\'')or error('Unable to fetch current attachments',__FILE__,__LINE__,$db->error());

    if($db->num_rows($result_attach)>0){

        //time for some output ... create the existing files ...

        $i=0;

        while(list($attach_id,$attach_owner,$attach_filename,$attach_extension,$attach_size,$attach_downloads)=$db->fetch_row($result_attach)){

            if(($attach_owner==$pun_user['id']&&$attach_allow_owner_delete)||$attach_allow_delete)

                $attach_output .= '<br />'."\n".'<input type="checkbox" name="attach_delete_'.$i.'" value="'.$attach_id.'" />'.$lang_attach['Delete?'].' '.attach_icon($attach_extension).' <a href="./attachment.php?item='.$attach_id.'">'.$attach_filename.'</a>, '.$lang_attach['Size:'].' '.number_format($attach_size).' '.$lang_attach['bytes'].', '.$lang_attach['Downloads:'].' '.number_format($attach_downloads);

            else

                $attach_output_two .= '<br />'."\n".attach_icon($attach_extension).' <a href="./attachment.php?item='.$attach_id.'">'.$attach_filename.'</a>, '.$lang_attach['Size:'].' '.number_format($attach_size).' '.$lang_attach['bytes'].', '.$lang_attach['Downloads:'].' '.number_format($attach_downloads);

            $i++;

        }

        if(strlen($attach_output)>0)

            $attach_output = '<input type="hidden" name="attach_num_attachments" value="'.$db->num_rows($result_attach).'" />'.$lang_attach['Existing'] . $attach_output;

        if(strlen($attach_output_two)>0)

            $attach_output .= "<br />\n".$lang_attach['Existing2'] . $attach_output_two;

        $attach_output .= "<br />\n";

    }else{

        // we have not existing files

    }
   
   
   
    if(strlen($attach_output)>0)$attach_output .= "<br />\n";

    if($attach_per_post==-1)$attach_per_post = '<em>unlimited</em>';

    $attach_output .= str_replace('%%ATTACHMENTS%%',$attach_per_post,$lang_attach['Upload'])."<br />\n".'<input type="hidden" name="MAX_FILE_SIZE" value="'.$attach_allow_size.'" /><input type="file" name="attached_file" size="80" />';

I'm sure someone can find a cleaner way to do this - I'll watch this thread

cheers