bingiman wrote:
MattF wrote:

The only problem with truncation is that it screws the W3C compliance if it happens to trim the message inbetween a pair of tags. big_smile

Actually, this is true but soonotes (tinytim) managed to resolve this issue with his User Blogs.

You wouldn't happen to know how, would you? I have a feeling that delving through his blog code might be a somewhat long winded affair without knowing exactly which bit I'm searching for. big_smile

quaker wrote:

so mattf how can this be fixed?

Don't think there is any easy way to do it with php. Unless I've missed something major in my manual delving, it has nowhere near the text abilities of, say, shell scripting. big_smile It's either truncate at a preset character count for convenience, or don't if you want to retain W3C strict compliance.

1,728

(23 replies, posted in PunBB 1.2 discussion)

spikeweb wrote:

Now, back to the original question, and I apologize for that, but what about the roadmap ?
In other words, shall I have to start thinking using mods if extensions come soon with 1.3 or will this release come only next year or worse ?

When it's ready for production use, one would assume.

bingiman wrote:

This is totally awesome. You should have it so that it truncates to a set amount of text. Something like I have in Mega Pun. I think it would be great because then you will have too much clutter on the front page. Maybe add a read more link?

Shedrock

The only problem with truncation is that it screws the W3C compliance if it happens to trim the message inbetween a pair of tags. big_smile

zap wrote:

Funny you should mention this just now, I found out that was indeed the case late friday night. The web site was tested on another domain before being deployed and apparently it was not correctly removed: access to the site itself was denied but a direct link to the forum still worked. That would explain why the spam seemed to just drop into the DB and there were no traces of anything in the server logs.

It's worthwhile remembering, (if you have any more problems), to check your own security, setup and coding before laying blame on someone elses. smile

pradtf wrote:
MattF wrote:

Glad to hear you've found the cause of the problem. smile

ya it was me all the time big_smile big_smile big_smile
thanks mattf, for your inputs and the idea of looking at the log in the earlier post.
guess it's better to look at logs before looking at code big_smile

but now that i've done it, i think i'd still like to find out where that exit is implemented when o_new_reg=0.

Logs are the easiest and most useful starting point every time. big_smile We've all had one, (or more), of those moments in the past of overlooking what seems obvious afterwards. big_smile

With regards to the exit, it's more a bypass. If you look at that function, you'll notice that once the message function is called, it terminates itself directly. The calling script can't continue on.

Edit: Think of it as the page that calls the message function is actually calling a separate page, so therefore it no longer has anything to process itself.

Glad to hear you've found the cause of the problem. smile

1,733

(9 replies, posted in PunBB 1.2 troubleshooting)

Header.php:

$tpl_main = str_replace('<pun_title>', '<h1><span>'.pun_htmlspecialchars($pun_config['o_board_title']).'</span></h1>', $tpl_main);

1,734

(2 replies, posted in PunBB 1.2 discussion)

I think Smartys is probably going to give you the exact same answer he did the other day.

Once the message function gets called, message(), further processing of that script stops. (I found out the hard way). big_smile

Btw, is there anything in the server logs regarding these registrations that are getting through?

pradtf wrote:

is it possible that

o_regs_allow = 0

in the config.php file only disables the registration form from showing up?

now if one were to parallel the registration uri directly, something like:
domain.com/register.php?name=me&email=me@whatever.com etc etc
thus simulating what would be sent by the registration form that the normal process would be circumvented?

Shouldn't be. Register.php is called to deal with whatever parameters are passed to it. Thereby, it will check the o_regs_allow setting before proceeding any further with it's processing on that demo above.

elbekko wrote:

Ack, sorry. Looked over that. I just didn't see it in the part where a user is being added =P

big_smile big_smile You had me worried for a moment there. big_smile big_smile

elbekko wrote:

Hrmm, it seems register.php doesn't check if registration is enabled when processing the form at all... I'd see this as a bug actually.

I may be missing the point of that sentence completely, but what then is this check in register.php?

if ($pun_config['o_regs_allow'] == '0')
{
        message($lang_register['No new regs']);
}
zap wrote:

I guess my point is that SQL injections are not bugs that should be fixed but something that should be designed out of the system, relying as little as possible on the developer being fully awake when he writes the code. :-)

That is incorrect. Anyone who writes any code whatsoever, in any language, should design it as securely as possible regardless of (the|any) underlying security. And with regards to semantics, php is not perl. Perl is not shell. Shell is not (C|C+|C++). They all vary in their abilities and semantics. One should never, and I do mean never, assume any level of security so that they can relax their own coding methods. As a software developer, you should have been taught that before you were ever even allowed near a keyboard.

At the end of the day, if you're wanting to optimise the hell out of everything, you've got the source code, start optimising. big_smile A high level UI will never give you that level of optimisation no matter what friendly, (and rather useless, one might add), messages it gives you.

1,742

(29 replies, posted in Programming)

sirena wrote:

Excellent. I'm sure that will be very handy for many people.

I'm just surprised Smartys managed to resist throttling me with all the questions I asked. big_smile big_smile Thanks again for all your help btw Smartys. smile smile

1,743

(29 replies, posted in Programming)

This is the file include/user/register.php:

<?php

$register_failed = 'The answer you supplied was incorrect. Please try again.';

session_start();
if (!isset($_SESSION['answer']) || $_SESSION['answer'] == '')
{

$number = rand(1, 4); // Alter the second number to match the number of questions.

//---Questions array---//

$questions = array(

'q1' => 'One plus three equals?',
'q2' => 'Two plus four equals?',
'q3' => 'Eight plus eight equals?',
'q4' => 'Three times three equals?'

);

//-----Hints array-----//

$hints = array(

'h1' => 'One less than five',
'h2' => 'One more than five',
'h3' => 'Just under seventeen',
'h4' => 'One shy of ten'

);

//----Answers array----//

$answers = array(

'a1' => 'Four',
'a2' => 'Six',
'a3' => 'Sixteen',
'a4' => 'Nine'

);

$_SESSION['hint'] = $hints[h.$number];
$_SESSION['answer'] = $answers[a.$number];
$_SESSION['question'] = $questions[q.$number];

}

?>

The answers/questions/hints arrays can have as many added to as you like. Just remember to use the same prefix letter in each array:
(q, a, h), with the numbers after the letter rising sequentially.


The register.php file in the root forum directory needs the following:

This first addition is very near the top of the file.

if ($pun_config['o_regs_allow'] == '0')
{
        require_once PUN_ROOT.'header.php';
        message($lang_register['No new regs']);
}

require_once PUN_ROOT.'include/user/register.php'; // This line added

This is the second section in the root register.php file. The bits between the //----// need adding. I've included existing code above/below for placement. I think it goes in the same place as your original code:

        else
        {
                $language = $pun_config['o_default_lang'];
        }

//------------------------------------------------//

                if (isset ($_POST['spamcode']) && $_POST['spamcode'] != '' && $_POST['spamcode'] == $_SESSION['answer'])
                {
                        session_unset();
                        session_destroy();
                }
                else
                {
                        session_unset();
                        session_destroy();
                        message("$register_failed");
                }
        
//------------------------------------------------//

        $timezone = round($_POST['timezone'], 1);
        $save_pass = (!isset($_POST['save_pass']) || $_POST['save_pass'] != '1') ? '0' : '1';

This is the final section in the root register.php file. Again, layout as above, and goes in the same spot, (I think), as your original code:

                                                <input type="text" name="req_email2" size="50" maxlength="50" /><br /></label>
<?php endif; ?>                                 </div>
                                </fieldset>
                        </div>

//----------------------------------------------------//

                        <div class="inform">
                                <fieldset>
                                <legend>Spambot prevention question</legend>
                                        <div class="infldset">
                                                <p><b>Question:</b> <?php echo $_SESSION['question']; ?></p>
                                                <p><b>Hint:</b> <?php echo $_SESSION['hint']; ?></p>
                                                <input method="post" type="text" name="spamcode" size="10" maxlength="10"/><br/>
                                        </div>
                                </fieldset>
                        </div>

//----------------------------------------------------//

                        <div class="inform">
                                <fieldset>
                                        <legend><?php echo $lang_prof_reg['Localisation legend'] ?></legend>

Remember to remove those //----// lines from that last section as they're in a html section of the script. big_smile (Or enclode them within php start/end tags if you want to keep them). If you've any probs, give us a shout. big_smile I haven't put line numbers in btw because I do have a bad habit of severely altering/rewriting things, so my line numbers might be way out. big_smile I tested it around fifteen times with the final version, and it appeared to be behaving as it should. Obviously though, I would suggest giving it a good test on a test server before using it for real. big_smile


Have fun,

Matt

1,744

(29 replies, posted in Programming)

No probs. big_smile I'll post the final complete working version in this thread, and then it's all yours to do with as you will. big_smile I was just scratching an itch. (I hate been beaten). big_smile

1,745

(2 replies, posted in General discussion)

elbekko wrote:

Erm, just press the * button? big_smile

big_smile big_smile I did walk into that one didn't I? big_smile

Was looking for something to replace the [ New posts ] bit in viewforum.php. big_smile Did eventually find reference to this one: ? which gives a bold asterisk type symbol. (I believe it's classed as one of the mathematical symbols in this context).


Cheers,

Matt

1,746

(2 replies, posted in General discussion)

Just another quickie. big_smile Is it okay to include an asterisk in say a title/subject, and is there any special html notation for it, like the ampersand and such?


Cheers,

Matt

p0Wer wrote:
MattF wrote:

I know this sounds geeky, big_smile but might be worth ditching the W3C Xhtml icon/link at the bottom of the page. big_smile

The what?

This:

http://www.game-warp.com/wp-content/themes/freshy-10/images/valid_xhtml11_80x15_2.png

It does a referrer check on the validity of, (or severe lack of), your Xhmtl. big_smile

1,748

(8 replies, posted in Programming)

Smartys wrote:

You don't need the global line since you're using none of those variables.
For the second function, I think you want to return the value, not store it in a local variable

Cheers. smile


Smartys wrote:

For both functions, why can't you simply call pun_htmlspecialchars when you need it, as opposed to wrapping it in a new function?

Simple answer? Less to type. big_smile Don't like using copy and paste if possible, so I usually hand type everything.

1,749

(8 replies, posted in Programming)

Just realised the downnfall of the above method. It does assume you want to echo the output. big_smile So, a secondary one like this:

function vsanitise($parseinput)
{
global $db, $lang_common, $lang_forum, $lang_index, $pun_config, $pun_start, $tpl_main;

        $cleanoutput = pun_htmlspecialchars($parseinput);

}

would make two functions that would suit for either cleaning and echoing the input, (example one), or making a variable from the input, (example two), that could be passed to the inscript variable?


Thanks again,

Matt

1,750

(8 replies, posted in Programming)

Right, I know I said it was just a quickie, but............ big_smile

Would the following do what I expect? Just so I can use a shorthand method, if anybody's wondering. big_smile

function esanitise($cleanoutput)
{
global $db, $lang_common, $lang_forum, $lang_index, $pun_config, $pun_start, $tpl_main;

        echo pun_htmlspecialchars($cleanoutput);

}

I don't know if all those global bits are required? I just based this on the existing message() function.


Cheers again,

Matt