176

(13 replies, posted in PunBB 1.2 discussion)

The reason we went with target="_blank" as opposed to window.open() is to get around the issue with broken popup stoppers (most of them).

177

(26 replies, posted in PunBB 1.2 discussion)

I would like to stress that this is a temporary thing. For the release of 1.3, we'll have a completely redesigned web site.

178

(13 replies, posted in PunBB 1.2 discussion)

So the problem is that we're opening all links with rel="external" in a new window and that this might include links that are used elsewhere in the template? If that's the case, how about we limit the javascript to look for such links within its own container div?

The problem with that is that in rewrite.php, we have yet to log the user in, so we have no idea what language to use. There's also the issue of users running different languages pasting links (they won't work for anyone using a different language).

180

(14 replies, posted in PunBB 1.2 discussion)

Yeah, I already ate it.

Or take it straight from the horses mouth big_smile

http://blog.punbb.org/2007/09/18/preven … f-attacks/

182

(7 replies, posted in Programming)

if (function_exists('fopen'))
   // bla bla

Hosts completely disabling fopen() is quite rare though. They generally just disable allow_url_fopen.

Unless you figure out how to solve this yourself, you'll have to wait for PunBB 1.3 in which the referrer check has been obsoleted.

Personally, I think the idea of a MVC style CMS that integrates with PunBB is good news. I don't understand what some of you have against this project. Well done, foxmask!

It determines whether or not to setup a persistent connection to the database. Generally, you don't want this so just set it to false.

186

(71 replies, posted in News)

MattF wrote:

Cheers for the update. smile Just one quickie. With the profile.php change, would it not be simpler to just make that a preliminary check in profile.php near the top of the file, so that it acts as a cover all incase anyone mods their file later on with something problematical?

confirm_referrer() is gone in 1.3. See http://blog.punbb.org/2007/09/18/preven … f-attacks/

187

(71 replies, posted in News)

I have now updated the downloads and hdiffs/patches. The change is one line only. If you downloaded and updated already, locate the following in include/functions.php

$destination_url = str_replace(array("\r", "\n", '%0a', '%0d', ';'), '', $destination_url);

and replace it with

$destination_url = preg_replace('/([\r\n])|(%0[ad])|(;[\s]*data[\s]*:)/i', '', $destination_url);

Sorry for the mess up.

188

(71 replies, posted in News)

Whoops big_smile I'll sort this out tonight. Sorry for the mess.

189

(12 replies, posted in Programming)

Annoy the hell out of unwanted visitors? I like it smile

190

(14 replies, posted in PunBB 1.2 discussion)

As much as we appreciate tips on how to optimize PunBB, I would like to point out that this particular optimization probably won't be measurable considering we're talking about only a few iterations. In other words, I wouldn't bother porting this to 1.2. Still, as we say in Sweden, many streams make a river smile

191

(71 replies, posted in News)

Here's just a short message announcing the release of 1.2.16. This time around, we've fixed two security vulnerabilities and corrected topic/post counts for forums to include redirected topics. The only two scripts affected by the update are profile.php (two lines) and include/functions.php (a few lines). The vulnerabilities are relatively serious, so we recommend that everyone upgrade as soon as possible.

Thanks to the people who reported the issues (details in the changelog).

Now, back to 1.3 ...

192

(124 replies, posted in News)

seleterresis6 wrote:

Rickard, I'm sorry if this question has been answered anywhere else (I couldn't find the answer though), but would you release security patches for the 1.2.x versions after 1.3 is released? It seems that I won't need the functionality of 1.3 and it would be too hard to upgrade to 1.3 for me (a lot of self-written code, many changes to CSS etc).

It is my intention to continue supporting 1.2 for some time after the release of 1.3. There won't be any feature additions to 1.2, but we will at the very least release fixes for more serious security problems.

Very nice smile

194

(124 replies, posted in News)

StevenBullen wrote:

You was very vague on what this new holder wants to do.

I think I was as clear as the situation warrants. Can't we just wait 6 months and see where we are then? I'm certain you will not be disappointed. Give us the benefit of the doubt.

195

(2 replies, posted in PunBB 1.2 discussion)

I don't believe the performance benefits are all that noticeable. I haven't done any benchmarking, but my guess is that if there was a large performance gain, the PHP folks would be pushing it more.

196

(124 replies, posted in News)

One learns something new almost every day smile

197

(124 replies, posted in News)

Enough with the drama. This isn't the "End of free PunBB". PunBB is GPL and will remain so. If push comes to shove, I'll fork it myself!

Regarding the copyright notice in the footer. Keeping it has always been optional. Actually, we decided to remove the notice altogether a year ago.

198

(124 replies, posted in News)

trakman wrote:

thanks Rickard for the update, can we get more regular updates like maybe weekly?

Most certainly. Paul had an idea earlier today that we should have a simple todo list with percentages for each item (e.g. "80% done"). I'll try to get that up tomorrow.

199

(124 replies, posted in News)

Jérémie: They are sponsoring the development of 1.3. That doesn't change the fact that we are all busy with non-PunBB related obligations and that we occasionally like to not work. But rest assured, we're back on track.

Jérémie wrote:

Yes, on the paper PunBB 1.3 (well, probaly 1.3.5 or something, it won't be perfect at the first try) could very well be the best forum software, period.

Two problems though:

- 1.3 isn't here
- there's some question about the current and future state of PunBB (ownership, etc.)

This should clear things up a bit.

Also, on the topic of other forum software with a similar plugin architecture to PunBB 1.3, one would have to mention vBulletin 3.something. PunBB's system is based on the same principle as vBulletin's system. I do believe we've taken it a few steps further though.