Attachment Mod 2.0.1 by Frank H (Page 1 of 21)

##
##
##        Mod title:  Attachment Mod
##
##      Mod version:  2.0.1
##   Works on PunBB:  1.2.5
##     Release date:  2005-04-28
##           Author:  Frank Hagstrom (email removed, read my sig)
##
##      Description:  This mod will add the ability for attachments beeing
##                    posted in PunBB 1.2.5
##
##   Affected files:  delete.php
##                    edit.php
##                    moderate.php
##                    post.php
##                    viewtopic.php
##
##       Affects DB:  Yes
##
##            Notes:  This is the second Attachment Mod I have written. The
##                    earlier mod used the database to store the binary data,
##                    for a huge amount of files, this might start getting hard
##                    to make backups etc. of. (first mod was intended for few
##                    files, not gigabytes of data, but I have come closer and
##                    closer to this, and would like to be able to keep it on
##                    files instead.)
##                    
##                    To be able to get attachments, one need to enable upload
##                    of files in PHP, and set the max_file_size (and some
##                    other variables, so read documentation after installing
##                    the mod)
##                    There's now no longer any need of having large buffers
##                    for the database, so these can be returned to the values
##                    one had before installing the first mod (if you have that
##                    installed, but I guess you should do that after the files
##                    has been converted to disk files)
##                    
##                    There's also no need for editing php files to set options,
##                    these are set in the Administration interface, located in
##                    the Plugins menu. These are cached and should therefore be
##                    at least just as quick (perhaps quicker as they're
##                    combined with the forum config), so it's easier to
##                    administrate the mod now, adding icons, and such.
##                    
##                    Another great new thing done is that you only have to
##                    backup each file once, as there will never be two files
##                    with the same name in a directory. So one only need to
##                    download the new files from the subfolders, old deleted
##                    files will be emptied (0 bytes), but still be in the
##                    folders to keep new attachments to get the same name. As
##                    if they would, one would need to download all files during
##                    backup procedure.
##                    
##                    And as a further upgrade, posts are no longer limited to
##                    one attachment per post. I still have a limit of one file
##                    per opportunity (i.e. one on post creation, rest on edit),
##                    but the admin set the limit of max files per post, a per 
##                    group and per forum basis.
##                    
##                    I strongly suggest you read the whole documentation
##                    before start using the mod, the documentation is in the
##                    Administration interface. Or at the very least the first
##                    chapter!
##
##
##
##                    **** PREPARATIONS NEEDED TO BE DONE FIRST! ****
##
##                    1. Backup!
##                    2. Create a directory where you want the attachments to
##                       be stored. (Suggestion is somewhere the browser does
##                       NOT reach, if not bruteforcing to find files is
##                       possible)
##                    3. Make sure php is allowed to create files and
##                       directories in the above directory.
##                    
##                    Written by Frank H  
##                    on: 2005-04-12 17:11
##
##       DISCLAIMER:  Please note that "mods" are not officially supported by
##                    PunBB. Installation of this modification is done at your
##                    own risk. Backup your forum database and any and all
##                    applicable files before proceeding.
##
##

As always MAKE BACKUPS!!!

Backups should be simpler now, files only need to be downloaded once, as two attachments never has the same filename, even if an attachment is removed.

A couple of things to note:
1. The folder where the attachments are saved can (and should be) in a directory where browsers aren't allowed to be, but if that's not the case (for various reasons), an .htaccess and index.html is copied into each and every folder that the script makes for attachments. But beware, if the browser is allowed to see the index.html file, they may aswell bruteforce themselves to the attachments. So, my recommendation is to store the files in a place where the browsers aren't allowed.
2. If you have installed the "changeset 172" Rickard told about in the 1.2.5 release thread, then step 43 in readme is changed, and in step 44, just change the true to false after the query (and add the comment behind , so you have a mark that the attachment mod has altered that line) This affects PunBB 1.2.6+ aswell!!!
3. If you upgrade from pre 2.0 version, first remove all traces in the php files from the old mod (but keep database tables!), I suggest using a clean 1.2.5 install.
4. If bugs is surfaced, this post will be updated.
5. basefile.psd doesn't need to be uploaded, it's a Photoshop template if you want to create your own icons.
6. Those updating from 2.0 just read the update_2.0_to_2.0.1_readme.txt for instructions, it's a really simple upgrade, replace a few files, and run a small script
7. To test that upload works, use a tiny textfile (make a new textfile and write test in it, and save it). If that one works, but not other files, you probably haven't set the max upload size in "Alter Settings", read Documentation chapter 1.6 to figure out what value to use. (Using this small value to force people to set the settings according to their server, as 'every' server has it's own config)
8. "Blank page" can be the result of missing attach.php in all languages ... damac made me aware that it's a bit unclear that all languages need the attach.php file, so I'll make it a bit more clear in the next release...
9. Installation trouble can be caused by php running in safe mode, turning it off will make it work. (if you're getting an error on .htaccess beeing copied, but the chmod seems to be correct)

I've now made an Installation Guide!

Downloads:
Download from punres.org
Languages avaible for download: English(default), French, German, Greek, Norwegian, Russian, Simplified Chinese, Slovenian, Spanish & Swedish. Big thanks goes out to all the translators!
(when extracting lang files, never overwrite (they are all called the same in the zip), extract to different directories, or extract and move them one by one, all languages need their own attach.php files or the mod will give errors)

Critical Bugs:
SQLite: Installer doesn't work with SQLite (and might very well be that the whole mod in incompatible? (Anyone having time and knowledge of SQLite that would like to try to fix it?)
NULL byte vulnerability: The mod is probably vulernable to the NULL byte hack, that PunBB 1.2.13 was patched for, so the administrative plugin has been modified to solve that. Download the updated plugin from PunBB Resource, just overwrite your existing plugin. (can only be exploited by Administrators). More info in this post!

'Normal' Bugs:(can be related to different softwares etc. And not security related)
*new*(15th April 2007) Karinne noticed the readme says "index.htm" instead of "index.html". So please copy "index.html" to the attachment directory.
*new*(19th January 2007) Thesaint discovered an output bug in the administration interface for editing allowed files. Bugfix here.
*new*(24th November 2006) Koktsing had a problem where only 2'000'000 bytes were downloaded on his server, this was due to the fpassthru function probably hadn't enough memory to put the file, and just clipped at 2'000'000 bytes. One can solve it by applying a fix in attachment.php.
* (3rd April 2006) Fpouget reported that zip-files behaves odd in Internet Explorer if gzipped output (the zipfile has one file, that when unzipped and renamed to zip is the actual zipfile), works fine in Firefox though. Simple bugfix found in this post.
* Selad reported a typo in the readme.txt file "compressed.pnd to img/attach/" should be "compressed.png to img/attach/". Will be fixed in next release
* Gardell reported that attachment.php have a 'non translated' "Go back". Probably fixed in next release sometime ...

Fixed bugs(since release)
Fixed to 2.0.1 version:
* Max upload size is only checked agaisnt admins, so the rulecheck I had thought out, was only in my head and not in the code, typical Will make a fix. (but not critical, as the max upload size set in rules will still be the limiting factor, but if you have a small max upload, normal users can upload larger files (if allowed in ruleset), but not admins ...
* Performance issue when viewing attachment. Dexus reported having 5-7s extra waiting time for viewing attachments, but sending an extra header fixed it. See this post for info how to fix it. (happened on IE6 & Firefox 1.1 on an Apache 2 server). Will most probably be included in next release. This header is now in 2.0.1.

Fixed on the 2.0 release:
* readme in zip updated - (Step 32 in readme should say #---------[ 32. FIND (line: 358) ]--------------------------------------------   (thanks Dexus for noticing))
* readme in zip updated - (Step 15 in readme is wrong, use the step shown in this post (the large code block) (thanks Dexus for noticing))