Search options (Page 247 of 307)

If you had removed everything from your search index first, the backup would be smaller
I just imported it locally: it worked fine (and, without anything in the search tables, it's below 2MB, meaning it can be imported properly). To get search to work you'd have to rebuild the search index, but you could do it

http://dev.punbb.org/timeline
You can see commits for both the trunk and 1.3

http://dev.punbb.org/browser/branches/punbb-1.3-dev/
And there's 1.3 itself

Yes, you can submit a form multiple times with different data and PunBB will accept it
*gasp*
Seriously, that's just about the only implication of this. If you're having issues with someone doing it, you can ban the IP and then use this plugin to deal with the accounts (if they're coming from more than one IP, nothing PunBB other than something like allowing one registration every 30 seconds for everyone will deal with the "bug"). It is nowhere near as big a deal as they make it seem.

Oh, and as for the brute force login: yes, most logins are vulnerable to this
If you're worried, you can always do what they suggest and block based on IP, but I'm sure that more "creative" hackers will simply get a fresh list of proxies and use them to get around it

Edit:
http://punbb.org/forums/viewtopic.php?id=10657
That is a slight bit more of an issue, but it's essentially harmless. Same deal though.

Very interesting
If it happens again, just post: I'll be looking into this bug

I've never heard of that, or maybe I'm just not understanding what you're saying. Could you give an example?

HaVoC: Try deleting all your cache files, see if that does anything

Did you upload the backup to the same folder as the plugin?

That's because your dump is too large to do that way

Here's what you should do:
0. (I forgot to add this before ) Install a fresh copy of PunBB
1. Upload the dump to the fresh copy's website in the plugins folder. Call it backup.sql
2. Download the DB Management plugin
3. Open the code up, find

elseif ( isset($_POST['restore_start']) ) {
    // Restore SQL Dump
    //
    // Handle the file upload ....
    // If no file was uploaded report an error...
    //
    $backup_file_name = (!empty($HTTP_POST_FILES['backup_file']['name'])) ? $HTTP_POST_FILES['backup_file']['name'] : "";
    $backup_file_tmpname = ($HTTP_POST_FILES['backup_file']['tmp_name'] != "none") ? $HTTP_POST_FILES['backup_file']['tmp_name'] : "";
    $backup_file_type = (!empty($HTTP_POST_FILES['backup_file']['type'])) ? $HTTP_POST_FILES['backup_file']['type'] : "";
    if($backup_file_tmpname == "" || $backup_file_name == "")
    {
        message('No file was uploaed or the upload failed, the database was not restored');
    }
    if( preg_match("/^(text\/[a-zA-Z]+)|(application\/(x\-)?gzip(\-compressed)?)|(application\/octet-stream)$/is", $backup_file_type) )
    {
        if( preg_match("/\.gz$/is",$backup_file_name) )
        {
            $do_gzip_compress = FALSE;
            $phpver = phpversion();
            if($phpver >= "4.0")
            {
                if(extension_loaded("zlib"))
                {
                    $do_gzip_compress = TRUE;
                }
            }
            if($do_gzip_compress)
            {
                $gz_ptr = gzopen($backup_file_tmpname, 'rb');
                $sql_query = "";
                while( !gzeof($gz_ptr) )
                {
                    $sql_query .= gzgets($gz_ptr, 100000);
                }
            }
            else
            {
                message('Sorry the database could not be restored');
            }
        }
        else
        {
            $sql_query = fread(fopen($backup_file_tmpname, 'r'), filesize($backup_file_tmpname));
        }
    }
    else
    {
        message('Error the file name or file format caused an error, the database was not restored');
    }

Replace with

elseif ( isset($_POST['restore_start']) ) {
    $sql_query = fread(fopen('backup.sql', 'r'), filesize('backup.sql'));

3. Upload the plugin, go to the plugin's page and hit the Restore button. It might take a while, but it should restore

You have to answer my question
The database your PunBB is using is named plich73_1sql. It can't find the tables you imported (I'm assuming you did import them ). Since I have a copy of the dump and can see the prefixes are right, that means you imported the SQL dump was not imported into the database.

It isn't a security bug
All he's saying is that I can hit refresh on the form on the forgot password change and get it to send as many emails as I want. That seems to be a very popular type of "bug" recently with PunBB: I guess that means anything really serious has been taken care of

Except PunBB doesn't use sessions at all

Edit: I just double checked and phpBB and vB suffer from the same issue

Bekko: He wants to merge two PunBB forums together

I figured, it explained a bit about why my setup was so odd