8/ modules/system/admin.php?fct=comments
if you navigate with IE through admin menus in admin toolbar, all options "all modules" "any status" are hidden by admin menus, as you navigate through them.
It's a theme issue under Internet Explorer

i think, with regards to the display name.. it should be made a seperate field completely if it's to be made unique and still keep the real name field...

using the real name field has caused problems when users have the same name.. u can't expect them to add numbers or whatever to their real names..

with keeping user login name hidden, i don't think it's as big a security risk in my opinion. if the password is strong enough, then brute force attacks won't work anyway.

i always set a minimum of 8 characters for password, how about a password strength check.. must have at least 1 or 2 numbers, and at least 1 or 2 lower/upper case characters combined or even a level that rquires to add characters too like + - @ # % etc an 8 character password mixed like that would take quite a few years for a brute force attack. and possibly a password lockout for a set time.. if u get the password wrong it locks out all further attempts for a pre determined time, so even if the bruteforce is still going, during that time nothing is accepted, so even if the brute forcer gets the right password then it won't work anyway so will log it as a wrong password.. do i make any sense?

------------
i have a problem with adding profile fields. the category works fine, but can't add any fields.. it returns errors: none. no debug info..

on userside > viewing profile..

Notice [PHP]: Undefined offset: 1 in file modules/profile/userinfo.php line 144
Notice [PHP]: Undefined index: fields in file modules/profile/userinfo.php line 144
Warning [PHP]: array_keys(): The first argument should be an array in file modules/profile/userinfo.php line 144
Notice [PHP]: Undefined index: fields in file modules/profile/userinfo.php line 144
Warning [PHP]: array_multisort(): Argument #1 is expected to be an array or a sort flag in file modules/profile/userinfo.php line 144

No in any application, a username should be protected just as a password. If the username is known that is ½ the equation for a brute force attack, and forcing users to use strong passwords is like pulling teeth. Ouch.

I do like the lockout idea though. Maybe until an admin unlocKS it to keep it simple.

doesn't have to be admin unlock.. a counter for say 5 mins would suffice. the user only needs to be warned that even when locked out, his/her real password will not work either..

and a 5 minute delay after every 3 incorrect passwords will probably stop any1 wanting to use brute force because it will be a waste of their time, unless of course you are using XOOPS for your NSA spy satellites or Military inteligence (do people really still use brute force? lmao)

also maybe a good idea to stop uname = pwd

that will stop people using the same password as their usernames.. or even in reverse..

ie..
uname = m0nty, pwd = m0nty <deny password>
uname = m0nty, pwd = ytn0m <deny password>

yes some people are really that stupid..

getting your users to adopt a stricter password method will not only protect your site, but will also teach them them to adopt a securer password on their other sites they visit..

now back to my previous error:

mysql debug shows when trying to create a field that has textfield type..

ALTER TABLE 0IAN12_user_profile ADD Track 1 varchar(255) NOT NULL DEFAULT 'track 1'
Error number: 1064
Error message: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near '1 varchar(255) NOT NULL DEFAULT 'track 1'' at line 1
( 7.3E-05)

seems that the form isn't taking into account spaces in field names, so when the query is constructed, the space in the name is treated seperately.. i think the field name in the query must be quoted '' but i can't seem to find where the query is put together.

There are better ways. From what I have seen a dictionary attack could crack most XOOPS admin passwords in a matter of seconds. Even site admins do not know the value of strong passwords.

yup so true :-|

all my passwords are minimum of 11 characters.. and a dictionary attack would be useless lol my passwd has no words in it whatsoever, it's just a mixture of letters and numbers.. (but i might add that it's dead easy to remember for me because those letters and numbers do mean something)

I've found a potential bug:

CVS checkout from today (july 2nd), 20:00 GMT. Clean install, on hosted service (Apache version 1.3.33 (Unix), PHP version 4.3.11, MySQL version 4.0.24-standard).

Changed to other theme, wanted to add a custom template set, but got error:
ERROR: Could not create template set xoops2.2.

Same error when trying to clone the default template set.
PHP debug shows no errors.
MySQL debug gave me a faulty query:


Herko

I'll look at it, Herko.

Thank you everyone for your attention in this.
When upgrading to XOOPS 2.2, the users without "Real Name"/"Display Name" will get their username transferred to this field (defeating the purpose of "hiding" the username, I know, but I felt it was the most obvious way of doing it)

Regarding spaces in custom field names, this is not allowed. In the titles yes, but not in the field names.

Afther fresh install and logging in I got these errors. I hope that helps:

thanks mith, removing the space did the trick :) there oughta be some kind of warning or notice on the field name language definition to warn against it :)

now i can get to work on making x-ipb work with 2.1 lol