[_ck_]

HttpOnly cookies are a security advancement that is finally supported now by all major browsers (Firefox eventually got it right in 3.1, while IE 7 still has a bug but it generally works).

HttpOnly means a cookie cannot be read by javascript in the browser, only by the server (via PHP, etc.) This practically stops XSS exploits and makes it much harder if not impossible in most cases.

HttpOnly may “save your bacon” when a plugin has a security hole (like Private Messaging and bb-Reputation 0.0.5) and prevent a malicious script from forwarding your keymaster cookie to someone else via a XSS script.

I manged to get them to include HttpOnly in WordPress 2.7 and bbPress 1.0 but it’s still not in older WordPress or bbPress 0.9 because they worried about backward compatibility with some WordPress plugins that try to directly read the cookie (bad technique) instead of using server-side helpers.

However there are NO bbPress plugins that direct read the auth cookie and very few WordPress plugins still do this. I am not 100% positive how it will affect ajax but it shouldn’t because it’s still authorized on the server-side via PHP.

So if you’d like to try out HttpOnly on your bbPress 0.9, here’s how, it’s as simple as a mini-plugin. Note that if you are already using a cookie replacement plugin like my “Freshly Baked Cookies” or “Year Long Cookies” you will need to edit them instead of using the following (you can only use one cookie replacement plugin at a time).

I’d appreciate any feedback or experiences with this, especially if it causes problems:

Save this as _HttpOnly.php and upload into your my-plugins/ directory:

<?php

/*

Plugin Name: HttpOnly Auth Cookie

*/



function wp_set_auth_cookie($user_id, $remember = false) {

global $bb;



if ( $remember ) {

$expiration = $expire = time() + 1209600;

} else {

$expiration = time() + 172800;

$expire = 0;

}



$cookie = wp_generate_auth_cookie($user_id, $expiration);

do_action('set_auth_cookie', $cookie, $expire);



setcookie($bb->authcookie, $cookie, $expire, $bb->cookiepath, $bb->cookiedomain. '; HttpOnly' );

if ( $bb->cookiepath != $bb->sitecookiepath )

setcookie($bb->authcookie, $cookie, $expire, $bb->sitecookiepath, $bb->cookiedomain. '; HttpOnly' );

}

?>

To prove it’s working, you CANNOT use the Firefox webdeveloper plugin because that looks at the cookie in Firefox’s chrome, not at the user level. What you have to do is

1. prove you can see your bbpress/wordpress cookie by typing or copying this to your browser address bar javascript:alert(document.cookie);

2. install the plugin

3. log out and then log in

4. again type or copy this to your browser address bar javascript:alert(document.cookie);

5. if it’s working, you should NOT see your wordpress/bbpress cookie in the alert

Currently the only plugin I am aware of that tries to read the cookie directly in WordPress is the WP-UserOnline plugin from GamerZ, and he may have even fixed that by now in the newest versions. However there may be others, so test your setup.

[andrew-stacey]

I’ve had a go at adapting one of the WordPress plugins (easy LaTeX) for bbPress. It works for me, but there are probably a few things a little too specific to my set-up for it to be released “in the wild” – for example, I’m using both WordPress and bbPress so there’s a little cross-over information which wouldn’t be available on a bbPress-only site (putting in some options for that would probably be a good idea).

However, it might be suitable for beta-testing. I’ve put a copy here if anyone’s interested in taking a look and tweaking it.

A few details:

It uses a public server so no need for LaTeX to be installed locally.
It uses a cache (needs to be writable by the server) to save on server load.
It has a two-step parsing (not in the original) since forum posts are saved in their original format. This makes it more robust since the plugin allows for changing the tags that surround the mathematics. The saved format uses <math> tags which has the added advantage of avoiding markdown processing.
Due to being a rather limited programmer, I ended up copying stuff from other plugins to get it to work without really understanding what I was doing (particularly with add_filter and the like) so if some kind soul wishes to take pity on me and clean up my code I’d be very grateful.

[andreascreten]

Hi everyone

We are a web development agency from Belgium that’s working on a bbPress project, we are moving a big forum (1.5 million posts) from phpBB to bbPress. The only phpBB converter I found out there is quite outdated, so we need someone to write a new one. When the project is done we will make the converter free and open-source, so that everyone can use it.

Please email your portfolio and/or cv to andreas at madewithlove dot be if you are interested in doing this job.

Disclaimer:

We had contact with someone of this forum but since a couple of weeks he does not (or at least very slow) respond on our emails. If that person is reading this post, please get back in touch with us, we still want to work with you!

[chrishajer]

Sounds like you need to find someone local to walk you through it. You need a server environment to run the software. It’s not an executable you run on your desktop. You need a web server, a MySQL database and PHP. Those things can be installed on your desktop, or, with your domain, you can find a cheap/good web host to host this site, and you can install the software there. It will work either way. On your desktop, you don’t have to pay for a hosting account. If you have a domain though, why *not* get a host?

You can do this all on your desktop without paying for a server or hosting account at all, so long as you install server software on your desktop. https://bbpress.org/forums/topic/do-i-need-a-server#post-24581

[johnhiler]

I actually have a WYSIWYG editor (TinyMCE) working in bbPress… but haven’t released it since I don’t know if we can re-distribute TinyMCE’s software. But it’s really easy to do…

[kris_115]

Basically I am very new to website design. I have begun learning photoshop and fireworks and am building my site at the moment using dreamweaver. I may have the complete wrong lingo when describing what it is that I am asking, but I am looking into incorporating a forum into my site using bbpress. At the moment i have a domain but no server and I was just wondering if I need a server in order to start working on configuring my forum or if I can do this before setting up an account. (I have downloaded bbpress but have no idea how to install it or if it runs through dreamweaver… but i suppose that is another story all together). At the moment I am just wondering if my website needs to be established on a server in order to configure wordpress?

[killpack99]

I’ve just installed bbPress and I’m not using pretty permalinks and for some reason I never get a 404. Which at first doesn’t sound bad but I don’t get and 404 errors, no matter what I write in the address bar. I’d like to fix it (I’ve even specified a 404 page in .htaccess) but I’m really at a loss.

[John James Jacoby]

How I do deep integration using WordPress 2.7 and bbPress 1.0 Alpha 6.

Add to beginning of bb-config.php:

if ( !defined('ABSPATH') & !defined('XMLRPC_REQUEST')) {

define('WP_USE_THEMES', false);

include_once( '/absolute/path/to/yourdomain.com/wp-blog-header.php' );

header("HTTP/1.1 200 OK");

header("Status: 200 All rosy");

}

[kevinjohngallagher]

https://bbpress.org/plugins/topic/bb-reputation/

for those that dont know it

[_ck_]

If you use my bb-reputation plugin, please update to 0.0.6 ASAP.

http://bbpress.org/plugins/topic/bb-reputation

(remember to copy over your settings at the top if you have customized them)

[kevinjohngallagher]

Txanny, it’s hard to say as you’re talking about 6 months down the line, but if it was me i’d leave BBpress until the end of your development cycle. We’ve no idea what the 1.0 alpha is going to look like in 6 months, as the next release is going to break 2/3 of all plugins and none are being updated for some time, and _ck_ herself has stated she’s not fixing any of hers until 1.1 .

Given that 1.0alpha came out in September 16th last year and isn’t anywhere close to being out of alpha just now (some 6 months later), I’d suggest not making a decision on which BBpress version for quite some time yet, at least until 1.0alpha7 and we can see what the plugin fall out is.

If it was me though, i’d go with 0.9. it works well, the plugins work, development on it can continue, and it’s stable.

[chrishajer]

In another thread you posted this:

> I’m using bbpress 0.9.0.4 and wordpress 2.7.1.

Those two versions will not integrate user logins (cookies) unless you use one of these two solutions:

https://bbpress.org/plugins/topic/freshly-baked-cookies/

https://bbpress.org/forums/topic/bayanimecom-wp26-and-bbpress-09-complete-cookie-integration

[chrishajer]

There’s something wrong with your header.php if there is just a “>”.

It should look like this:

http://svn.automattic.com/bbpress/tags/0.9.0.4/bb-templates/kakumei/header.php

[_ck_]

I’ve actually become the maintainer for that recently.

The problem is their options are VERY limited with no room for details.

WYSIWYG would be wrong, I’ll go look at that, but bbPress has partial or most of the others.

[kevinjohngallagher]

Not a great title but it’s after 3am here.

I remembered in October last year _ck_ posted a link to ForumMatrix and it’s information on BBpress:

http://www.forummatrix.org/show/bbPress

Now, if it’s not someone involved with the project that keeps ForumMatrix up to date, then i’m very sorry for asking but right now i find it a good source of “where we’re at”, but ee seem to have PLUGIN listed in every box. The thing is, i dont think we have plugins for some of this stuff.

For example, where is the WYSIWYG plugin?

According to forum matrix BBpress has plugins for Full BBcode, WYSIWYG editor, nested quotes, syntax highlighting, multiple file attatchments, acl, blacklist, warnings, suspensions, ip-block, audit logging, user reports, rating/karma system, custom profile fields, split threads, calendar, pruning , archiving, export private messages, lo-fi view.

Thing is, i dont see any working plugins that do those jobs. Now, i’m more than happy to admit that i may be wrong (be great if i was), but i do find the whole current plugin page a bit of a mess (given that the latest plugins, latest talked about plugins, and the highest rated plugins are generally quite similar).

Any help in finding working plugins that BBpress is supposed to have would be really helpful

Thank you all

[Chad Holden]

when posting a topic within any forum, after I click submit, it goes directly to a This topic has been closed page. Nothing else shows, no errors. Just the standard green bbpress error page.

Anyone else experience this? ANy fixes?

[ganzua]

Ok, thanks for your help I’m going to try more of these queries. I find them very useful to integrate small details.

[_ck_]

To be clear, both bbPress and WordPress for that matter still work fine under PHP 4.4.x and technically 4.4.x is still supported officially.

It’s just the specific i18n problem they are encountering, where the fix in 1.0 hasn’t been backported to 0.9

Sam is unlikely to make any further changes to 0.9 unless it’s a security fix or serious performance problem.

I haven’t looked at the fix for 1.0 but I suspect someone could make a patch to make 0.9 do the same thing if they really wanted.

[_ck_]

Because for some reason the bbdb object must not be created when deeply integrated under 1.0

Must have something to do with backpress which re-uses wp functions.

[ganzua]

That is with bbPress 1.0 right? the object_type is for 1.0

Yes, it is bb 1.06a with wp 2.7

I tried with get_var and I get the same error for get_var;

Fatal error: Call to a member function get_var() on a non-object in….

but then I changed $bbdb for $wpdb and it works. Why? I don’t understand this.

[johnhiler]

Yup! _ck_ did a great job with this plugin:

https://bbpress.org/plugins/topic/instant-password/

I’ve been using it for a while, and it’s really great…

[dphs]

Hi,

There is an answer to this question posted a year ago, but when I open the header.php file from my bb-templates/kakumei folder all that is there is “>”. I tried adding the code there, but it deleted the header. Is it located in another place?

I’m using bbpress 0.9.0.4 and wordpress 2.7.1.

Thanks!

[_ck_]

That is with bbPress 1.0 right? the object_type is for 1.0

You get nothing using get_results because it returns an array – use get_var instead

<?php

global $bbdb;

$result=$bbdb->get_var("SELECT SUM(meta_value) FROM bb_meta WHERE object_type='bb_topic' AND meta_key='views'");

echo $result;

?>

[ganzua]

I need more info than “didn’t work”

Fatal error: Call to a member function get_results() on a non-object in wordpress/wp-content/themes/mytheme/header.php on line 149 (line where I placed the code)

Try replacing $bbdb with $wpdb

no error but what I want is to query bbpress data base. Whenever I echo $results there is no answer.

[Bloggsbe]

Norwegian translation of 0.9.0.4 -> here

Norsk oversettelse av 0.9.0.4 -> her

—

Rune

Norsk WordPress og bbPress forum