[Erlend]

I was reading a reply to my own thread when I noticed it said on the left:

Started 10 hours ago by hennyjack

“hennyjack” hadn’t even posted in the thread. I was going to report this, but then I thought, “why bother? It’s not the old bbP standalone we should be worrying about anyhow.”

I’ve tested bbPress and it can definitely talk the talk, but of course I can’t tell for sure if it can walk the walk on a high profile site such as bbpress.org. That said, I think this is as good a time as any to start discussing when the bbPress community should start “eating their own dog food”.

Maybe a good topic for the next weekly meeting?

[John James Jacoby]

The recent WordPress security upgrade (regarding kses) wasn’t 4 hours from initial contact to release, but you’re right to say that having more eyes and developers did help to expedite the testing.

Needless to say I wasn’t personally accessible to work on this until I was back from holiday, so it is me dropping that ball and not being prepared. I’ll take that responsibility even if no one expects me to.

Honestly, the reminders get a little repetitive, but only because I get them from a few different places. Open source development is kinda like having 1,000 bosses, but I’m used to it and take pride in having people be worried about the state of things.

I’ve got pretty thick skin and don’t take things personally. So, no worries.

Another personal hurdle was learning exactly what the procedure is to actually push out a release of bbPress. Having never needed to do it yet, and having the only person who has in the past few years (Sam) not immediately at my disposal, it took a few days to get me setup and ready to be able to do it.

The trunk and 1.0 branches are fixed. The 1.0 branch is ready for a release. I am going to do the 0.9 branch tonight, do some testing, make my first deployments, and look forward to things hopefully going smoothly for releases tomorrow or this weekend.

I’m not new to bbPress, but I am new to the logistics. Don’t fret, I’m a fast learner.

[John James Jacoby]

The recent WordPress security upgrade (regarding kses) wasn’t 4 hours from initial contact to release, but you’re right to say that having more eyes and developers did help to expedite the testing.

Needless to say I wasn’t personally accessible to work on this until I was back from holiday, so it is me dropping that ball and not being prepared. I’ll take that responsibility even if no one expects me to.

Honestly, the reminders get a little repetitive, but only because I get them from a few different places. Open source development is kinda like having 1,000 bosses, but I’m used to it and take pride in having people be worried about the state of things.

I’ve got pretty thick skin and don’t take things personally. So, no worries.

Another personal hurdle was learning exactly what the procedure is to actually push out a release of bbPress. Having never needed to do it yet, and having the only person who has in the past few years (Sam) not immediately at my disposal, it took a few days to get me setup and ready to be able to do it.

The trunk and 1.0 branches are fixed. The 1.0 branch is ready for a release. I am going to do the 0.9 branch tonight, do some testing, make my first deployments, and look forward to things hopefully going smoothly for releases tomorrow or this weekend.

I’m not new to bbPress, but I am new to the logistics. Don’t fret, I’m a fast learner.

[John James Jacoby]

The trunk is technically 1.1, so both the 1.0 branch and 0.9 branches also need fixes, which means they both need testing. There is also another critical bug that’s cropped up that I’m working on currently, to get them both in under the same security releases.

[John James Jacoby]

The trunk is technically 1.1, so both the 1.0 branch and 0.9 branches also need fixes, which means they both need testing. There is also another critical bug that’s cropped up that I’m working on currently, to get them both in under the same security releases.

[hbalagh]

have the latest bbpress and wanted to know how to limit the display of the thread titles so it will be something like this

this is a test of a thread title an…

[Willabee]

Use wordpress function query_posts().

Then give it the parameters of author_name and post_type.

@ Gautam/JJJ

Any major updates planned soon? Want to launch a site with this plugin end of the month, so would like it if I can build in the latest and greatest. Keep it up. ^^

[McGeeSteve]

norcalmilsim.com/forum

I have login synchronized with WP and bbPress.

The only option I have as Admin / Keymaster or my account McGee / Administrator is to ‘Add New’ in the ‘Latest Discussions’ topic section.

I do get a new window and can enter a title and content, but can’t select one of the two forum for the topic. When I click ‘Send Post’ the next page says ‘This topic has been closed’ every time.

There are no other options to add, rely or create anything new.

All I have been able to do is edit a post as the Admin.

[Peter Westwood]

I’ve ported over the changes to KSES and clean_url into a branch in the BackPress repo ready for bbPress 1.0.x branch work.

If anyone has cycles to review and test would be great

http://backpress.automattic.com/log/branches/bbpress-1.0-backpress

[Peter Westwood]

I’ve ported over the changes to KSES and clean_url into a branch in the BackPress repo ready for bbPress 1.0.x branch work.

If anyone has cycles to review and test would be great

http://backpress.automattic.com/log/branches/bbpress-1.0-backpress

[Gautam Gupta]

@intimez

I started from scratch and I’m trying to add it to the menu

Ok, here are the steps to test the plugin:

1. Upload the plugin folder to the wp-content/plugins directory & activate it.
2. Go to Appearance -> Themes & activate the bbPress TwentyTen theme.
3. If you’re using permalinks, go to Settings -> Permalinks and click the save button.
4. Go to Pages -> Add new & select bbPress - Forum index in the template selection in the right side, give the page title Forums or anything and press publish. You can repeat the step to add pages like add new topic, topic index page etc.
5. Go to Appearance -> Menu if you want to add those pages to the menu for easy navigation.
6. Go to Forums -> Add new & write a forum title, description and press publish.
7. Now go to your blog’s home page or that forum you created or directly here – http://www.example.com/bbtest/forums
8. If you go to that /forums url, hopefully you’d see the forum listed which you just created and the new topic form.
9. Browse, test & report bugs

[intimez]

I started from scratch and I’m trying to add it to the menu

I’ve tried

http://www.example.com/bbtest/forums

http://www.example.com/bbtest/forum

Each of them go to Page not found page.

[comankind]

I’ve got a fresh install of the latest versions. Have config’d both config.php files to match. This is on 1and1.

I was able to login to WP just fine, but as I installed BB, WP tells me ‘You do not have sufficient permissions to access this page.’ when logging in with admin account.

I installed BB on same DB as WP.

BB works fine.

I’ve tried resetting the password on WP, same result.

Any input would be appreciated. thanks!

[Gautam Gupta]

@Willabee

As I said earlier, “And we’re also done with these or I’ve patches ready for these“. I’m still doing testing etc. & I’ll post the patches once I’m finished.

@alanchrishughes

If you are talking about one reply per page style threads like creativecow.com please do not, that is the most annoying forum to follow in the world.

Nothing like that. Moreover, replies per page would be an option given to the user.

Someone also mentioned the forums/forum/thread problem and I agree, I would like if possible the option to just go http://www.sitename.com/forum/threadname. Not every market or group needs that much organization. And being able to rename “forum” to something else would be nice also, I don’t know if that is already possible or not, I’ve been trying to be patient and just wait until it is done.

Yup, there would be options to edit any slug.

Are you still required to use the Twenty Ten theme? Or was that just something during the development process?

The development process is still going on, though you can port your themes very easily, you just need to add a few files.

Is this the version that is suppose to be compatible with Buddypress?

Nop, we’re focussing on the basic forum features right now. No BuddyPress integration yet (I don’t know if jjj’s working on that, but I don’t think so).

[amxcld9]

How do I ad a link back my main WordPress page?

I want it at the top to the right of the login link.

Any ideas?

Thanks,

I’m using latest versions as of Dec 2010

[Gautam Gupta]

@intimez

Regarding forums/forum, that’s gonna be an option. You could remove the root slug (i.e. forums) from all the slugs, once we just add it.

And regarding [edit, sticky, move], I said “And we’re also done with these or I’ve patches ready for these“. If you want to test these, just register up on my demo forums, I’ve set the default role as Forum Moderator, so you’d see those links.

[intimez]

I downloaded branches_plugin-2743 and testing once again

I installed in subfolder and created a forum called general and getting the following url: http://www.example.com/bbtest/forums/forum/general

Why forums/forum?

Also [edit, sticky, move] are greyed out for topics.

[Malfunction]

Is there anything a moderate PHP programmer / designer can do to help? Testing, coding?

Looking forward to see this plugin developed. Could use a proper forum plugin that integrates well with WordPress itself.

[John James Jacoby]

In this topic is fine. Would rather have more eyes on this than less.

The solution involved the shuffling of things around, as well as this specific addition: https://trac.bbpress.org/browser/trunk/bb-login.php#L51

Basically if the esc’ed $re is now empty, fall back to the installation root. At first this seemed like a silly solution, but because the login always attempts to smart redirect, there isn’t a circumstance where it would naturally be empty. By moving the esc’s up and letting them filter out the baddies, it’s possible to end up with an empty $re.

Tested with ampersands and question marks and it appears to work fine. I’ll try more esoteric URL combinations and see if it breaks.

I indented that code because of the repeated empty( $re ) checks. I had a hard time keeping track of how many times it needed to repeat the same check and bumped them in for clarity. Not a common formatting technique but helpful to me at the time.

[John James Jacoby]

In this topic is fine. Would rather have more eyes on this than less.

The solution involved the shuffling of things around, as well as this specific addition: https://trac.bbpress.org/browser/trunk/bb-login.php#L51

Basically if the esc’ed $re is now empty, fall back to the installation root. At first this seemed like a silly solution, but because the login always attempts to smart redirect, there isn’t a circumstance where it would naturally be empty. By moving the esc’s up and letting them filter out the baddies, it’s possible to end up with an empty $re.

Tested with ampersands and question marks and it appears to work fine. I’ll try more esoteric URL combinations and see if it breaks.

I indented that code because of the repeated empty( $re ) checks. I had a hard time keeping track of how many times it needed to repeat the same check and bumped them in for clarity. Not a common formatting technique but helpful to me at the time.

[_ck_]

Maybe I am getting rusty, but looking at the diff, I don’t see it.

Basically it’s the same thing, shuffled around a bit and the same esc_url and esc_attr is being used at the end, which is the same pattern as the existing 1.0/1.1 code.

Are you sure the fix was not being caused by just having a more updated version of esc_url and esc_attr ?

Or was it just being solved by moving those two sanitizers up higher before bb_safe_redirect could ever be called. Because that was definitely an oversight on someone’s part (not me). Based on the comments I’d guess they thought their functionality was for display filtering and not actually sanitization.

Looking at esc_url though, its default is indeed meant for displaying urls by default, note the comment in the code “Replace ampersands and single quotes only when displaying.” and how the context is set by default to “display”.

Maybe test your solution with a url that contains an ampersand, it probably will not work?

Also, are you relying on the list of protocols to do the sanitization? Because that could be defeated too (and would prevent using relative urls that are legitimate).

ps. very minor but you have confusing indentation indicating nesting with the code at line 18 – which actually is not nested

Feel free to email me directly if that’s better.

[_ck_]

Maybe I am getting rusty, but looking at the diff, I don’t see it.

Basically it’s the same thing, shuffled around a bit and the same esc_url and esc_attr is being used at the end, which is the same pattern as the existing 1.0/1.1 code.

Are you sure the fix was not being caused by just having a more updated version of esc_url and esc_attr ?

Or was it just being solved by moving those two sanitizers up higher before bb_safe_redirect could ever be called. Because that was definitely an oversight on someone’s part (not me). Based on the comments I’d guess they thought their functionality was for display filtering and not actually sanitization.

Looking at esc_url though, its default is indeed meant for displaying urls by default, note the comment in the code “Replace ampersands and single quotes only when displaying.” and how the context is set by default to “display”.

Maybe test your solution with a url that contains an ampersand, it probably will not work?

Also, are you relying on the list of protocols to do the sanitization? Because that could be defeated too (and would prevent using relative urls that are legitimate).

ps. very minor but you have confusing indentation indicating nesting with the code at line 18 – which actually is not nested

Feel free to email me directly if that’s better.

[yehgdotnet]

We learnt bbpress is somewhat linked with wordpress.

However, according to our testing result on wp latest version, it is certainly not vulnerable to this issue.

[yehgdotnet]

We learnt bbpress is somewhat linked with wordpress.

However, according to our testing result on wp latest version, it is certainly not vulnerable to this issue.

[_ck_]

Thanks, I got the report.

This is interesting.

Do you find that WordPress fails this test too? Because it uses a very similar routine.

I feel the problem should be addressed in function wp_sanitize_redirect which would solve it cross-platform.