126

(26 replies, posted in Feature requests)

Well, randomsalt algorythm also will need a sort of migration module...
And boolean field in "users" table, shows that password is randomsalt hashed, and password hash check, using that field.
And all "change password" and "register new user" have to use randomsalt hashing.
Anyways you'll be unable to "rehash" all users passwords hash codes to new ones.
So, this task could be resolved only on clear dbase OR when password migration scheme will work.

I wonder, why the password maximum length is 16?? why not 32? smile
Also, is there any "restore forgotten password" possible? I think not. So, what about it? smile

there are some style incorrectness, when there is no messages, from left of that textline, in that table, there is second vertical line, that shouldn't be there... it's got to be fixed by:

    echo '<tr><td class="puncon1" colspan="'.$cols.'">'.$lang_pms['No messages'].'</td></tr>'."\n";
line 357 ... replace to
    echo '<tr><td class="tcl" colspan="'.$cols.'">'.$lang_pms['No messages'].'</td></tr>'."\n";

also to hide "delete multiple messages" where you are already in that mode , edit include/pms/footer_links.php line 14

if ($messages_exist)

replace to

if ($messages_exist && !(isset($_GET['action']) && $_GET['action'] == 'multidelete'))

128

(26 replies, posted in Feature requests)

there were problems with someting like
[b ][b ][/b ] or [code ][code ][/code ]

or cascaded BBCodes..
or maybe variables entered in url string?
well, phpbb were hacked through url string (path and variables)

129

(26 replies, posted in Feature requests)

well, you need to limit db activity only to http server (by firewall). after that you won't be able to access db directly.
but hackers often use php scripts holes, to execute selects from dbase.
i wonder, is there any hole in punbb, to execute custom selection, or even update and other sql commands?

130

(26 replies, posted in Feature requests)

Damn. I'm confused.
How will it helps anyway? If brutforce will be through login.php - there will be no difference how to hash passwords...
also he would be able to stole salt string
and find out that md5(md5()) is used...
no sense...

131

(26 replies, posted in Feature requests)

anyways, you must somehow update current userlist.. how? you have only md5 hashes...
and if this salt string will be stolen - it won't have any sense.

I've updated "install_mod.php" to update_forum after installing.. To avoid null subject names.
You can run this code in php. I haven't found built-in forums update in administration
make .php file with this code, and run it.

<?php
define('PUN_ROOT', './');
require PUN_ROOT.'include/common.php';


    $result = $db->query('SELECT id FROM '.$db->prefix.'forums') or error('Unable to fetch forum info.', __FILE__, __LINE__, $db->error());

    while ($row = $db->fetch_row($result))
        update_forum($row[0]);

Ign1111, ?????? ???????, ??? EasyPoll - ???????? ? ?????? ????. ?? ??????????? ? ??? ????????????? ?? ????????? ?????? ??????????? ????????????? ? ????? ??? "???????"?
? - ????????. ?????? ???????, ??? ??????? ??? ?? ???????????.
????? ????? ????? ???????? ???-???? ?????? ?? ???????? ????-???? ?????????, ? ???-???? ???????? ????.
?????? ????? ??????? ????? ???????????? ???.

??? ???? ???????? ????? ?????.
5) ???????? ????? (????????), ? ??????????. (?? ???? ????? ? ??????????, ? ??? ??? ????? ????? ??? ?????? ??????????).

134

(6 replies, posted in Feature requests)

Woman - as rank? LOL smile))

135

(6 replies, posted in Feature requests)

http://www.punres.org/viewtopic.php?id=213
lol smile
Who will write this instruction "how to add new attribute to profile"? I think it will be nice smile

"Show your posts" from index page (in the bottom of page) will show you messages, related to you smile
"Show recent posts" is also good.

137

(26 replies, posted in Feature requests)

what is "random salt"?
where can I read about it?

as for converter for doublehashed passwords:
1. add boolean field "dblhashpass" to "users" table
2. in all places using md5 - check this field, and if true - use md5(md5()).
3. when registering new user or changing password - make it "true".

well. a sort of smile

138

(21 replies, posted in General discussion)

its' a stupid fashion to make all tags dummie-understandable.
<i> and <b> tags are perfect.
short tag names safe bandwidth and time to write them (not everyone is using dreamweaver or frontpage, some use notepad smile ).

Glad to hear that smile
I don't cnow why this "last subject" feature isn't integrated into punbb by default...
Maybe Rickard will argue. Maybe server will be overloaded? I don't know, but I don't think so.

What exactly??

explode() will help to use a number of URLs from one string.

I've finished with actual install_mod.php and readme.txt with instructions.
take it from here

SELECT c.id AS cid, c.cat_name, f.id AS fid,
f.forum_name, f.forum_desc, f.redirect_url,
f.moderators, f.num_topics, f.num_posts,
f.last_post, f.last_post_id, f.last_poster,
t.subject
FROM '.$db->prefix.'categories AS c
INNER JOIN '.$db->prefix.'forums AS f ON c.id=f.cat_id
LEFT JOIN '.$db->prefix.'posts AS p ON p.id=f.last_post_id
LEFT JOIN '.$db->prefix.'topics AS t ON t.id=p.topic_id
LEFT JOIN '.$db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].')
WHERE fp.read_forum IS NULL OR fp.read_forum=1
ORDER BY c.disp_position, c.id, f.disp_position

it makes little SQL perfomance decrease.
other way to make this - to add "subject" column to "forums" table, and fix some inserts/updates in include/functions.php

And if you need to use multilanguage support:
after line 69 lang/English/common.php

'by'=>'by',    // as in last post by someuser

insert

'in'=>'in',    // as in last post in some topic

and second replace code fragment from above must be:

    // If there is a last_post/last_poster.
    if ($cur_forum['last_post'] != '')
$last_post = format_time($cur_forum['last_post']).' '.$lang_common['by'].' '.pun_htmlspecialchars($cur_forum['last_poster']).'<span class="byuser">'.$lang_common['in'].' <a href="viewtopic.php?pid='.$cur_forum['last_post_id'].'#p'.$cur_forum['last_post_id'].'">'.pun_htmlspecialchars($cur_forum['subject']).'</a></span>';

Got it.
And when it will be released?
About week/month/couple_of_monthes/half_a_year/year? smile

in punbb 1.2.4

replace line 41 of index.php

// Print the categories and forums
$result = $db->query('SELECT c.id AS cid, c.cat_name, f.id AS fid, f.forum_name, f.forum_desc, f.redirect_url, f.moderators, f.num_topics, f.num_posts, f.last_post, f.last_post_id, f.last_poster FROM '.$db->prefix.'categories AS c INNER JOIN '.$db->prefix.'forums AS f ON c.id=f.cat_id LEFT JOIN '.$db->prefix.'forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].') WHERE fp.read_forum IS NULL OR fp.read_forum=1 ORDER BY c.disp_position, c.id, f.disp_position', true) or error('Unable to fetch category/forum list', __FILE__, __LINE__, $db->error());

with

// Print the categories and forums
$result = $db->query('
SELECT c.id AS cid, c.cat_name, f.id AS fid,
f.forum_name, f.forum_desc, f.redirect_url,
f.moderators, f.num_topics, f.num_posts,
f.last_post, f.last_post_id, f.last_poster,
t.subject
FROM '.$db->prefix.'categories AS c
INNER JOIN '.$db->prefix.'forums AS f ON c.id=f.cat_id
INNER JOIN '.$db->prefix.'posts AS p ON p.id=f.last_post_id
INNER JOIN '.$db->prefix.'topics AS t ON t.id=p.topic_id
LEFT JOIN forum_perms AS fp ON (fp.forum_id=f.id AND fp.group_id='.$pun_user['g_id'].')
WHERE fp.read_forum IS NULL OR fp.read_forum=1
ORDER BY c.disp_position, c.id, f.disp_position
', true) or error('Unable to fetch category/forum list', __FILE__, __LINE__, $db->error());

replace line 109 index.php

    // If there is a last_post/last_poster.
    if ($cur_forum['last_post'] != '')
        $last_post = '<a href="viewtopic.php?pid='.$cur_forum['last_post_id'].'#p'.$cur_forum['last_post_id'].'">'.format_time($cur_forum['last_post']).'</a> <span class="byuser">'.$lang_common['by'].' '.pun_htmlspecialchars($cur_forum['last_poster']).'</span>';

with

    // If there is a last_post/last_poster.
    if ($cur_forum['last_post'] != '')
        $last_post = format_time($cur_forum['last_post']).' '.$lang_common['by'].' '.pun_htmlspecialchars($cur_forum['last_poster']).'<span class="byuser"> in <a href="viewtopic.php?pid='.$cur_forum['last_post_id'].'#p'.$cur_forum['last_post_id'].'">'.pun_htmlspecialchars($cur_forum['subject']).'</a></span>';

Yes, not everyone will notice that.
But anyways, DNS of intranet may use VERY OTHER from external name. Specially when it a sort of dynamic IP or NAT mapping.
If server has two providers, each of them assignes server's name under their domain. In this case, possibility of two addresses for admins/moderators will be very useful.

148

(2 replies, posted in PunBB 1.2 bug reports)

http://punbb.org/forums/viewtopic.php?id=6770
it already have a fix smile

Frank, and what about those who haven't 1.0 version, and have no need to "upgrade". Just set it up on pure punbb... They could be able to use it before those who have a "migration script"

And one question about filename of stored files. How they will be named? As uploaded? If so, what if there is already that filename stored? If not - will they be renamed as template like '_post_'.$last_filenum.$extension and simply "select id, real_filename, author, date from attachment_list " table ?
This is "plugin/mod", people really need. So don't delay beta/release smile

Rickard, because machine has more then one ethernet interface, there is not only one correct urls.
Each url is correct for people.
some people from one interface, from intranet and using internal IP.
other - from internet. and they have to use external IP.
If I choose only external IP, people from intranet.. They had to use external IP. Some of them are just unable to go internet.. others - will pay much more.
To work this out I had to add other cascaded hardcoded check for other IP.
And by the way. You may use it through "localhost" address.