So my forum and site will go alive soon. thanks!

I am using the actual bbpress (2.0) plugin not the standalone and it still displays the 1970 date. It doesn't matter what date format I use. I have a feeling it made be due to the $post->post_id that is causing this.

You should refer this page http://php.net/manual/en/function.date.php to change code that will suit your display need.


<?php global $post;
$lalaposttime = date( 'CHANGE THIS', strtotime( $post->post_id ) );
echo $lalaposttime; ?>


<?php global $post;
$lalaposttime = date( 'D M Y', strtotime( $post->post_id ) );
echo $lalaposttime; ?>

This worked to a point, however it displays the date as "THU JAN 1970".

I assumes that it will be different for the bbpress plugin itself.

Could anyone help get me started with this?

Thanks in advance.

Their code only runs if there is an active user, if someone is not logged in and there is a loophole, the code would run unchallenged.

Plus they exclude admin, so if there is a hacked account, the code is also bypassed.

Here is my improved version of my original code

if (strlen($_SERVER['REQUEST_URI'])>255 ||
preg_match('@(eval|base64|unescape)[^a-zA-Z0-9]@si',$_SERVER['REQUEST_URI']))
{
	header('HTTP/1.1 414 Request-URI Too Long');
	header('Status: 414 Request-URI Too Long');
	header('Connection: Close');
	exit;
}

_ck_ posted something similar a while back on the WordPress.org trac site about blocking long query strings. Maybe she will post here about this.

http://ckon.wordpress.com/2008/11/11/simple-wordpress-and-bbpress-security-plugin-to-block-long-requests/

http://core.trac.wordpress.org/ticket/8152

< ?php
/*
Plugin Name: Block Bad Queries
Plugin URI: http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI: http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/

global $user_ID;

if($user_ID) {
if(!current_user_can('level_10')) {
if (strlen($_SERVER['REQUEST_URI']) > 255 ||
strpos($_SERVER['REQUEST_URI'], "eval(") ||
strpos($_SERVER['REQUEST_URI'], "CONCAT") ||
strpos($_SERVER['REQUEST_URI'], "UNION+SELECT") ||
strpos($_SERVER['REQUEST_URI'], "base64")) {
@header("HTTP/1.1 414 Request-URI Too Long");
@header("Status: 414 Request-URI Too Long");
@header("Connection: Close");
@exit;
}
}
}
?>

And tell me how can I make my forums more secure?
Nedd Tips and Tricks!!
And did anyone make any security concern plugin for bbpress?

Thanks,
Pagal

So, that's enough to not use that.

Thanks again Chrishajer.

You're always welcome at my place!

http://bbpress.org/forums/topic/apostrophe-and-or-quotation-marks-cause-backslash-to-appear#post-65803

"magic_quotes_gpc should be off - always, it's evil."

So, if it does not work with magic quotes on, it's probably a bug somewhere, with the integration, and for that reason I prefer the plugin solution here:

http://bbpress.org/forums/topic/apostrophe-and-or-quotation-marks-cause-backslash-to-appear#post-61089

Not sure what's best as I've never been affected by the problem and therefore never tried to fix it.

From: http://bbpress.org/forums/topic/slashes-being-added-in-front-of-apostrophes

User: baptiste

Post: Easy fix (hack) in bb-includes/template-functions.php, update this function to look like this:

function get_post_text() {
global $bb_post;
return stripslashes($bb_post->post_text);
}

May be an artifact of the wordpress integration - not sure.

The above did indeed work. But I still looked at the other posts and problems others had.

http://bbpress.org/forums/topic/apostrophe-and-or-quotation-marks-cause-backslash-to-appear

user: arpowers

ok, found the answer wooooooo!

The 'real' reason this wasn't working was....

'magic_quotes_gpc' is set to 'off' on my server (in php.ini)

All these other solutions are band-aids, my hunch is that making sure magic quotes is 'on' is the solution.

user: jackey

Putting "php_value magic_quotes_gpc 1" in my .htaccess file worked for me... for now.

The above also worked. So instead of editing the bbpress code, i just modified the .htaccess file (added to it), that 1 line fixed it. So I will go with it untill I see a problem.

Worth noting, someone said that by changing the code as per baptiste's method could corrupt backups you make of sql. So, that was the reason I went with the .htaccess fix.

Thank you!

chrishajer: you are GhettoBSD Approved!

So yeah that's not what is affecting this problem. I will look into the links you pasted.

Thank you very much!

The escaping of single quotes on integrated installations has been covered here before.

http://bbpress.org/forums/topic/slashes-being-added-in-front-of-apostrophes

http://bbpress.org/forums/topic/apostrophe-and-or-quotation-marks-cause-backslash-to-appear

http://bbpress.org/forums/topic/slash-text-issue-in-10-alpha-6-have-searched

Sounds that that is your problem - escaping single quotes in an integrated installation. The hacking you did is unrelated (I think.) I confused backticks with quotation marks.

I don't think it's related to the keys at all. They are not used that way when posting. The worst that ever happened was that bbPress did not support the complex keys (with escaped characters) that WordPress did. But that resulted in a 500 Internal Server Error.

It's not until integration.

But it's just so weird, why would a / be added in? Even with no modification to anything? I will try with separate auth keys and go from there.

I used a NEW (not related) db, i used both clean installs.

So basically, the problem is reproduced on the stock installs of wp,bb with integration on mysql. So nothing, not even the themes from before were used.

At first I thought it was because I changed the type of links (permlinks) and then did a stock install with no changes, but integration and it happened again.

I basically did many installs under different configurations/databases. And everything ended up the same every time.

I ruled out:
- The theme being the problem.
- The hacks ...
- Perm link options ...
- .htaccess ...
- The database...

Maybe it has to do with the auth key info? That's the only obvious thing.

I do have wp and bb installed else where and integrated without the same problem.

I used a generator that also generated the salt, could that be it?

I did some hacking to get rid of the back tick to quote option

I suspect this is your problem. If you undo those hacks, does the problem go away?

If the hacking you did modified the entries in the database, and your fresh installations are still using that database, I suspect you will still see a problem.

What hacks did you do?

I did some hacking to get rid of the back tick to quote option.

So I'm posting for the fist time "I'm" and it posts as "I/'m"

I try to find the problem and can't.

I end up making 3 db's total:
db 1) Using what I have (results in /')
db 2) Clean install, using only themes (results in /')
db 3) Clean install, no themes, no hacks nothing, just integrated with cookies (results in /')

Any one have any idea what's going on?

Both are latest releases. Everything else works fine. Integration works etc etc

I created a new DB with clean installs of both wp and bb with the same results. Different user names, default themes etc. Nothing worked.

tia!

I've done some limited testing and this seems to work.

In functions.bb-template.php I created the following function:

function hackfixurl ($url){
$url= str_replace("http://", "", $url);
$url= str_replace($_SERVER["HTTP_HOST"], "", $url);
return $url;
}

Then, on line 1590 of the same file, wrap the url with the new function like:

$url = bb_get_uri('bb-login.php', array('re' => hackfixurl($url)), BB_URI_CONTEXT_A_HREF + BB_URI_CONTEXT_BB_USER_FORMS);

Regards--

Integration works well. I only register users from WP. Logins work from either BBP or WP. WP users appear correctly to BBP (every user can log in from both WP and BBP)..

Logout from WP is fine regardless of where the login occurred (so, no cookie problems).

However, when logging out from BBP (using the Kakumei "Log out" link), the logout occurs (so cookies are working), but I am redirected to a 404. The logout link is bb-login.php?logout=1. I have found that, on the other hand, the link bb-login.php?logout=0 (as typed in) works just fine -- logs out, redirects back to page.

I have hacked a solution. I don't understand it (I haven't yet been able to follow the use of the GET variable logout to find where it's value is used anywhere). But in case anyone else has this problem, here's the hack.

The logout link is produced by the function call bb_logout_link(); in the template's logged-in.php file.

bb_logout_link is defined in bb-includes\functions.bb-template.php, and effectively calls bb_get_logout_link with the same arguments. In the latter function, around line 2737, the value logout=1 is hard-coded.

I have changed the code for bb_get_logout_link so (a) it defaults to logout=1 if logout is not specified in the call to bb_logout_link (thus the hack is non-destructive), but (b) the call bb_logout_link('logout=0'); overrides the default.

This produces the working link, so the "Log out" link works.

Here's the code
Old line 2737 of bb-includes\functions.bb-template.php was

$query = array( 'logout' => 1 );

I changed that to the following (which works because the args were "extract"ed, so $logout has a value from the call to bb_logout_link):

if ( $logout==NULL ) $logout = 1;  // Defaults to 'logout=1'
$query = array( 'logout' => $logout );  //  Changed '1' to '$logout'

Then in the template's logged-in.php, I added the argument to the call to bb_logout_link:

bb_logout_link('logout=0');

It works for me.

Has anyone else has had this problem? If not, I must have broken something somewhere else -- so I'd like to know.

Can anyone explain the bug, or explain where the value of logout is used? (I'll keep looking, and will post a followup if I find it, but I'm not expert at the subtleties of apply_filters, which appears to be the only possibility.)

Thanks.

<?php new_topic(); ?>

and replaced it with ADD NEW
<a href="http://www.endsofearth.com/forum/?new=1">ADD NEW</a>

which works just fine, so I am happy with it.

Notice how this works:

http://www.endsofearth.com/forum/bb-login.php?re=http%3A

but this doesn't

http://www.endsofearth.com/forum/bb-login.php?re=http%3A%2F

So it looks like bbPress is sending users to the right place. So I played around with your URL a bit:
http://www.endsofearth.com/forum/bb-login.php?re=http://www.endsofearth.com/

That didn't work either, so I stripped off the re= part completely:
http://www.endsofearth.com/forum/bb-login.php

That worked... suggesting that the problem is with the re= part and your htaccess file.

Just when I was feeling clever, I did a quick Google search and ck had already figured it all out:
http://bbpress.org/forums/topic/latest-discussions-add-new-link-problem-if-not-logged

Maybe try disabling MultiViews or checking your htaccess file?

If you are logged in and click on ADD NEW, it works just fine. If you are not logged in, then instead of getting the message that they need to log in, it is putting up a 404.

It seems like whether you are logged in or not, it should just go to http://www.endsofearth.com/forum/?new=1 . . . if I go to that URL when I am not logged in, it gives me the appropriate message and link to log in. However instead it is attempting this for unlogged in users:

http://www.endsofearth.com/forum/bb-login.php?re=http%3A%2F%2Fwww.endsofearth.com%2Fforum%2F%3Fnew%3D1

which throws up the 404

I would appreciate any help. Thanks!