Hello

I'm getting the following error message from PunBB after including the familiar two lines in a script, after the user has already been authenticated by PunBB and received the forum_cookie_baf83f cookie:

Unable to confirm security token. A likely cause for this is that some time passed between when you first entered the page and when you submitted a form or clicked a link. If that is the case and you would like to continue with your action, please click the Confirm button. Otherwise, you should click the Cancel button to return to where you were.

This is actually a very simple play, with the following characters:

  • /blog/index.php

  • /blog/action.php

  • /punbb/login.php

A picture being worth a thousand words, here's the plan:

http://img838.imageshack.us/img838/8666 … nlogin.png

In other words, /blog/index.php uses PunBB's code to check if the user is logged on: If not, it calls /punbb/login.php, which, once the use is logged on, redirects the user back to /blog/index.php. So far, so good.

Next, /blog/index.php sees that the user is logged on, and displays a form with a single button "Subscribe/Unsubscribe"; The form calls /blog/action.php which includes just the two lines from PunBB:

define('FORUM_ROOT', '/var/www/nginx-default/punbb/');
require FORUM_ROOT.'include/common.php';

Here's the full code of index.php and action.php.

As you can see in the following HTTP log, when the user clicks on the Subscribe/Unsubscribe button to call action.php, for some reason, PunBB isn't happy and sends another cookie with Set-Cookie:

http://pastebin.com/jHJ4MprR

Does someone more experienced with web applications have an idea what the problem could be?

Thank you for any hint.

Thanks Grez, it works fine:

<?php

define('FORUM_ROOT', '/var/www/punbb/');
require FORUM_ROOT.'include/common.php';

print $forum_user['username'] . "<p>";

echo("<pre>");
print_r($forum_user);
echo("</pre>");

?>

Hello

If I understood how things work, from a different application, once the user has logged on using PunBB's authentication code, the browser received a cookie that matches the session ID that was created for him, and $_SESSION[] contains information put there by PunBB.

I need to read "username" for the current user, but looping through the array returns nothing:

foreach ($_SESSION as $key => $value){
  print sprintf("%s = %s<p>\n",$key,$value);
}

Do I really need to include this whole thing just to read session information for a user who has already logged on?

define('FORUM_ROOT', '/var/www/punbb/');
require FORUM_ROOT . 'include/common.php';
$forum_page['redirect_url'] = $post_info['real_link'];
$forum_page['form_action'] = forum_link($forum_url['login']);
$forum_page['hidden_fields'] = array(
        'form_sent'    => '<input type="hidden" name="form_sent" value="1" />',
        'redirect_url'    => '<input type="hidden" name="redirect_url" value="'.forum_htmlencode($forum_page['redirect_url']).'" />',
        'csrf_token'    => '<input type="hidden" name="csrf_token" value="'.generate_form_token($forum_page['form_action']).'" />'
    );

Thank you.

29

(4 replies, posted in PunBB 1.3 troubleshooting)

Stupid me smile I copy/pasted the line from my first test and forgot to update it to actually match the var names expected by PunBB. Works great now, thank you.

Thank you.

30

(4 replies, posted in PunBB 1.3 troubleshooting)

Thanks a lot for the tip. I hadn't noticed that the hidden fields only had names and not ids.

I'm getting a bit further, but PunBB now complains that the username/password is wrong, although I can see in the proxy that my test.php does send the correct information:

POST http://192.168.0.3/punbb/login.php HTTP/1.1
Referer: http://192.168.0.3/blog/test.php

username=admin&password=test&form_sent=1&redirect_url=%2Fblog%2Ftest.php&csrf_token=58009a05448ccac128f352df01f28a5deb00f571

Warning! The following errors must be corrected before you can login:
* Incorrect username and/or password.


Thank you.

31

(4 replies, posted in PunBB 1.3 troubleshooting)

Hello

I can succesfully use the script shown in the Login form outside the forum section of the "PunBB 1.3 integration" page.

However, I'd like to turn this standard form into an AJAX alternative so that I put this code in a DIV and only update this section of the page.

I tried rewriting the code, but it fails with the following error:

Confirm action

Please confirm or cancel your last action

Unable to confirm security token. A likely cause for this is that some time passed between when you first entered the page and when you submitted a form or clicked a link. If that is the case and you would like to continue with your action, please click the Confirm button. Otherwise, you should click the Cancel button to return to where you were.

Here's the code, using jQuery for the AJAX call:

This is test.php
<?php
define('FORUM_ROOT', '/var/www/nginx-default/punbb/');
require FORUM_ROOT.'include/common.php';

$forum_page['redirect_url'] = "/blog/test.php";

$forum_page['form_action'] = forum_link($forum_url['login']);
$forum_page['hidden_fields'] = array('form_sent'=> '<input type="hidden" name="form_sent" value="1" />',
        'redirect_url' => '<input type="hidden" name="redirect_url" value="'.forum_htmlencode($forum_page['redirect_url']).'" />',
        'csrf_token' => '<input type="hidden" name="csrf_token" value="'.generate_form_token($forum_page['form_action']).'" />'
);

echo "<div id='subscribers_list'>\n";
?>
    <?php echo implode("\n\t\t", $forum_page['hidden_fields'])."\n" ?>
    
    User:
    <input type="text" id="fld1" name="req_username" value="" />
    <br />
    
    Password:
    <input type="password" id="fld2" name="req_password" value="" />
    <br />
    
    <input type="button" id="mybutton" name="mybutton" value="Login" />
<?php
}
echo "</div>\n";
?>

<script type="text/javascript" src="/blog/admin/includes/js/jquery/jquery.js"></script>
<script type='text/javascript'>
$("#mybutton").click(function() {
        switch($("#mybutton").attr("value")) {
                case "Login":
                        var username = $("#req_username").val();
                        var password = $("#req_password").val()
                        //hidden vars set through implode() above
                        var form_sent = $("#form_sent").val();
                        var redirect_url = $("#redirect_url").val();
                        var csrf_token = $("#csrf_token").val();
                        $("#subscribers_list").load("<?php echo $forum_page['form_action'] ?>", {username : username, password : password, form_sent : form_sent, redirect_url : redirect_url, csrf_token : csrf_token});
                        break;
        }
})
</script>

Has someone succeeded in using an AJAX version of the login script?

Thank you.

32

(0 replies, posted in Discussions)

Hello

I was wondering: Suppose my PunBB-powered forum because sooooooo successful that I can no longer scale up (ie. beef up the single MySQL server) and thus need to scale out (ie. add two or more MySQL servers).

Can PunBB handle this scenario, either as master-slaves or masters-slaves?

Thank you.

Thanks Grez smile

Thanks for the clarification. From the code above, I guess it means that in case the user tried to fake authentication by calling the URL with "login=whatever" added manually, PunBB will display an error message.

But in my case, the user has been logged on OK since a cookie is available, and so, $forum_user['is_guest'] == False.

So I'm not sure whether I can remove "login=1" safely. It's just for esthetics, though, not a major issue.

Thanks.

One last little thing, though: I notice that after calling a form with action=login.php to let the user authenticate against PunBB... once redirected, the URL has "/?login=1" added to the URL, ie.

http://192.168.0.8/?login=1

Reading through login.php, this is due to the final redirect():

if (isset($_POST['form_sent']) && empty($action))
{
[...]
     redirect(forum_htmlencode($_POST['redirect_url']).((substr_count($_POST['redirect_url'], '?') == 1) ? '&amp;' : '?').'login=1', $lang_login['Login redirect']);
        }

Before I go ahead and just remove this bit... does someone know if it's really needed and removing it could have some nasty side-effect?

Thank you.

Thanks again Grez for the idea. Solved solved smile

Here it is, in ./include/functions:

$links['logout'] = '<li id="navlogout"><a href="'.forum_link($forum_url['logout'], array($forum_user['id'], generate_form_token('logout'.$forum_user['id']))).'">'.$lang_common['Logout'].'</a></li>';

However, the user ends up in the PunbBB forum... while he was in the blog when clicking on the Logout link I displayed hmm

How can I tell login.php to redirect the user to a different URL instead of the forum?

Thank you.

Thanks Grez. I figured there should be a simpler solution.

And finally, now that users are authenticated in the blog part of the site... what URL should I use to provide a "Log out" button or hyperlink?

The Log Out URL in the PunBB forum seems to include the SessionID as returned by the browser:

http://punbb.informer.com/forums/logout/10921/b9ecde09d23f6f2a82f558b92ab556827558049b/

Is this URL also available as a variable in PunBB?

Thank you.

I mean the equivalent of this page for PhpBB:

http://www.phpbb.com/community/viewtopi … ;t=1677625

I guess I could do this myself by reading if the browser returned a cookie named "forum_cookie_b2bbd3", check that this key exists in $_SESSION[], and find what the username is from this session.

But before doing this, I'd like to make sure PunBB doesn't already provide a safer/cleaner way.

Thank you.

Hello

The article PunBB 1.3 integration shows how to use PunBB's authentication module in external applications by displaying its logon form.

But once the user has logged on successfully and received the necessary cookie... what code should I use in the external application in all restricted areas to check that the user is logged on and, if not, redirect him to that logon page?

Thank you.

Hello

Using the code in the PunBB 1.3 integration article to use PunBB to authenticate users in a blog application, I notice that once authentication is successful, the URL includes a trailing "?login=1".

Is it possible to get rid of this directly? Otherwise, should I use URL Scheme for URL rewriting (I guess Nginx has an equivalent to Apache's mod_rewrite)?

Thank you.

42

(2 replies, posted in PunBB 1.3 discussion)

Thanks, I'll give it a shot.

43

(2 replies, posted in PunBB 1.3 discussion)

Hello

To make it easier to integrate PunBB in a CMS, I was wondering whether it can outsource authentication to OpenID, and if yes, what the status is on this feature: Under development/Sort of works/Solid?

Thank you.

44

(5 replies, posted in PunBB 1.3 additions)

(English translation)

Hello

I found some code to display a logon form on all the pages on a site. I'm not the author of this code; I simply found it on a mod; Can't recall which, but it works. Its author will know who he is.

Before the doctype of the document, add the following lines:

<?php
 
// Add these lines in the very top of your code
define('FORUM_ROOT', './forum/');
require FORUM_ROOT.'include/common.php'; 
?>

Next, where you want the logon form to be displayed, add the following code. Logged-on members can also see the avatar:

<?php
// If user is logged display some informations about it
if (!$forum_user['is_guest'])
{
    require FORUM_ROOT.'lang/'.$forum_user['language'].'/index.php';
    if ($forum_config['o_users_online'] == '1')
    {
        // Fetch users online info and generate strings for output
        $query = array(
            'SELECT'    => 'o.user_id, o.ident',
            'FROM'        => 'online AS o',
            'WHERE'        => 'o.idle=0',
            'ORDER BY'    => 'o.ident'
        );
        $result = $forum_db->query_build($query) or error(__FILE__, __LINE__);
        $num_guests = 0;
        $users = array();

        while ($forum_user_online = $forum_db->fetch_assoc($result))
        {

            if ($forum_user_online['user_id'] > 1)
                $users[] = '<a href="'.forum_link($forum_url['user'], $forum_user_online['user_id']).'">'.forum_htmlencode($forum_user_online['ident']).'</a>';
            else
                ++$num_guests;
            
        }

        // If there are registered users logged in, list them
        if (count($users) > 0)
            //$users_online = '<p><strong>'.$forum_user['Online'].'</strong> '.implode(', ', $users).'</p>';<!--Décommenter cette ligne pour afficher les utilisateurs en ligne-->

        $stats_online[] = 'Membres en ligne: <strong>'.count($users).'</strong><br />';
        $stats_online[] = 'Visiteurs en ligne: <strong>'.$num_guests.'</strong>';
    }
    
    $avatar = generate_avatar_markup($forum_user['id']);
?>
<?php echo Bienvenue ?>: <strong><?php echo forum_htmlencode($forum_user['username']) ?>  </strong> <br />
<?php echo $links['logout'] = '<span id="navlogout"><a href="'.forum_link($forum_url['logout'], array($forum_user['id'], generate_form_token('logout'.$forum_user['id']))).'">'.$lang_common['Logout'].'</a></span> | ';?>
<?php echo $links['profile'] = '<span id="navprofile"'.((substr(FORUM_PAGE, 0, 7) == 'profile') ? ' class="isactive"' : '').'><a href="'.forum_link($forum_url['user'], $forum_user['id']).'">'.$lang_common['Profile'].'</a></span> | ';?>
<?php echo $links['userlist'] = '<span id="navuserlist"'.((FORUM_PAGE == 'userlist') ? ' class="isactive"' : '').'><a href="'.forum_link($forum_url['users']).'">'.$lang_common['User list'].'</a></span>';?>
<?php if ($avatar != '') : ?>
            <?php echo $avatar ?>
<?php else : ?>
<?php endif; ?>
            <ul class="stats-online">
                <?php echo implode("\n\t\t\t", $stats_online) ?>
            </ul>
        
            <?php //if (isset($users_online)) : echo $users_online; endif; ?><!--Décommenter cette ligne pour afficher les utilisateurs en ligne-->

<?php

}


// Else user is not logged, display login form
else
{
    $cur_panel['title'] = $lang_common['Login'];

    require_once FORUM_ROOT.'lang/'.$forum_user['language'].'/login.php';
    $form_action = forum_link($forum_url['login']);
?>
    <?php echo Bienvenue ?>: <strong><?php echo $lang_login['Guest'] ?></strong>    <br />
    <?php echo $lang_login['Please login'] ?><br />
    <a href="<?php echo forum_link($forum_url['register']) ?>"><?php echo $lang_login['Register'] ?></a>
    <a href="<?php echo forum_link($forum_url['request_password']) ?>"><?php echo $lang_login['New password'] ?></a><br />
    <form method="post" action="<?php echo $form_action ?>">
        <div class="hidden">
            <input type="hidden" name="form_sent" value="1" />
            <input type="hidden" name="redirect_url" value="<?php echo get_current_url() ?>" />
            <input type="hidden" name="csrf_token" value="<?php echo generate_form_token($form_action) ?>" />
        </div>
        <div class="panel-input">
            <?php echo $lang_login['Username'] ?>
            <input type="text" name="req_username" size="13" /><br />
        </div>
        <div class="panel-input">
            <?php echo $lang_login['Password'] ?>
            <input type="password" name="req_password" size="13" /><br />
        </div>
        <div>
            <label for="fld-remember-me"><span class="fld-label"><?php echo $lang_login['Remember me'] ?></span>&nbsp;<input type="checkbox" id="fld-remember-me" name="save_pass" value="1" /></label>
            <span class="submit"><input type="submit" name="login" value="<?php echo $lang_common['Login'] ?>" /></span>
        </div>
            
            
</form><?php

}

// this variable is also used for display statistics on forums page
unset($stats_list);

?>

Obviously, this code requires adding the extra links contained in the navlinks. Personally, I don't need more than that.

To the login file of your "language pack" (?), add the following lines (translate according to your needs):

'Guest'                                =>    'Visiteur',
'Welcome'                            =>    'Bienvenue',
'Please login'                        =>    'Déjà inscrit? Connectez-vous.',
'Register'                            =>    'S\'enregistrer',
'New password'                        =>    'Redéfinir mot de passe'

Finally, you'll have to create some CSS based on the theme of your site. This code works fine. It could require some thorough code inspection, but I don't know PHP.

45

(3 replies, posted in Discussions)

Works great smile I just had to copy/paste the code to /var/www/logon.php and once authenticated, redirect the user to /var/www/index.html.

One little thing, though: Does someone know how to remove the trailing "login=1" that PunBB adds after redirecting the user?

http://192.168.0.1/index.html?login=1

Thank you.

46

(3 replies, posted in Discussions)

Thanks Grez. Looks like just what I was looking for. I'll give it a try tomorrow and report back.

47

(3 replies, posted in Discussions)

Hello

On the same site, I'd like to provide a forum (PunBB, naturally) and a blog (TextPattern or some other solution) so users can post comments.

I don't want users to have to log on twice, once to post to the forum, and the other to type comments.

If someone's already done this: Is it easy to plug another PHP application to use the PunBB database/tables to take care of authentication?

Thank you.

48

(5 replies, posted in PunBB 1.2 discussion)

Smartys wrote:

I don't believe there is a Debian package for PunBB. And although I agree that apt-get/dpkg are easier, untaring a folder in the correct location isn't difficult smile

I know but I prefer to install everything through the package manager so as to get a quick view of what's installed.

I'll see how to build one from source code.

Thanks.

49

(5 replies, posted in PunBB 1.2 discussion)

Hello

I'm only beginning with Debian, so it might be something obvious, but it seems like PunBB is not available as a package in the Debian repository:

http://packages.debian.org/stable/web/

I'd rather install PunBB through dpkg/apt-get instead of compiling a tarball. Does someone know if a Debian package is available somewhere else, and if yes, whether I just need to add the link to it in /etc/dpkg/origins/debian for that other repository to be available?

Thank you.