[kaihsynliu]

Since file hosted by mediafire could be expired some day, I put the files on my own space. http://imlab.cs.nccu.edu.tw/~kaihsyn/files/bbPress_zh_tw.zip

[Ashish Kumar (Ashfame)]

@ckwalsh I am do supporting _ck_, bbPress as bbPress is generating each and everything again and again on each page load. It doesn’t matter if its a first load or second or third whereas in other forum scripts, there is some sort of caching involved in each of them which makes the difference in subsequent loads by caching atleast some part of it.

I hope I made my point. If I had nothing to say or I wouln’d have got a word about what’s being discussed here, I wouldn’t have left a comment.

[MakMak2]

The work around seems to be log out of WordPress then log in to bbPress when you want to administer bbPress.

Yeah I figured that, so wait, there’s no current way to circumvent that?

[_ck_]

All BBcode-lite users should upgrade to 1.0.5 IMMEDIATELY

(regardless if you allow images or not)

http://bbpress.org/plugins/topic/bbcode-lite/

http://plugins-svn.bbpress.org/bbcode-lite/trunk/

This is an important security update.

[_ck_]

Okay here’s the reality.

Basically bbPress doesn’t run it’s tag filter on post_text when the text is finally displayed, because it would be too slow.

Instead it only checks tags during saving time and filters then.

If an item is not a tag AT SAVE TIME it won’t get checked.

That is how this is slipping through, because bbcode are not html tags.

I have a quick, dirty fix.

Basically anything that gets stuck INSIDE a tag ie. [HERE] = < HERE > is no longer allowed to contain spaces, single quote or double quote. Stuff [blah]HERE[/blah] = <blah>HERE</blah> is okay.

Preventing spaces alone, in theory, should be enough. Even url or entity encoding won’t get properly parsed. It will simply display as plain text and then you can see who is posting what instead of hidden stuff.

The only good news is that this problem in theory should not allow admin cookies to be stolen since the last version of 0.9 and 1.x already use HttpOnly cookies which cannot be read by javascript.

The downside of the quick-fix is that secondary attributes are no longer possible until I come up with another way. Example of secondary would be alt or title etc.

Many thanks for reporting this Tom!

[_ck_]

Double frack, it’s not just IMG.

Working hard on a fix.

All BBcode-lite users should upgrade to 1.0.5 IMMEDIATELY

(regardless if you allow images or not)

https://bbpress.org/plugins/topic/bbcode-lite/

https://plugins-svn.bbpress.org/bbcode-lite/trunk/

[_ck_]

Oh frack, it’s bbcode-lite.

I run through post-text so the bbpress parser never fires.

Fortunately img is disabled by default but I bet people turn it on.

Working on a fix.

[chrishajer]

If the software you install today works for you, why upgrade it to the plugin version? It’s not even an “upgrade” so much as it will be installing completely different software. It would be like switching from bbPress to WP Forum or some other forum plugin for WordPress. Would you expect your bbPress plugins to work with any other WordPress forum plugin? I don’t think so, and I don’t think you should expect any existing plugins for bbPress to work (or even be necessary, for that matter, when running the WordPress plugin.)

[tom.mccabe]

I’m using the Allow Images plugin (https://bbpress.org/plugins/topic/allow-images/).

[enatom]

How did you do you this?

[Elias Schwerdtfeger]

By default, bbPress does not allow using the img tag, it needs a plugin for this functionality. Of course, the given attributes style and any kind of JavaScript handler is highly unwanted, but it is a weakness in the plugin’s code, which has to be patched asap.

[tom.mccabe]

Hey everyone. I believe there’s a security flaw within BBPress that allows for any forum user to insert JavaScript into their posts. For instance, the following code replaces instances of “oldStuff” with “newStuff”:

[img]http://www.whatever.net/forums/bb-admin/images/blank.gi” style=”display:none;” onerror=”this.parentNode.parentNode.parentNode.parentNode.parentNode.innerHTML = this.parentNode.parentNode.parentNode.parentNode.parentNode.innerHTML.replace(/oldStuff|onerror/g,’newStuff’);[/img]

What are the patching instructions? Thanks.

[_ck_]

All your current benchmark proves is that bbPress will be slower for 20 concurrent connections over 1000 passes, where no-one is logged in and the content never changes.

What I am saying is that’s not how people run forums, you need a more realistic benchmark, which I know from experience is going to be tricky to code.

bbPress 0.9 will be faster than what you have shown by about 50% and then with content caching it will compete fairly against the others.

Apachebench is not dynamic enough to prove real-world usefulness and barebones bbpress out-of-the-box is certainly not setup for a large site. But with plugins it certainly can be. There are some reasonably large sites on the Top 100.

[garyditsch]

thanks, that actually makes sense. my question now is that both of my blogs have the “wp_” prefix. i think that saying “new” is misleading.

both blogs are fairly established, so i’m not sure what would happen if i changed the wp_prefix? there are already 100’s of posts on that blog and while i’m trying to transfer the users from one blog to another, i’d rather not lose the posts/pages

so.. i guess what i’m looking at is that the user tables are named the same thing b/c i just used the normal wp set up, but they sit on different databases. i’m wondering if just naming the user_table will work?

[tpack]

I did this in my footer.php of my Kakumei theme.

Find your theme folder. E.g. /forums/bb-templates/YOUR-THEME/footer.php.

Edit footer.php code:

<div id=”footer” role=”contentinfo”>

<p><?php printf(__(‘%1$s is an online discussion site of the YOUR-DOMAIN.com‘), bb_option(‘name’), “http://YOUR-DOMAIN.com&#8221;) ?></p>

[ckwalsh]

Um, wow. I’ll admit I’m quite astounded and I’m not quite sure what to say, but I’ll try.

Actually the PHP version kinda proved my point about content caching.

It’s taking 3-4 ms.

The front page index on most of those forums is taking 20-25ms

Uh… no they aren’t. http://bb-bench.com/benchmark/1#section_p_index

That’s impossibly fast, it definitely means content is not being regenerated. If the cache was defeated it would have to re-render the whole thing and the page time would be significantly higher.

No, it’s not impossibly fast. I have not perused the code of most systems, but I can guarantee phpBB does not cache the output of its pages. They are retrieved every page load. Sure, there is a caching system in place, but it doesn’t catch the output of a page, only stores a few variables that don’t even improve performance particularly. As for caching at the apache level, you would see a much bigger difference in speed than you do see. Without special configuration, apache should never cache the output of a php page, since that would entirely defeat the purpose of a dynamically generated page.

Caching page output is near impossible for forums in general, due to forum permissions and session specific information. It would be kind of bad if my “One private message unread” were cached for you. The only other form of caching is the sql cache, which is contained entirely within MySQL, and is automatically activated for all queries, regardless of software.

bbPress doesn’t even save the tag cloud between pages, it will re-render it each and every time, which is at least 1/4th of the page render time (that can be changed via a plugin).

Sounds like that’s a big area for bbPress to improve. But it still doesn’t make the result invalid: bbPress is slower.

So 265ms vs 78ms

bbPress 0.9 is “only” 187ms slower than statically served PHP.

Do your math again. It’s 260ms slower than a static page. It’s still damn slow, and if someone installs bbpress and *pick another board* side by side, the bbpress one will not perform better. While technically correct, it does nothing to affect the overall results.

@ckwalsh, Your benchmarks are incorrect this way. _ck_ is right about it

Can you please paraphrase what his arguments are, and perhaps add a little bit more? I’m getting the feeling that you posted here to support _ck_ since the results I found were unfavorable to bbPress, and you don’t have anything to add, or even understand the discussion. Not to say I only want to talk to experts, but blind bandwagonning always frustrates me on the internet.

Basically I’d want to see a simulated load with logged in users being served different content – ie. unread posts for different users

Certainly apache bench isn’t perfect, however, it does show the relative performance of those 3 pages, which are almost guaranteed to be responsible for the majority of requests to a forum. I have been considering how to build a better tool, but have not gotten a chance to do so yet.

But plugins can still do content caching themselves. For example I realized awhile back that the Hot Tag cloud that bbPress renders is taking at least 1/4th of the total page render time, and it does it each and every time, regardless if there are new tags added or deleted. So my Hot Tags Plus plugin caches the tag cloud as static html (as well as add many other features to it at the same time).

If you think that will drop load time, it seems to be something anyone can add – I’d certainly be willing to install it for my tests.

Overall, you seem to be upset that bbPress performed so badly, leading you to say the benchmark is wrong. While it isn’t perfect, what it does show it shows rather precisely. In the current state of forum software, bbPress does appear to have a long way to go. It doesn’t matter if it was rewritten. It doesn’t matter if it doesn’t have caching (if so, that is a failure of bbPress, not an unfair advantage to other software). When comparing the same functionality between software, those are the results, like them or not.

[Ricardo]

Thats what “worries” me, the plugins wont be compatible but will the images show up? If the plugin is not present will the images work? They’re uploaded to bbpress folder so im thinking that as long as they are there they will show up even if the plugin is not there.

Some dark times (or not) are coming for bbpress, i’m not sure if i’m the only one asking these questions when looking for a forum script/plugin.

I think from a user prespective we all ask ourselves these questions but there’s no info on bbpress future.

I like bbpress but i can´t see it on a medium/long term prespective, am i worrying to much about these questions?

[chrishajer]

Can't access the dashboard

There are lots of topics that deal with this very problem. Just click on the integration tag and read.

The work around seems to be log out of WordPress then log in to bbPress when you want to administer bbPress.

[_ck_]

None of my plugins (or any others) will be compatible with the next version of bbPress (1.2 or 2.0 or whatever they are going to call it to confuse people).

Also, none of the existing themes.

Basically think of the next version of bbPress as another program entirely that they just insist on calling bbPress anyway.

[Ricardo]

Another question… take for example CK’s image upload plugin, wiil the images show up on future bbpress versions even if the plugin is discountinued?

Also will the permalink structure remain in future versions? i know search engines adapt to it but links from other sites will end up in a 404 error page…outside links still go to the forum but not the right page.

[_ck_]

Well I don’t want to discourage his initiative, it’s a great idea.

I just think a better tool then apachebench needs to be written.

Basically I’d want to see a simulated load with logged in users being served different content – ie. unread posts for different users

and most importantly, I’d want to see new posts generated (or existing posts edited) that force content caching to be defeated.

If bbPress 0.9 had been finished instead of all that all wasted coding energy Sam was forced into porting it to backpress, we’d definitely have some content caching by now.

But plugins can still do content caching themselves. For example I realized awhile back that the Hot Tag cloud that bbPress renders is taking at least 1/4th of the total page render time, and it does it each and every time, regardless if there are new tags added or deleted. So my Hot Tags Plus plugin caches the tag cloud as static html (as well as add many other features to it at the same time).

[Ricardo]

@ Chrishajer

Thanks for your advices

@ Fernando

About the localization, bbpress (1.02) its not available in Portuguese (Portugal), i wanted to translate just the “bits” that the user sees, ive tried poedit but its take time as i cant copy all strings from the “original area” to the “translated area” with one click, need to copy paste one by one, i installed glotpress and it copied all strings as i wanted with one click… all i have to do is edit the ones i want (what the user sees)

Off topic:

one question about glotpress….how can i change the admin password? I couldnt find any reference on how to do it, i wanted to make “my glotpress” available to anyone to contribute but without changing the password anyone can login as a admin and erase all the work done. Anyone know how to change the admin password on glotpress from the default one?

Thanks to everyone for your advices

[Ashish Kumar (Ashfame)]

the new blog tables is just left as it is, you can delete that if you want.

you can even specify the user tables to be used while installing.

this is how it is done in wp-config.php –

define('CUSTOM_USER_TABLE','new_user_table');

define('CUSTOM_USER_META_TABLE', 'new_usermeta_table');

those two lines should be in that WP whose user tables you want to change.

like my initial has a wp_ prefix, then in the new installation, which has something different (lets say wp1_ or anything), put the lines in wp-config.php

define('CUSTOM_USER_TABLE','wp_users');

define('CUSTOM_USER_META_TABLE', 'wp_usermeta');

[_ck_]

quick ‘n’ dirty test: ab -c 20 -n 1000

bbpress 1.1

.             min  mean[+/-sd] median   max

Total:         46  458 117.9    453    1250

bbpress 0.9 (with $bb->load_options=true;)

.             min  mean[+/-sd] median   max

Total:         46  275  90.6    265     890

453ms vs 265ms (or 458 vs 275)

So, I’d expect I’d see around a 50% improvement on your box on 0.9

now – vs static cache content simulation:

bbPress 0.9 front page html saved as static.php

and <?php $test=1; ?> put at top to force PHP parser to turn on

.             min  mean[+/-sd] median   max

Total:         15   75  14.3     78     109

So 265ms vs 78ms

bbPress 0.9 is “only” 187ms slower than statically served PHP.

In a nutshell:

.             min  mean[+/-sd] median   max

bbpress 1.0:   46  458 117.9    453    1250

bbpress 0.9:   46  275  90.6    265     890

static PHP     15   75  14.3     78     109

[_ck_]

Actually the PHP version kinda proved my point about content caching.

It’s taking 3-4 ms.

The front page index on most of those forums is taking 20-25ms

That’s impossibly fast, it definitely means content is not being regenerated. If the cache was defeated it would have to re-render the whole thing and the page time would be significantly higher.

bbPress doesn’t even save the tag cloud between pages, it will re-render it each and every time, which is at least 1/4th of the page render time (that can be changed via a plugin).

So you aren’t testing renderer-vs-renderer, you’re testing content caching vs content caching. You aren’t even testing for logged-in users but only outside visitors.

If we are going to play that game, all someone has to do is port wp-super-cache to bbpress and it will beat every forum in existence, because static html will be served via htaccess directly and bypass PHP/MySQL entirely. So you’d be down to 4ms (or less) per page.

In any case, I am looking forward to seeing how 0.9 does against 1.0 under 20 concurrency.