Search options (Page 12 of 307)

extern.php only shows what Guests can read. If they can't read those other fids, which they can't, then nothing gets shown.

Actually, it'll just look something like this
http://www.punbb-hosting.com/forums/travian/
(The message in English is "You do not have permission to view these forums.")

You can certainly edit your language files to link to the registration page in that message or edit the actual code to add a login box or something.

Moved to Troubleshooting
Yes, you can disable posting for guests. Just edit the forums and uncheck the boxes that allow Guests to post.

Then try adding:

.pun .tclcon { BORDER-LEFT: 1px #363636 solid; }

Oh look, your host has its own domain name. And cPanel? Of course they're trustworthy! I mean, those are two very big, important hosting things. It's not like you can buy a domain name for $10 and get cPanel for < $100 (or for free, if it's a cracked copy). And lets not forget their great deals: they offer free hosting AND they offer unlimited bandwidth and hard drive space for under $5 per month! It's not like computer space really costs more than that....
Seriously. I mean, it's certainly possible that one of your modifications allowed the hacker to take control of your fourm AND get the password for your cPanel, but I doubt it.

1.3, and yes, that would be simplest.

One thing has nothing to do with the other, and there's no need to reindex for MySQL(i) since it uses MySQL fulltext indexing.

For manual admin approval.

I wasn't thinking about having admin/options.php save to a different location, but you're right, that probably would be easiest.
And your folder would be no different than PunBB's cache folder. It doesn't have to be 777, PHP just needs permission to write there.

And I like your code, other than the fact that you're again taking arbitrary input from the user ($_GET['domain']) and using it in an include, which is a security flaw.

Which has absolutely no relevance here. The cookie seed does not allow someone to change your cPanel password or view your config.php file. And to see the cookie seed you need to have access to config.php in the first place.

Well, I would write it as

if (strpos($_GET['file'], '..') === false && is_file($file = PUN_ROOT.$_GET['file']) && in_array(strrchr($_GET['file'], '.'), array('.php', '.html', '.htm', '.tpl', '.txt', '.xml'))
    include $file;
else
    include PUN_ROOT.'index.php';

and also make sure there's no null byte (I can't remember if it could be abused in this case, but I'm relatively sure it could). It still wouldn't be extremely secure, since if I can upload any of those file types I can execute arbitrary PHP on the server.
A better solution might be to see if mod_rewrite can rewrite the requests to the correct folder and append a variable to the query string like "subdomain=test.example.com" which you could then use in a lookup.

Well, no, the problem is that I could really put an arbitrary number of subdirectories in there and try to use it (eg: admin/index.php, extensions/sample_extension/some_file.php, extensions/sample_extension/some_other_file.html, etc). I don't think there's a clean solution to the problem, really, other than defining some allowed extensions (eg: .php, .htm, .html) and only allowing loading if the file ends in those as well (of course, you probably also need to check for null bytes),