Support Forums - All Posts - XOOPS Web Application System

1

Php-stats Security Issue

2006/3/22 10:17
Olorin
Just popping in
Posts: 50
Since: 2003/7/5 1

Php-Stats Multiple Vulnerabilities and Security Issue

Official thread(Google's English translation)

Curerently, as of March 22th, there is no official patch for the issues.

Liberty is never being too sure you're right....

2

Re: Taking you back to where you were??????????!!

2005/9/10 12:44
Olorin
Just popping in
Posts: 50
Since: 2003/7/5 1

I don't think we are facing exactly the same problem. But, in my case, there was a trouble when an anonymous user try to post a comment: he gets that error message "taking you ... where you were".

This is caused by the empty $_SESSION['XOOPS_TOKEN_SESSION'] as far as I know. (please bear in mind that I'm not a coder. :-p) So I swapped class/xoopssecurity.php with the one for "XoopsCube". (XoopsCube is compatible with XOOPS 2.0.x for the time being.) And I also uploaded "class/token.php" from XoopsCube, added some lines within XoopsSecurity class.

Add the following code somewhere in class/xoopssecurity.php

 function checkReferer($docheck=1) 
    { 
        $ref = xoops_getenv('HTTP_REFERER'); 
        if ($docheck == 0) { 
            return true; 
        } 
        if ($ref == '') { 
            return true; 
//            return false; 
        } 
        if (strpos($ref, XOOPS_URL) !== 0 ) { 
            return false; 
        } 
        return true; 
    }

Please remember the fact that it may create an gaping security hole for I'm not a professional. At very least, it weakens the protection against CRSF. So all the webmasters must turn on referrer when s/he manages his/her web sites.

Anyway, this hack solved MY problem, and my site became more friendly to anonymous visiters. That's all I can say.

Liberty is never being too sure you're right....

3

Re: Wiki Module for Xoops 2.0.X

2005/6/9 14:46
Olorin
Just popping in
Posts: 50
Since: 2003/7/5 1

You can also check bluemoon's modified Pukiwikimod.

http://www.bluemooninc.biz/~xoops2/modules/pukiwiki/?WhiteBoard

Pukiwikimod is a bit slower than bwiki. But it has more functionality when it comes to user permission. (Though, I personally prefer bwiki. :-p)

Anyway, have a look on its "Post-It plugin" at very least. It's really an astonishing feature!

4

Re: Adding a link to the MAIN Menu

2005/4/14 11:34
Olorin
Just popping in
Posts: 50
Since: 2003/7/5 1

<a class="menuMain" href="<{$xoops_url}>[b]/modules/wfchannel/blahblahblah[/b]">yourtexta>

Well, I recommend you to install Multimenu, anyway. If you want to make your own "main menu" only, multimenu 1.4 jp-edition is sufficient. If you want to make varied menus, solo's multimenu 1.7 is the one.

5

Re: Anti-Spam Operation

2005/2/18 8:33
Olorin
Just popping in
Posts: 50
Since: 2003/7/5 1

Quote:

4. A unique attribute and its correspong value to comment forms.

Well, I've figured it out.

include/comment_post.php
line 233

 -if( ! xoops_refcheck() ) { 
+if( ! xoops_refcheck() || $_POST['jfophmledf'] !== 'hgembaec' || $_POST['tzkrcekn'] !== 'qkspoflx' ) {

include/comment_form.php
line 103

 $cform->addElement(new XoopsFormHidden('com_mode', $com_mode)); 
+$cform->addElement(new XoopsFormHidden('jfophmledf', 'hgembaec')); 
+$cform->addElement(new XoopsFormHidden('tzkrcekn', 'qkspoflx'));

Quote:

To me it sounds like 3. and 4. have the same approach.
Kazu is working on implementing a ticket system for the upcoming XOOPS 2.0.10

Sounds promissing.

Well, I agree with you that 3 & 4 have the same approach. Maybe I should have listed them up as 3a & 3b...

6

Anti-Spam Operation

2005/2/12 21:39
Olorin
Just popping in
Posts: 50
Since: 2003/7/5 1

Referrer-Spaming(or Comment-Spam) is hot thesedays, which is a growing headache for webmasters in many ways:

1. It abuses your web server severely.
2. It's not just annoying to delete the spams everytime you check your web site, but just... GIVE ME A BREAK!!!!

Thanks to the appearance of "Protector", Headache-1 can be dealt with automatically since it can restrict the simultaneous accesses from the same IP.

Headache-2 is not that problematic for the community sites where all the comments are posted by registered users like here. But for the web sites where comments are open to public, it is.

Possible solutions:

1. .htaccess

 SetEnvIf Referer "(.*)(ronnieazza|future-200|loan|loans|6q|diet-pills|sex|freakycheats|psxtreme|learnhowtoplay|online-deals-4u|poker|gambling|chat-nett|fidelityfunding|terashells|casino|crescentarian|yelucie|smsportali|viagra|blackjack|porn|nude|naked|adult|anal)(.*).(.*)" ToTheDeepestAbyssOfHELL 
<Files *> 
Order allow,deny 
Allow from all 
Deny from env=ToTheDeepestAbyssOfHELL 
Files>

So called "Referrer Spams" contain banal referrer information to entice webmasters into their crappy web sites. I know that none of them may well click such feeble links, though they seem to think it works, somehow...lol Anyway, we can exploit this poor information.

2. xoops_refcheck()
include/comment_post.php

line232

 if ($uid == 0) { 
+            if ( ! xoops_refcheck() ) { 
+                redirect_header($redirect_page.'='.$com_itemid.'&com_id='.$com_id.'&com_mode='.$com_mode.'&com_order='.$com_order, 1, _NOPERM); 
+                exit(); 
+            } 
            switch ($xoopsModuleConfig['com_rule']) { 
            case XOOPS_COMMENT_APPROVEALL:

Given that no registered user commits spammming, it can block "referrer-spams" as long as they hold external referrer infomation. It would also block legitimate comments because many people simply have no idea what the firewall software in their computer does. To avoid this unintended inconvenience, you can disable referrer-check only when the empty referrer is recognised. Please search "Xoops FAQ" for the detailed information about it.

Btw, this function is accessible from all the modules. So this hack can be applied to those modules that use their original commenting system: B-wiki, WordPress, and etc..., too.

3. g_ticket
Maybe, it's not that difiicult to implement GIJOE's ticket system to Xoop's commenting system... But I DON'T KNOW HOW TO do it!!! lol

4. A unique attribute and its correspong value to comment forms.

This technique is widely adopted by many blog softwares to confirm if the comments are sent from your comment form.. But how can I implement this function to Xoops? That's the question. As far as I know, "Comment Callback Function" seems to be the one. But, again, I DON'T KNOW HOW TO assign an extra parameter with the provided xoops-form class... lol

Maybe, instead of assigning it, I can set a certain attribute and its value as an default extra-parameter by hacking core files in class/xoopsform, and insert "if ( A!==B){exit;}" into include/comment_post.php...

IMHO, I want this feature to be available from the admin panel in the future: Webmasters can define their original attribute and its corresponding value for the comment forms in their web site.

7

Re: Auth Module for wrapping HTML, PHP, CGI web site

2005/1/17 9:37
Olorin
Just popping in
Posts: 50
Since: 2003/7/5 1

@carnuke
Quote:

I do not know what to do here? What module folder? Do I need to create one?

$modversion['dirname'] = "auth";

by changing the value of the variable above, you can have multiple instance with ease.

i.e.
modules/auth (default)
modules/auth2 (when "$modversion['dirname']" is "auth2";)

$auth_dir = "sample";

You can see "sample" directory in "auth" directory, right? This is where you put your contents by default.

If it doesn't work try the following values:

$auth_dir = "modules/auth/sample"; (default)
or
$auth_dir = "physical_path/modules/auth/sample"; (default)

What you have downloaded is an add-on to make your html contents searchable as Bender says. Don't forget to change the name of search function in "include/search.inc.php" when you use multiple instance. Or it causes conflicts

As regards its authentication, I have no idea since I don't use this module.

8

Let's just calm down...

2005/1/1 14:33
Olorin
Just popping in
Posts: 50
Since: 2003/7/5 1

Quote:

Mithrandir wrote:
Ok, this is getting a bit one-sided. GIJOE is not very visible here, but I am sure he does a tremendous job in the Asian community sites, so it is not the case of a guy just coding, coding and coding and not doing any support work.

GIJOE is the most active supporter in Japan. Moreover, he couldn't be more active in his personal support site as you can see.

Quote:

carnuke wrote:
As this new year starts, let's invite some positive constructive response to this discussion in a way that all parties feel they are heard, appreciated and respected.

I quite agree with you. As Mithrandir stated on the news, XOOPS seems to be looking for the developers for the current version. At the same time, Japanese developers seem to be serious about leaving XOOPS and making their own one.

So why don't you make the best of Japanese developers' enthusiasm? For instance, you can let the Japanese team alter the current 2.0.x series. And the others focus on the 2.1 series.

Of course, there should be a consensus for the development so as not to make a difference between the current and the future one in their features.

This may delay the release of 2.1, eventually. But even Onokazu thinks there should be another release with a few, but not too radical, changes in the feature before 2.1 arrives.

In the end, all the Xoopsers can have more secure Xoops, Japanese team doesn't need to worry about the language, and English team can focus on the future version.

Surely, I'm not ignoring the other local communities. But Japanese developers are just HEATED in many ways.

This is "ORETEKI Xoops":
http://marijuana.ddo.jp/xoops/modules/mydownloads/
http://marijuana.ddo.jp/xoops/modules/mydownloads/visit.php?cid=1&lid=20&type=0

Some modules have already exceeded the standards of the core, I think. So it's high time we thought how to adopt these advanced features to the core, isn't it?

9

Great Opera extension: BBCode&WikiSyntax

2004/10/8 9:32
Olorin
Just popping in
Posts: 50
Since: 2003/7/5 1

If you use Firefox, go to this thread:
https://xoops.org/modules/newbb/viewtopic.php?topic_id=22116&forum=7&post_id=96676#forumpost96676

If you are Opera user, you can make the most of its flexibility!

Paste the following lines on your "menu.ini":

 &#x5b;Edit Widget Popup Menu] 
Submenu, 67653, Edit Widget Insert Menu 
Submenu, 67654, Internal Note List 
--------------------1 
Submenu, "BB Code", BBCode 
Submenu, "Wiki", Pukiwiki 
--------------------1 
Item, 50864=Undo 
Item, 68116=Redo 
--------------------2 
Item, 50865=Cut 
Item, 50866=Copy 
Item, 50867=Paste 
Item, 50868=Delete 
--------------------3 
Item, 67652=Copy to note 
--------------------4 
Item, 67655=Clear 
Item, 50869=Select all 
Platform Windows-Unix-QNX, --------------------5 
Platform Windows-Unix-QNX, Item, 69620=Spell check 
 
 
&#x5b;BBCode] 
Item, "[quote]"=Insert, "[quote]" & Paste & Insert, "[/quote]" 
Item, "[img]"=Insert, "[img align=left]" & Paste & Insert, "[/img]" 
Item, "[img-tag]"=Insert, "[img][/img]" 
Item, "[url]"=Insert, "[url=" & Paste & Insert, "][/url]" 
Item, "[url-tag]"=Insert, "[url][/url]" 
Item, "[code]"=Insert, "[code][/code]" 
Item, "[list]"=Insert, "[list][*][*][*][/list]" 
Submenu, "Formatting", Formatting 
 
&#x5b;Formatting] 
Item, "[b]"=Cut & Insert, "[b]" & Paste & Insert, "[/b]" 
Item, "[i]"=Cut & Insert, "[i]" & Paste & Insert, "[/i]" 
Item, "[u]"=Cut & Insert, "[u]" & Paste & Insert, "[/u]" 
Item, "[d]"=Cut & Insert, "[d]" & Paste & Insert, "[/d]" 
Submenu, "Size", Formatting Size 
Submenu, "Color", Formatting Color 
Submenu, "Font", Formatting Font 
 
&#x5b;Formatting Size] 
Item, "[size xxSmall]"=Cut & Insert, "[size=xx-small]" & Paste & Insert, "[/size]" 
Item, "[size xSmall]"=Cut & Insert, "[size=x-small]" & Paste & Insert, "[/size]" 
Item, "[size Small]"=Cut & Insert, "[size=small]" & Paste & Insert, "[/size]" 
Item, "[size Large]"=Cut & Insert, "[size=medium]" & Paste & Insert, "[/size]" 
Item, "[size Largest]"=Cut & Insert, "[size=large]" & Paste & Insert, "[/size]" 
Item, "[size xLargest]"=Cut & Insert, "[size=x-large]" & Paste & Insert, "[/size]" 
Item, "[size xxLargest]"=Cut & Insert, "[size=xx-large]" & Paste & Insert, "[/size]" 
 
&#x5b;Formatting Color] 
Item, "Blue"=Cut & Insert, "[color=blue]" & Paste & Insert, "[/color]" 
Item, "Red"=Cut & Insert, "[color=red]" & Paste & Insert, "[/color]" 
Item, "Purple"=Cut & Insert, "[color=purple]" & Paste & Insert, "[/color]" 
Item, "Orange"=Cut & Insert, "[color=orange]" & Paste & Insert, "[/color]" 
Item, "Yellow"=Cut & Insert, "[color=yellow]" & Paste & Insert, "[/color]" 
Item, "Gray"=Cut & Insert, "[color=gray]" & Paste & Insert, "[/color]" 
Item, "Green"=Cut & Insert, "[color=green]" & Paste & Insert, "[/color]" 
 
&#x5b;Formatting Font] 
Item, "Arial"=Cut & Insert, "[font=arial]" & Paste & Insert, "[/font]" 
Item, "Verdana"=Cut & Insert, "[font=verdana]" & Paste & Insert, "[/font]" 
Item, "Courier"=Cut & Insert, "[font=courier]" & Paste & Insert, "[/font]" 
Item, "Impact"=Cut & Insert, "[font=impact]" & Paste & Insert, "[/font]" 
Item, "Geneva"=Cut & Insert, "[font=geneva]" & Paste & Insert, "[/font]" 
Item, "Optima"=Cut & Insert, "[font=optima]" & Paste & Insert, "[/font]" 
 
&#x5b;Pukiwiki] 
Item, "[img]"=Insert, "&ref(" & Paste & Insert, ",center);" 
Item, "

"=Insert, "
" 
Item, "def-list"=Insert, ":|" 
Submenu, "Formatting", Syntax 
 
&#x5b;Syntax] 
Item, "[b]"=Cut & Insert, "''" & Paste & Insert, "''" 
Item, "[i]"=Cut & Insert, "'''" & Paste & Insert, "'''" 
Item, "[u]"=Cut & Insert, "%%%" & Paste & Insert, "%%%" 
Item, "[d]"=Cut & Insert, "%%" & Paste & Insert, "%%" 
Submenu, "Size", Syntax Size 
Submenu, "Color", Syntax Color 
Submenu, "Font", Syntax Font 
 
&#x5b;Syntax Size] 
Item, "xxSmall"=Cut & Insert, "&size(xx-small){" & Paste & Insert, "};" 
Item, "xSmall"=Cut & Insert, "&size(x-small){" & Paste & Insert, "};" 
Item, "Small"=Cut & Insert, "&size(small){" & Paste & Insert, "};" 
Item, "Medium"=Cut & Insert, "&size(medium){" & Paste & Insert, "};" 
Item, "Large"=Cut & Insert, "&size(large){" & Paste & Insert, "};" 
Item, "xLarge"=Cut & Insert, "&size(x-large){" & Paste & Insert, "};" 
Item, "xxLarge"=Cut & Insert, "&size(xx-large){" & Paste & Insert, "};" 
 
&#x5b;Syntax Color] 
Item, "Blue"=Cut & Insert, "&color(blue){" & Paste & Insert, "};" 
Item, "Red"=Cut & Insert, "&color(red){" & Paste & Insert, "};" 
Item, "Purple"=Cut & Insert, "&color(purple){" & Paste & Insert, "};" 
Item, "Orange"=Cut & Insert, "&color(orange){" & Paste & Insert, "};" 
Item, "Yellow"=Cut & Insert, "&color(yellow){" & Paste & Insert, "};" 
Item, "Gray"=Cut & Insert, "&color(gray){" & Paste & Insert, "};" 
Item, "Green"=Cut & Insert, "&color(green){};" 
 
&#x5b;Syntax Font] 
Item, "Arial"=Cut & Insert, "&font(Arial){" & Paste & Insert, "};" 
Item, "Verdana"=Cut & Insert, "&font(Verdana){" & Paste & Insert, "};" 
Item, "Courier"=Cut & Insert, "&font(Courier){" & Paste & Insert, "};" 
Item, "Impact"=Cut & Insert, "&font(Impact){" & Paste & Insert, "};" 
Item, "Geneva"=Cut & Insert, "&font(Geneva){" & Paste & Insert, "};" 
Item, "Optima"=Cut & Insert, "&font(Optima){" & Paste & Insert, "};"

default WikiSyntax is configured for Pukiwiki. So if you use wakka, phpwiki, or wiwi, you can change the certain values to meet your need.

By the way, isn't there a way to disable BBcode in code without replacing "[" & "]" with "#???" ?

Well...Thx for forcing me to wait for 30 seconds... I'm not a spammer...I just forgot turning on Referrer... lol

10

Re: how do I create colapsable menus

2004/7/23 21:47
Olorin
Just popping in
Posts: 50
Since: 2003/7/5 1

Multi-menuJP1.14
http://malaika.s31.xrea.com/modules/mydownloads/

****Link Styles****
1.Full-path link (Always shown)
Quote:

http://www.aa.com/xoops/index.php

2.Assigning by modules names (Always shown)
Quote:

[module_name]
[module_name]xxxx.php?xxxx=xxxx

****Special Syntax for Sub-menu****
1. Static menu (Sub-menu is always shown)
Quote:

+[module_name]
+[module_name]xxxx.php?xxxx=xxxx

2. Dynamic Menu (Sub-menu is shown like Xoops' menu)
Quote:

@[module_name]
@[module_name]xxxx.php?xxxx=xxxx

==Examples==
A. @[news] , Title=News2
-When the module isn't chosen:
"News2"
-When the module is chosen:
"News"
"Submit News"
"Archive"

B. @[news]details.php?storyid=1 , Title=News2

-When the module isn't chosen:
"News2" (linking to News Item1)
-When the module is chosen:
"News2" (linking to News Item1)
"Submit News"
"Archive"

**You can make an arbitary selection for its title
================

I think it would work on English environment, too.(mb_string isn't required) It may be not the one for you since it doesn't allow you to define your original sub-menu.

Stats
Goal:	$100.00
Due Date:	Oct 31
Gross Amount:	$0.00
Net Balance:	$0.00
Left to go:	$100.00

Forum Index

Php-stats Security Issue

Re: Taking you back to where you were??????????!!

Re: Wiki Module for Xoops 2.0.X

Re: Adding a link to the MAIN Menu

Re: Anti-Spam Operation

Anti-Spam Operation

Re: Auth Module for wrapping HTML, PHP, CGI web site

Let's just calm down...

Great Opera extension: BBCode&WikiSyntax

Re: how do I create colapsable menus

Login

Search

Recent Posts

Re: XOOPS 2.5.11 search user is not working

Tuto/news: Old themes with XOOPS 2.5.11

Re: Suggetions for xmNews & xSitemap

Re: Suggetions for xmNews & xSitemap

Suggetions for xmNews & xSitemap

Help Needed with Custom Module Development in XOOPS

Re: sbadmin5 - Bootstrap 5 Theme

Re: sbadmin5 - Bootstrap 5 Theme

Re: sbadmin5 - Bootstrap 5 Theme

Re: sbadmin5 - Bootstrap 5 Theme

Who's Online

Donat-O-Meter

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}