Web Development 2.0: Web Design, CakePHP, Javascript » Forum http://www.webdevelopment2.com Quick and Dirty Web Development for Web 2.0: CakePHP, Prototype, JQuery, and lots more. Sat, 23 Apr 2011 15:21:02 +0000 en hourly 1 http://wordpress.org/?v=3.0.1 SMF 1.1 RC 2 Is Out! http://www.webdevelopment2.com/smf-11-rc-2-is-out/ http://www.webdevelopment2.com/smf-11-rc-2-is-out/#comments Sat, 31 Dec 2005 21:31:05 +0000 Kevin Lloyd http://www.webdevelopment2.com/2005/12/31/smf-11-rc-2-is-out.htm I just made a comment in a previous post about phpBB vs. SMF where a user mentioned the pains that we all go through when upgrading phpBB. I commneted that I cannot actually compare upgrade procedures between the two packages because from the first install of SMF a new version hasn’t come out.

And here comes the irony: SMF 1.1 RC 2 is out today.

After scanning through the upgrade procedures, it doesn’t look like anywhere near the horrors of upgrading phpBB. They say that there may be some issues with previous themes, which they gave a fix for. I haven’t tried the upgrade yet, but from all reports it only invloves uploading some files, changing some permissions and then running a step by step script. The only file editing I see is to fix old themes.

Here goes another notch in the belt for SMF. Right now, phpBB is quickly fading for me.

[tags]SMF, phpBB, forum, bulletin board[/tags]

Similar Posts:]]> http://www.webdevelopment2.com/smf-11-rc-2-is-out/feed/ 0 phpBB 2.0.19 released http://www.webdevelopment2.com/phpbb-2019-released/ http://www.webdevelopment2.com/phpbb-2019-released/#comments Fri, 30 Dec 2005 19:32:44 +0000 Kevin Lloyd http://www.webdevelopment2.com/2005/12/30/phpbb-2019-released.htm After all the security issues with phpBB 2.0.18, version 2.0.19 is finally out.

phpBB Group announces the release of phpBB 2.0.19, the “we wish you all a happy new year” release. This release addresses several bugfixes and some security issues only affecting Internet Explorer. Additionally we introduced a new feature to limit the number of logins. The admin is able to configure this feature on two ways, defining the number of maximum allowed logins and setting a time period after the user is allowed to login again. With this feature we hope to address the recent dictionary attacks happening on some forums to crack user passwords.

As with all new releases we urge you to update as soon as possible. You can of course find this download available on our downloads page. As per usual four packages are available to simplify your update.

  • Full Package
    Contains entire phpBB2 source and English language package
  • Changed Files Only
    Contains only those files changed from previous versions of phpBB. Please note this archive contains changed files for each previous release
  • Patch Files
    Contains patch compatible patches from the previous versions of phpBB.
  • Code Changes
    Contains step-by-step instructions in MOD format for updating heavily MODified installs

Select whichever package is most suitable for you.

Please ensure you read the INSTALL and README documents in docs/ before proceeding with installation or updates!.

It is important that you carry out both parts of the update – updating the files and running the database update script – for updates to be complete.

What has changed in this release?

The changelog (contained within this release) is as follows:

  • [Fix] corrected index on session keys table under MS SQL
  • [Fix] added session keys table to backup
  • [Fix] delete session keys entries when deleting user
  • [Fix] changes to support MySQL 5.0
  • [Fix] changes to some of the admin files to improve efficiency and remove a potential error condition when building the menu
  • [Fix] change truncation of username length in usercp_register.php – BFUK
  • [Fix] incorrect path to avatars in admin_users.php (Bug #667)
  • [Fix] fixed get_userdata to support correct sql escaping (non-mysql dbs) – jarnaez
  • [Fix] fixed captcha for those not having the zlib extension enabled
  • [Change] Placed version information above who is online in admin panel for better visual presence
  • [Sec] fixed XSS issue (only valid for Internet Explorer) within the url bbcode
  • [Sec] fixed XSS issue (only valid for Internet Explorer) if html tags are allowed and enabled
  • [Sec] added configurable maximum login attempts to prevent dictionary attacks

[tags]phpBB, forum[/tags]

Similar Posts:]]> http://www.webdevelopment2.com/phpbb-2019-released/feed/ 2 phpBB “Allow HTML” Script Insertion Security Issue http://www.webdevelopment2.com/phpbb-allow-html-script-insertion-security-issue/ http://www.webdevelopment2.com/phpbb-allow-html-script-insertion-security-issue/#comments Wed, 21 Dec 2005 20:24:30 +0000 Kevin Lloyd http://www.webdevelopment2.com/2005/12/21/phpbb-allow-html-script-insertion-security-issue.htm We have a new exploit for phpBB. Just when you thought you were safe:

Description:
Maksymilian Arciemowicz has discovered a security issue in phpBB, which can be exploited by malicious people to conduct script insertion attacks.

Input passed in the message body when posting isn’t properly sanitised before being used. This can be exploited to inject arbitrary JavaScript code, which will be executed in a user’s browser session in context of an affected site when the malicious post is viewed.

Example:
H E L O

Successful exploitation requires that “Allow HTML” is enabled (not default setting).

It is also possible to disclose the full path to “admin/admin_disallow.php” by accessing it directly with the “setmodules” parameter set to “1″ (requires that “register_globals” is enabled).

The security issue has been confirmed in version 2.0.18. Other versions may also be affected.

Solution:
Set “Allow HTML” to “No”.

source

Similar Posts:]]> http://www.webdevelopment2.com/phpbb-allow-html-script-insertion-security-issue/feed/ 1 Google Blocks phpBB Searches http://www.webdevelopment2.com/google-blocks-phpbb-searches/ http://www.webdevelopment2.com/google-blocks-phpbb-searches/#comments Thu, 15 Dec 2005 01:59:28 +0000 Kevin Lloyd http://www.webdevelopment2.com/2005/12/14/google-blocks-phpbb-searches.htm We all know that phpBB is prone to a number of security risks. People used to use Google (among other search engines) and search for “phpbb” to find a list of phpBB sites and try their exploits on them. The phpBB development team addressed this problem a couple versions before. They stopped displaying the version number in the footer of the forum.
phpBB Footer

Right now, Google has out right blocked the entire search. Take a look:

We’re sorry…

… but we can’t process your request right now. A computer virus or spyware application is sending us automated requests, and it appears that your computer or network has been infected.

We’ll restore your access as quickly as possible, so try again soon. In the meantime, you might want to run a virus checker or spyware remover to make sure that your computer is free of viruses and other spurious software.

We apologize for the inconvenience, and hope we’ll see you again on Google.

Similar Posts:]]> http://www.webdevelopment2.com/google-blocks-phpbb-searches/feed/ 0 phpBB Skins from WebsiteTemplates.com.au http://www.webdevelopment2.com/phpbb-skins-from-websitetemplatescomau/ http://www.webdevelopment2.com/phpbb-skins-from-websitetemplatescomau/#comments Thu, 15 Dec 2005 01:52:27 +0000 Kevin Lloyd http://www.webdevelopment2.com/2005/12/14/phpbb-skins-from-websitetemplatescomau.htm Here is an addition to my previous post on phpBB skins.

WebsiteTemplates.com.au claim to be offering phpBB skins but I’ve searched for some on their website and haven’t been able to find them yet. I’m wondering what took everyone so long to start offering templates from phpBB. This is another score for Open Source in my book.

Similar Posts:]]> http://www.webdevelopment2.com/phpbb-skins-from-websitetemplatescomau/feed/ 0 phpBB Skins from TemplateMonster http://www.webdevelopment2.com/phpbb-skins-from-templatemonster/ http://www.webdevelopment2.com/phpbb-skins-from-templatemonster/#comments Tue, 13 Dec 2005 23:21:28 +0000 Kevin Lloyd http://www.webdevelopment2.com/2005/12/13/phpbb-skins-from-templatemonster.htm Guess who’s doing phpBB templates now. Yep, our friends over at TemplateMonster.com are now doing phpBB 2 templates. These templates include the actual templates files, PSD files with the graphics, fonts and icons.

From Web Hosting News:

“We are always glad to support Open Source projects, especially those of them which are of great popularity thus adding additional value to them??? says Gary Nichols, head of marketing at template Monster. “We already have templates for the Open Source projects like PHP-Nuke and osCommerce. Now we enlarge our product database with skins for phpBB. We believe that not only our customers will benefit from this but the project itself.???

They only have four templates right now, ranging from $45 to $49, but they are planning to expand.

Similar Posts:]]> http://www.webdevelopment2.com/phpbb-skins-from-templatemonster/feed/ 1 phpBB vs. SMF http://www.webdevelopment2.com/phpbb-vs-smf/ http://www.webdevelopment2.com/phpbb-vs-smf/#comments Sun, 11 Dec 2005 04:37:15 +0000 Kevin Lloyd http://www.webdevelopment2.com/?p=47 A blog entry at Ask MetaFilter stirs up an interesting comparison, one which I should have covered a long time ago since it directly affects the way I work.

I’m not trying to stir up a Windows vs. Unix type debate but am interested in your thoughts and experiences, either as an administrator or user.

Personally, I feel that both of these are very powerful forum packages, but let me just mention that vBulletin is and always will be the best and preferred forum software. However, we’re doing the whole free thing, so let’s not even go into the costs of vBulletin. Let’s focus on the two free packages, phpBB and Simple Machines SMF. I have

I have been doing a lot of advanced work on a phpBB forum for over a year now, but I recently stumbled upon SMF. I was setting up a new website in the Joomla CMS for which I needed to have a forum integrated. It was easy enough to integrate the template so that it looks seamless, but I was also looking for a way to integrate the user database of both phpBB and Joomla. At the time their were no components around to do so, but there was a component to integrate SMF with Joomla, therefore I decided to give SMF a try. These are my observations after using both and doing a little bit of research:

  • The library of MODs (modifications) for phpBB far out weighs those of SMF.
  • The templates library for phpBB is also than those of SMF
  • The MODs for phpBB came be intimidating to install for a novice user. They require editing files on the server and sometimes apply SQL queries to the database. There is also no roll back or uninstall feature.
  • SMF on the other hand, has a brilliant set up where you simply upload the MOD from the administrator’s section and install.
  • Out of the box SMF has much more functionality than phpBB. Eg. there is already support for attachments, real name, etc. phpBB requires the installation of MODs for what should be basic tasks.
  • For me (I’ve gotten a lot of heat in the SMF forums about this, but what do you expect), the phpBB templating system is some what simpler to edit. The template files use tags (which are later replaced) for things like Forum Description, Title, etc. The templates are also in very basic HTML that the webmaster can dump in a WYSIWYG editor if he pleases.
  • SMF templates are written in PHP, so an editor would at least need some PHP knowledge to edit the templates. Although it is simply to pick up, an editor with not HTML or PHP knowledge would be lost, whereas in phpBB they would have a chance.
  • There is much more control over the forum and user permissions in SMF than in phpBB.
  • SMF is a bit more complicated to configure simply because of the vast number of different options available to the administrator. Or maybe it’s because I’ve been working with phpBB so long.
  • phpBB is prone to security issues. There is going to be an update or security patch at least every two months. If you consider this normal maintenance, then you’ll be fine. It is secure as long as you keep up with the updates religiously.
  • SMF is a bit more secure. There are considerably less exploits for SMF than phpBB. I am interested in knowing why though.
  • Personally, I feel that the default template for phpBB looks better and cleaner than SMF, but that might be a bias opinion.

Bottom line for me, since I’m doing a lot of sites using Joomla the integration is nice for me and the fact that I can deploy a basic forum with with a lot of functionality without having to fuss with too many MODs I would have to choose SMF. Hope this has helped you. I would also be interested in hearing your views on the subject.

Similar Posts:]]> http://www.webdevelopment2.com/phpbb-vs-smf/feed/ 4 phpBB 2.0.18 released http://www.webdevelopment2.com/phpbb-2018-released/ http://www.webdevelopment2.com/phpbb-2018-released/#comments Sun, 30 Oct 2005 15:01:14 +0000 Kevin Lloyd http://www.webdevelopment2.com/?p=6 A Halloween special edition of phpBB has been released today. The changelog includes, but is not limited to:

[Fix] incorrect handling of password resets if admin activation is enabled (Bug #88)

[Fix] retrieving category rows in index.php (Bug #90)

[Fix] improved index performance by determining the permissions before iterating through all forums (Bug #91)

[Fix] wrong topic redirection after login redirect (Bug #94)

[Fix] improved handling of username lists in admin_ug_auth.php (Bug #98)

[Fix] incorrect removal of bbcode_uid values if bbcode has been turned off (Bug #100)

[Fix] correctly preview signature if editing other users posts (Bug #101)

[Fix] incorrect alt tag on generated search images in groupcp.php, viewtopic.php and usercp_viewprofile.php (Bug #102)

[Fix] consistent forum ordering in all dropdown boxes (Bug #106)

[Fix] correctly get compression status in page_tail.php and page_footer_admin.php (Bug #117)

[Fix] set page title on summary page of groupcp.php (bug #125)

[Fix] correctly test style and avatar in usercp_register.php (bug #129 and #317)

[Fix] handling of reactivation notifications if admin activation is enabled (Bug #145)

[Fix] handling of both forms of translation information used in language packs (Bug #159)

[Fix] key length for activation keys fixed in usercp_sendpassword.php (Bug #171)

[Fix] use GENERAL_MESSAGE constant in message_die instead of MESSAGE (Bug #176)

[Fix] incorrect handling of move stubs (Bug #179)

[Fix] wrong mode_type in memberlist (Bug #187)

[Fix] SQL errors when setting maximum PMs to 0 (Bug #188)

[Fix] removed unused variable from topic_notify email template (Bug #210)

[Fix] removed unset variable from smilies popup window title (Bug #224)

[Fix] removed duplicate template assignment from admin_board.php (Bug #226)

[Fix] incorrect search link for guest posts in modcp.php (Bug #254)

[Fix] all users removed from topics watch table on special occassions (Bug #271)

[Fix] correctly check returned value from strpos in append_sid function (Bug #275)

[Fix] correctly display username in private message notification (Bug #278)

[Fix] fixed “var-by-ref” errors (Bug #322)

[Fix] changed redirection to installation (Bug #325)

[Fix] added timout of 10 seconds to version check (Bug #348)

[Fix] fixed user_level default in postgresql schema file (Bug #444)

[Fix] multiple minor HTML issues with subSilver

[Change] deprecated the use of some PHP 3 compatability functions in favour of the native equivalents

[Change] added 60 days limit for grabbing unread topics in index.php

[Sec] backport of session keys system from olympus

[Sec] fixed email bans to use the same pattern as email validation and allow wildcard domain bans

[Sec] fixed validation of topic type when posting

[Sec] unset database password once it is no longer needed

[Sec] fixed potential to select images outside the specified path as avatars or smilies

[Sec] fix globals de-registration code for PHP5 – (Stefan Esser/Matt Kavanagh)

[Sec] changed avatar gallery code sections to prevent possible injection points (AnthraX101)

[Sec] signature field is not properly sanitised for user input when an error occurs while accessing the avatar gallery (AnthraX101)

[Sec] check to_username and ownership when editing a PM (AnthraX101)

[Sec] fixed ability to edit PM’s you did not send (depablo84)

[Sec] compare imagetype on avatar uploading to match the file extension from uploaded file

If you ask me, all the frequent update is really begining to kill phpBB for me. That’s why I’ve been exploring Simplemachine’s SMF. I’ll keep you guys updated on my findings.

Similar Posts:]]> http://www.webdevelopment2.com/phpbb-2018-released/feed/ 1