I released the little hack I wrote here some time ago as a mod.
I think everybody who is concerned about security and wants to add abit of it at no cost should have that smile

What the mod does:

When you open an admin page the browser will ask you for an extra username/password just as if they were protected by a .htaccess file.
This username/password is stored in a text file on your server.
When somebody hacks your board he will not be able to do damage in the admin section unless he finds the extra. password.

You can download the mod from punres.org or here:

mod_extra_security-1_0.tgz

and, as usual, for the windows folks there is

mod_extra_security-1_0.zip


PS:
The mod is installed in 2 minutes, it is really easy

PPS:
Since you need an md5 encoded password you need an md5 encoder to make the password file.
I have one here in case you don't know how to do that.

227

(7 replies, posted in Programming)

Depends on your table.
An order on a heavy table always causes load especially when the field you order by is not indexed.
If you have a normally frequented board I wouldn't say it's an issue.

@af3: Yes, the preview button is commented out. That can not work with image upload. Sorry this is the price to pay.. wink

@smartmonkey: Which version are you running?

229

(7 replies, posted in Programming)

Yes, it is possible.

$arr=array(5,7,2,3,1);
$implode=implode(",",$arr);
$order = implode(", id=", $arr);
        
$result=$db->query('SELECT myinfo FROM mytable WHERE id IN(".$implode.") order by id=" . $order);

while($sub=$db->fetch_assoc($result)){
//spit out the information
}

But does it look nice?
Nope.
wink

Either that or you didn't install correctly.
I do not know the attachment mod so it may be..... but I hope it's just a mistake you made.. wink

sif wrote:

It works fine exept that i have to upload once and after edit again the same post and upload then again for it to work.
But it' s ok for me.=)

Not only from a perfectionist's point of view this is definitely not ok smile
Maybe it is some strange caching problem with your browser?

Hm.
Still sounds something that the attachment mod should handle.
My little mod exists only because displaying pictures inline was the only thing the attachment mod could not do.
Otherwise it looks like a swiss army knife and I'm sure with a little tweaking it can do what you want.

Well, for PDFs I think it might be OK to use the existing attachment mod.
It seems to be useful for many people.
My mod is for showing images inline, not linking to files. That's a different story....

Stupid me!

Forgot this in the readme.txt sad

Here we go:
Open admin_options.php

Find line 561:

            <div class="inform">
                    <fieldset>
                        <legend>E-mail</legend>

Before, add

<!-- MOD IMAGEPOST -->
            <div class="inform">
          <fieldset>
            <legend>Mod Imagepost</legend>
            <div class="infldset">
              <table class="aligntop" cellspacing="0">
                <tr>
                  <th scope="row">Supported Formats</th>
                  <td>
                    <input type="text" name="form[image_formats]" size="45" maxlength="45" value="<?php echo $pun_config['o_image_formats'] ?>" />
                    <span>The supported image formats for upload (defauts to gif,png,jpg,jpeg).</span>
                  </td>
                </tr>
                <tr>
                  <th scope="row">Max Bytes</th>
                  <td>
                    <input type="text" name="form[image_maxbytes]" size="7" maxlength="7" value="<?php echo $pun_config['o_image_maxbytes'] ?>" />
                    <span>The maximum allowed size of avatars in bytes (102400 is default).</span>
                  </td>
                </tr>
                <tr>
                  <th scope="row">Max Dimensions</th>
                  <td>
                    <input type="text" name="form[image_maxdimensions]" size="9" maxlength="9" value="<?php echo $pun_config['o_image_maxdimensions'] ?>" />
                    <span>The maximum allowed Dimensions of avatars in pixels (640x480 is default)</span>
                  </td>
                </tr>
              </table>
            </div>
          </fieldset>
        </div>
<!-- // MOD IMAGEPOST -->

That's all.
You will then find the possibility to set dimensions, max. bytes and supported formats in admin->options below the avatar part.

I'll update the readme.txt as well..... sad

235

(14 replies, posted in PunBB 1.2 troubleshooting)

You can base your layout on an existing one.
If you want to base on Oxygen f.e., just copy Oxygen.css and imports/Oxygen_cs.css to whatever you like.
The latter contains the color definitions.

There is also a tool to create color schemes on the fly called SpinkBB that might do exactly what you want.

No,
in edit.php it says

if((isset($_POST['delete_userimage']) and $_POST['delete_userimage'] == 1) or is_uploaded_file($_FILES['userimage']['tmp_name']))  {
    include_once(PUN_ROOT.'/include/mod_imagepost.php');
    @unlink($userdir .'/'. $_POST['current_userimage']);
    }

for those who don't speak *nix: "unlink" means "throw it away and don't ask questions" smile

Hm. I'm not sure if I got this one.

As an admin you can always edit a post which means you can also remove the picture. No three clicks here.

Or what did you mean exactly?
And no, you don't have to stop, it is OK to get an idea what people really need, right?

Yeah, but that would be more like the gallery mod, wouldn't it?
Anyway, I'll make something that shows all the pics w/o the posts and see how it goes from there.

Well, this really depends on your layout I guess.
Having it beneath is safer in most situations.
Imagine you have someone uploading a picture of 600 pixel width but your board is set to 550....

So if you want - yes, but at your own risk. I will not pay for damage caused by oversized pics destroying your layout smile

Here we go:

Open viewtopic.php and go for line 329:

<?php echo $cur_post['message']."\n" ?>
<!-- MOD IMAGE POST -->
                    <?php if ($cur_post['userimage'] != '') echo "<br /><img src=\"".PUN_ROOT."img/users/" . $cur_post['userimage'] ."\" alt=\"" . $cur_post['userimage'] ."\">\n"; ?>
<!-- // MOD IMAGE POST -->

It will be easy to put the Image post part before the cur_post['message'] part and add "align='left'" to the image tag.
Or wahetever else you prefer. Simple HTML - but not layout savvy....

What did you set the maximum size to?

Just open the mod_install.php and see what it does there.
Copy the commands, replace $db->prefix with your prefix, call "SQL" in your table overview in phpMyAdmin and paste it there.

Rod wrote:

Very interesting ... maybe I'll contact you for a bigger project smile but for newbies, it's perfect. is it possible to have a page which lists the uploaded files ?

No, but just beause I haven't thought about that yet. I think it's a good idea though, both for admins and users so I'll work on that. When I find some hours that is, unfortunately I have clients molesting me with jobs from time to time... smile

pogenwurst wrote:

Once upon a time I downloaded a really old version (none of the fancy JS stuff, really bad design) of this script. You might be able to modify it or a similar script.

Since I've done a rather grown up image catalogue anyway I'd rather base it on that. wink

Not so far.

It's not spectacular anyway, it looks like you put an img tag at the end of your message.
Just that the image is not on somewhere else but will be uploaded.

But if you can't get the picture I will make one wink

This mod allows for uploading an image that will be shown inline with the message.

The file formats and maximum size are definable by the admin.

You can get it from
Punres

or from script.gr:

mod Imagepost 1.0 tar.gz
mod Imagepost 1.0 Zip

The problem here is that you can ban all "hcgtv.net" addresses but then your own would be blocked as well.
Besides from the little hack I wrote only a more sophisticated whitelist/blacklist system would help.

I got a different error but there is something wrong.
In file plugins/AP_invitations.php , change line 465

     if($group != '')  {

to

     if($group != 'all')  {

works fine with me now.
Sorry for the inconvenience

mastiland wrote:

hey if i am havin 1.0.1 already installed what do i do

I think you should install 1.1.1 form scratch. An update would be a bit complicated.
If you think you can deal with it, just take the old and the new readme.txt, find the difference and apply them to your board.
Don't forget to change the database because there are also two changes there.

af3 wrote:

How to automatically add number of invitations to a newly registered user i.e. default invitation number without being manually added?

This is done in the user group administration.
If a new user registers into one of these groups he will get the number of invitatios that you define there.

My proposal is:
Open include/email.php
and replace line 36

if (strlen($email) > 50)

with

if ((strlen($email) > 50) || (preg('/@hcgtv.net/') && !preg('/yourname@hcgtv.net/')))

where you replace yourname@hcgtv.net with your own email address

Short instructions on how to mod the Mod version 1.1

1. with mphp MyAdmin or on the commandline, go to your pun DB and enter

INSERT INTO PREFIXconfig values('o_invitation_message','---------------')

Make sure to replace PREFIX with your prefix...

2. Open include/mod_invitation.php and go to line 29.
Replace there

     $mtext = $form['invitation_text'] . "\n".$lang_invitation['Forum Link'].$act_link;

with

     $mtext = $form['invitation_text'] . "\n".$lang_invitation['Forum Link'] . "\n" . $act_link . "\n" . $pun_config['o_invitation_message'];

3. Open admin_options.php and go to line 642.
After

                  <th scope="row">Rules</th>
                  <td>
                    <textarea name="form[rules_message]" rows="10" cols="55"><?php echo pun_htmlspecialchars($pun_config['o_rules_message']) ?></textarea>
                    <span>Here you can enter any rules or other information that the user must review and accept when registering. If you enabled rules above you have to enter something here, otherwise it will be disabled. This text will not be parsed like regular posts and thus may contain HTML.</span>
                  </td>
                </tr>

, add

<!-- MOD INVITATION  -->
                <tr>
                  <th scope="row">Invitation Message</th>
                  <td>
                    <textarea name="form[invitation_message]" rows="10" cols="55"><?php echo pun_htmlspecialchars($pun_config['o_invitation_message']) ?></textarea>
                    <span>Here you can enter a message that users will get along with their invitation.<br />
                    It will be added to the text that the inviter writes</span>
                  </td>
                </tr>
<!-- //MOD INVITATION  -->

For those who installed version 1.1. this should do the trick.

All others should either replace the files and revise the readme.txt of the new version - or do it totally from scratch smile