626

(2 replies, posted in Programming)

http://punbb.org/docs/dev.html

627

(17 replies, posted in PunBB 1.3 troubleshooting)

Do you have your browser setup to pull the Atom/RSS feed from the forum? Just wondering if it might be due to the prev_url setup.

628

(17 replies, posted in PunBB 1.3 troubleshooting)

You ain't set the browser homepage to the feed have you? big_smile

I think we may have crossed our wires then. big_smile If I understand correctly, your method would only allow access to those non-guest feeds when the user is actually logged in, regardless of whether it uses the cookie or not?

From what I understood of pedrotuga's initial post, however, (and I hope they will correct me if I'm wrong), is that it would use and extract info from the cookie to find the users g_id, if the user was not logged in, and decide on the feed contents accordingly.

630

(17 replies, posted in PunBB 1.3 troubleshooting)

kierownik wrote:

Anybody have an idea sad

Clear browser cache?

Smartys wrote:

lol tongue
The idea is fairly simple. Instead of having the code force guest permissions, it just uses the permissions of the logged in user. No security issues there, since the authentication is done via the same cookie that PunBB uses. Now, only RSS readers that are integrated into the browser would be able to take advantage of this.

Are you working on the basis of the feed only being available to the user when they are actually logged onto the forum, rather than extracting cookie info from the browser when the in-browser feed client updates the feed?

632

(4 replies, posted in PunBB 1.2 troubleshooting)

display: none;

pedrotuga wrote:

For example, I don't login each time i pass by punbb.org/forums... nor to the forums i run.. do you?

Always. big_smile

quaker wrote:

feeds as in rss feeds?

Yup.

Smartys wrote:

As opposed to cookie authentication for logins, which is what we use? wink
The idea is simply to use the login cookie as the authentication mechanism. That means nothing changes for regular RSS readers, but those which are integrated with a browser can view the RSS feed with the permission of the logged in user.

That cookie authentication part is a bit of a misnomer though. The cookie, in essence, doesn't mean diddley when the user isn't logged in. Plus, what's the point of a feed that you can only access once you're logged in? And if the auth mechanism contains some form of system whereby you don't have to be logged in to view it, then again, that comes back around to my original point. Security.

I'm quite willing to be corrected on my viewpoint if I've grabbed the totally wrong end of the cluestick, btw. big_smile

pedrotuga wrote:

What does this have to do with Drac? BTW, i didn't even know what drac was until i googled it just now.

Not that Drac. big_smile Apologies. I was skimping on the typing. Draconian. big_smile

smartys wrote:

MattF: I don't see what's so bad about the change, other than that the need to login is non-obvious.

But he's referring to a system where it is reliant upon a cookie only. What if two people share a machine? A login has to be cracked, somehow. A cookie is stored for all and sundry with access to that machine to see, for starters. Having good security is pretty pointless if you're going to allow cookie authentication for feeds.

pedrotuga wrote:

The only thing i suggested is to extend the user authentication check to the feed generator script. That should not be a lot of work and it would be very practical for some people, like me.

And it would also be the absolute worst nightmare of a Drac admin, if it was part of the core system, especially with such weak checks as those.

velma wrote:

2. A phrase enclosed in double quotes to be treated as a single search term.

That's implemented in 1.3, I believe.

SuperMAG wrote:

i am not saying about that idea in particulare .... i am saying that they should put all thier ideas for 1.4 in 1.3 ... final version is bitter then every new version per year ... afcource they will be updating but not full upgrading ...

Do you have any idea of how many possible bugs or unexpected consequences a single item can have? That's the point of new releases. To incorporate new features when, AND ONLY WHEN, they have been fully designed, implemented and tested.

SuperMAG wrote:

i just wanted to say why dont they apply features in 1.3 rather to apply it in 1.4 ........ if you have future plans ...

If they did that, 1.3, nor any other release, would ever get released. Plus, one can but hope that something like that *never* makes it into core.

SuperMAG wrote:

1.4 ... what is going on ... i thought we are on 1.3 ... why guys dont you guys put the things of 1.4 in 1.3 ... why just wait for another thing ... this is alittle annoying

Stop being a drama queen. Something like the aforementioned setup has the ability to bollocks your restrictions the first time some muppet puts their feed link on a public system, and they will, without fail.

pedrotuga: That concept has always struck me as being one that has issues. At least with your browser, you still require the login also. Working off of cookie info alone would most probably be best in some form of extension, if anyone likes the prospect.

My apologies then. smile

http://no-www.org/faq.php

TYPE is only relevant to the column, however. I think that mismatch in documentation is just due to documentation becoming more indepth. But saying that, I don't still run a 7.* DB, so can't attest to it with all certainty. smile (Unless I get one installed to test). big_smile

Smartys wrote:

Alter column type only exists for PostgreSQL 8, I believe.

It's be hoped not. big_smile

http://www.postgresql.org/docs/7.4/inte … table.html

Looking at that patch, and assuming all you want to do is go from 15 to 39 for PgSQL, (and possibly set a default too), you should only need, (straight command line syntax, btw), big_smile:

ALTER TABLE [db prefix]posts ALTER COLUMN poster_ip TYPE VARCHAR(39);
ALTER TABLE [db prefix]posts ALTER COLUMN poster_ip SET DEFAULT '0.0.0.0';
Smartys wrote:

if such a solution allows us to come up with a setup similar to the way we handle PostgreSQL, all the better.

Do you just need to alter the column from varchar(15) to varchar(39)?

Smartys wrote:

True, but no plan is perfect and all are subject to Murphy's Law tongue
But really, this is semantics. There will always be people who are capable enough to run the software without major issues. However, since the majority of people aren't capable and the development team wants to spend time developing rather than debugging odd installs, it's better simply to ask that people not use beta software in a production environment.

Can't disagree with that. big_smile

Smartys wrote:

If someone coverts their forum, deletes their backups, and then faces some database corruption caused by a bug, then we have an issue. wink

That would sort of drop outside of this part though. big_smile

(If one knows of, and is willing to take the risks involved).

Allowing oneself no provision for fallback would obviously be begging for whatever occurs. Running it with full knowledge of the possible consequences, (and having a fallback strategy in place), is a completely different thing, however. smile