526

(5 replies, posted in Programming)

It actually isn't as bad as you think tongue
It's more of an issue for XSS/SQL inject, since I can put quotes, HTML, etc into the request URI. However, I don't think you can redirect people to arbitrary sites that way.
But I don't think REQUEST_URI is what you're looking for. That's data on the current page, not on any referring page. If you want to see how 1.3 deals with the issue, check out the prev_url column in the online table.

527

(69 replies, posted in News)

neofutur: Look harder at the hdiff. The lines moved.
MattF: Good point, that's certainly possible

528

(7 replies, posted in PunBB 1.2 troubleshooting)

The code works fine, I just tested it.
I believe you actually have to send a POST request without req_file set to trigger that error.

529

(7 replies, posted in PunBB 1.2 troubleshooting)

Moved to Troubleshooting, since that's 1.2 code, not 1.3 code.
The code in 1.3 did have a slight issue with an undefined index, which I'm fixing now.

530

(8 replies, posted in PunBB 1.3 troubleshooting)

It would also lose meaning.
For example:

[url=http://punbb.org/forums/viewtopic.php?id=6859]You might want to try this modification[/url] ;)

versus

You might want to try this modification ;)

Not to mention that stripping it would be very annoying to code. tongue

An extension, possibly, but I doubt it will go in the core.

531

(69 replies, posted in News)

Could the users have deleted their messages?
There are no outstanding security vulnerabilities as of 1.2.17, so if that's what you're using, then I doubt it's due to that.

Then that's not admin activation per-se, that's simply trying to block spam registrations. For example:

http://www.punres.org/desc.php?pid=347
http://www.punres.org/desc.php?pid=400

I'm not seeing the difference between what you want and what I'm suggesting. Turn off the permission to Read board for that group and they're essentially not activated.

As for mass deleting users, try the User Management plugin

534

(8 replies, posted in PunBB 1.3 troubleshooting)

http://punbb.org/forums/viewtopic.php?id=18195
http://punbb.org/forums/viewtopic.php?id=10943
for example

1. Set the default usergroup to one that can't see much of anything. Manually move people out of it.
2. I don't know that anyone has written that one.

536

(69 replies, posted in News)

erased messages? I don't know what that means, it's not possible that updating the forum would do that.
As for double login, I usually see that in sites that are accessible both with and without the www., like yours is. You can either redirect all traffic to one of the two or set $cookie_domain in config.php to .forocure.com.ar

537

(12 replies, posted in PunBB 1.2 troubleshooting)

Check out preparse_bbcode, I think you'll need to add your stuff there.

Upgrading is a good idea.
If that doesn't fix it, enable debug mode and paste the full error.

539

(2 replies, posted in PunBB 1.3 troubleshooting)

The language strings are not yet finalized, so while you're welcome to get started, there is no guarantee that we won't add/change/remove strings.

540

(12 replies, posted in PunBB 1.2 troubleshooting)

I don't know how GeSHi works, but my assumption is that it's the result of a double escaping via htmlspecialchars.
Try

FIND

$geshi = @new GeSHi($text, "autoit", PUN_ROOT."/include");

REPLACE WITH

$geshi = @new GeSHi(html_entity_decode($text), "autoit", PUN_ROOT."/include");

541

(12 replies, posted in PunBB 1.2 troubleshooting)

Look at how URL BBCode is handled in the code you just pasted. Emulate that.

542

(12 replies, posted in PunBB 1.2 troubleshooting)

make a function, like is done for the URL tags, parse in there and return the parsed value.

543

(7 replies, posted in PunBB 1.3 troubleshooting)

Consider them a reminder that the HEAD revision from SVN of beta software is not meant to be used on a production website. tongue

544

(12 replies, posted in PunBB 1.2 troubleshooting)

If you're running that outside of the parser, the HTML is going to be sanitized for obvious reasons./

545

(5 replies, posted in PunBB 1.3 extensions)

http://php.net/manual/fr/function.mysql … -query.php

Right. We added a CSRF token to the logout URL, with the token being a pun_hash of user ID prepended to the current IP.

547

(5 replies, posted in PunBB 1.3 extensions)

Because that was not using an unbuffered query. wink
However, buffered query or not, it is never a good idea to run a query in a loop.

My original thought was that you had the Akismet modification installed and that was the reason for the delay, but since you don't have the plugin, I doubt the modification was installed.
Anyway, your best bet would be to enable debug mode and see if the page generation time when posting in those cases is high or not. If it is, then you need to figure out what is causing there (most likely a modification of some kind).

PUN_ROOT is where your forum is on your server (eg: where config.php is).

550

(8 replies, posted in PunBB 1.3 extensions)

Indeed tongue