This is fixed in the bbPress trunk. Give it a go and be sure to report back any more issues. 
Thanks for bringing this up!
In this topic is fine. Would rather have more eyes on this than less.
The solution involved the shuffling of things around, as well as this specific addition: https://trac.bbpress.org/browser/trunk/bb-login.php#L51
Basically if the esc’ed $re is now empty, fall back to the installation root. At first this seemed like a silly solution, but because the login always attempts to smart redirect, there isn’t a circumstance where it would naturally be empty. By moving the esc’s up and letting them filter out the baddies, it’s possible to end up with an empty $re.
Tested with ampersands and question marks and it appears to work fine. I’ll try more esoteric URL combinations and see if it breaks.
I indented that code because of the repeated empty( $re ) checks. I had a hard time keeping track of how many times it needed to repeat the same check and bumped them in for clarity. Not a common formatting technique but helpful to me at the time.
In this topic is fine. Would rather have more eyes on this than less.
The solution involved the shuffling of things around, as well as this specific addition: https://trac.bbpress.org/browser/trunk/bb-login.php#L51
Basically if the esc’ed $re is now empty, fall back to the installation root. At first this seemed like a silly solution, but because the login always attempts to smart redirect, there isn’t a circumstance where it would naturally be empty. By moving the esc’s up and letting them filter out the baddies, it’s possible to end up with an empty $re.
Tested with ampersands and question marks and it appears to work fine. I’ll try more esoteric URL combinations and see if it breaks.
I indented that code because of the repeated empty( $re ) checks. I had a hard time keeping track of how many times it needed to repeat the same check and bumped them in for clarity. Not a common formatting technique but helpful to me at the time.
Do me a favor and create a trac ticket over at http://trac.bbpress.org. Use your same bbPress.org login/password. I’ll be sure to check this out.
Do me a favor and create a trac ticket over at http://trac.bbpress.org. Use your same bbPress.org login/password. I’ll be sure to check this out.
Another oldie but goodie bumped.
Locked.
No reason to bring this back from 4 years ago.
Locked.
Lots of topics back from the dead lately.
Happy holidays to you too.
I am confident this potential exploit is now fixed, so if anyone wants to put some eyes on the bb-login.php from trunk would be helpful.
Happy holidays to you too.
I am confident this potential exploit is now fixed, so if anyone wants to put some eyes on the bb-login.php from trunk would be helpful.
Got the details and will patch asap. (Currently mobile and have limited Internet access due to visiting family in rural areas for holidays.)
Got the details and will patch asap. (Currently mobile and have limited Internet access due to visiting family in rural areas for holidays.)
Have been for past few weeks but have had other priorities to get started. I’ll probably post something up all official like eventually.
Heads up…
With the holidays coming up and starting my new job at Automattic, progress on the plugin is going to slow down for a week or two. GautamGupta is working on Google Code-in projects for the bbPress plugin and doing a great job on the tasks he’s completed so far.
As an operator of a forum with 4 million posts, you should know that creating multiple topics and bumping them hourly is a bad way to introduce yourself. You’ll have better luck waiting a few days and explaining in detail exactly what you’re question is.
From what I gather, Ashfame seems to have you on the right track. I deleted your other topic and bumps to focus the support in this topic.
As an operator of a forum with 4 million posts, you should know that creating multiple topics and bumping them hourly is a bad way to introduce yourself. You’ll have better luck waiting a few days and explaining in detail exactly what you’re question is.
From what I gather, Ashfame seems to have you on the right track. I deleted your other topic and bumps to focus the support in this topic.
Reply page now only shows one reply. Still probably needs some tuning, but at least it’s less confusing now.
Along the same lines as being able to view individual tweets, this is something that other forum software has had for years and something we can do pretty easily. I agree it isn’t properly integrated yet, but it’s mostly for external linking to something where the context of a topic isn’t needed.
@citizenkeith: Should be working? Worth testing though.
Sounds to me like you both downloaded the stand-alone version of bbPress and put it in your plugins directory.
bbPress currently is not a plugin, bit there is a version in development that is. The version of bbPress that you get by clicking “Download” in the upper right hand corner of this site is not a plugin for WordPress.
Sounds to me like you both downloaded the stand-alone version of bbPress and put it in your plugins directory.
bbPress currently is not a plugin, bit there is a version in development that is. The version of bbPress that you get by clicking “Download” in the upper right hand corner of this site is not a plugin for WordPress.
Rich is right. It ends up being a little bit chicken/egg but it should stand on its own before we open up the possibility of converting any data over.
If you feel your site is successful as it is now, and your users left because of the social network type setup that Burton moved to, it would take a custom and really muted theme to make BuddyPress a good move for you. By muted I mean you would want to keep the same kind of integration you have now, turn off BuddyPress Group Forums, and maintain the central forum setup that you have now.
If you feel your site is successful as it is now, and your users left because of the social network type setup that Burton moved to, it would take a custom and really muted theme to make BuddyPress a good move for you. By muted I mean you would want to keep the same kind of integration you have now, turn off BuddyPress Group Forums, and maintain the central forum setup that you have now.
