[Malfunction]

Is there anything a moderate PHP programmer / designer can do to help? Testing, coding?

Looking forward to see this plugin developed. Could use a proper forum plugin that integrates well with WordPress itself.

[John James Jacoby]

In this topic is fine. Would rather have more eyes on this than less.

The solution involved the shuffling of things around, as well as this specific addition: https://trac.bbpress.org/browser/trunk/bb-login.php#L51

Basically if the esc’ed $re is now empty, fall back to the installation root. At first this seemed like a silly solution, but because the login always attempts to smart redirect, there isn’t a circumstance where it would naturally be empty. By moving the esc’s up and letting them filter out the baddies, it’s possible to end up with an empty $re.

Tested with ampersands and question marks and it appears to work fine. I’ll try more esoteric URL combinations and see if it breaks.

I indented that code because of the repeated empty( $re ) checks. I had a hard time keeping track of how many times it needed to repeat the same check and bumped them in for clarity. Not a common formatting technique but helpful to me at the time.

[John James Jacoby]

In this topic is fine. Would rather have more eyes on this than less.

The solution involved the shuffling of things around, as well as this specific addition: https://trac.bbpress.org/browser/trunk/bb-login.php#L51

Basically if the esc’ed $re is now empty, fall back to the installation root. At first this seemed like a silly solution, but because the login always attempts to smart redirect, there isn’t a circumstance where it would naturally be empty. By moving the esc’s up and letting them filter out the baddies, it’s possible to end up with an empty $re.

Tested with ampersands and question marks and it appears to work fine. I’ll try more esoteric URL combinations and see if it breaks.

I indented that code because of the repeated empty( $re ) checks. I had a hard time keeping track of how many times it needed to repeat the same check and bumped them in for clarity. Not a common formatting technique but helpful to me at the time.

[_ck_]

Maybe I am getting rusty, but looking at the diff, I don’t see it.

Basically it’s the same thing, shuffled around a bit and the same esc_url and esc_attr is being used at the end, which is the same pattern as the existing 1.0/1.1 code.

Are you sure the fix was not being caused by just having a more updated version of esc_url and esc_attr ?

Or was it just being solved by moving those two sanitizers up higher before bb_safe_redirect could ever be called. Because that was definitely an oversight on someone’s part (not me). Based on the comments I’d guess they thought their functionality was for display filtering and not actually sanitization.

Looking at esc_url though, its default is indeed meant for displaying urls by default, note the comment in the code “Replace ampersands and single quotes only when displaying.” and how the context is set by default to “display”.

Maybe test your solution with a url that contains an ampersand, it probably will not work?

Also, are you relying on the list of protocols to do the sanitization? Because that could be defeated too (and would prevent using relative urls that are legitimate).

ps. very minor but you have confusing indentation indicating nesting with the code at line 18 – which actually is not nested

Feel free to email me directly if that’s better.

[_ck_]

Maybe I am getting rusty, but looking at the diff, I don’t see it.

Basically it’s the same thing, shuffled around a bit and the same esc_url and esc_attr is being used at the end, which is the same pattern as the existing 1.0/1.1 code.

Are you sure the fix was not being caused by just having a more updated version of esc_url and esc_attr ?

Or was it just being solved by moving those two sanitizers up higher before bb_safe_redirect could ever be called. Because that was definitely an oversight on someone’s part (not me). Based on the comments I’d guess they thought their functionality was for display filtering and not actually sanitization.

Looking at esc_url though, its default is indeed meant for displaying urls by default, note the comment in the code “Replace ampersands and single quotes only when displaying.” and how the context is set by default to “display”.

Maybe test your solution with a url that contains an ampersand, it probably will not work?

Also, are you relying on the list of protocols to do the sanitization? Because that could be defeated too (and would prevent using relative urls that are legitimate).

ps. very minor but you have confusing indentation indicating nesting with the code at line 18 – which actually is not nested

Feel free to email me directly if that’s better.

[yehgdotnet]

We learnt bbpress is somewhat linked with wordpress.

However, according to our testing result on wp latest version, it is certainly not vulnerable to this issue.

[yehgdotnet]

We learnt bbpress is somewhat linked with wordpress.

However, according to our testing result on wp latest version, it is certainly not vulnerable to this issue.

[_ck_]

Thanks, I got the report.

This is interesting.

Do you find that WordPress fails this test too? Because it uses a very similar routine.

I feel the problem should be addressed in function wp_sanitize_redirect which would solve it cross-platform.

[_ck_]

Thanks, I got the report.

This is interesting.

Do you find that WordPress fails this test too? Because it uses a very similar routine.

I feel the problem should be addressed in function wp_sanitize_redirect which would solve it cross-platform.

[wikileaksforum]

Hi Willabee,

Thanks for your response, I now have a quick and dirty fix by showing 100 post per page so its not showing page count.

Any change you have skype available to contact and test it out?

Or just post here and I will enable normal post per page (25) and you can hopefully check it out

[wikileaksforum]

Hi Willabee,

Thanks for your response, I now have a quick and dirty fix by showing 100 post per page so its not showing page count.

Any change you have skype available to contact and test it out?

Or just post here and I will enable normal post per page (25) and you can hopefully check it out

[Double Stuff]

Hello All

Happy Holidays

I had my host install bbpress on url/forum and now I am stuck. They do not provide support.

I have been able to login to bb-admin but see no administrative options. Just a “This Is Your First Post” and a test post the host did.

I guess what I’m looking for is the manual and directions to set up and sync to the existing wordpress blog.

I have put the integration plugin on my server in my-plugins but see no way to activate it or set up. The plugin read me only says “put in my-plugins folder”

I have been reading the forum and docs for two days and just dont get it.

Whats my next step/steps once install is complete.

Feel free to list all the steps to follow.

I’m not a coder, but know the wp files pretty well.

Thanks in advance for your help

—-

[zaerl]

It would be great if you tell me the alternative or solution.

Actually I can’t release the source code of my adaptation because of the GPL’s rules but I have modified the original plugin on the fly for you. Keep in mind that I have changed it but I haven’t tested it nor I have run it. So don’t install it in a production server but test if it functions first.

In my bavatars mod every files are stored on the ‘avatars/’ folder. Obviously you need to transfer all existing images in the top directory and then delete all the folders (it can be a very very long operation if you access your server through FTP).

http://dl.dropbox.com/u/15741404/bavatars.0.4.1-zaerl-mod.zip

I can write a php snippet that copies the images in the top folder if you want.

[zaerl]

It would be great if you tell me the alternative or solution.

Actually I can’t release the source code of my adaptation because of the GPL’s rules but I have modified the original plugin on the fly for you. Keep in mind that I have changed it but I haven’t tested it nor I have run it. So don’t install it in a production server but test if it functions first.

In my bavatars mod every files are stored on the ‘avatars/’ folder. Obviously you need to transfer all existing images in the top directory and then delete all the folders (it can be a very very long operation if you access your server through FTP).

http://dl.dropbox.com/u/15741404/bavatars.0.4.1-zaerl-mod.zip

I can write a php snippet that copies the images in the top folder if you want.

[Ashish Kumar (Ashfame)]

bbPress is the fastest option available. A point worth mentioning is that 0.9v is much faster than 1.0.2v

[Ashish Kumar (Ashfame)]

bbPress is the fastest option available. A point worth mentioning is that 0.9v is much faster than 1.0.2v

[Jaja..]

I have made a front-page where i show off all latest topics matching the forum ID’s..

It looks like this.

Forum id = General questions -> latest topics of the general questions

Forum id = Support questions -> latest topics of the support questions

I did this by hiding or deleting the forum id’s from all others and repeat the latest topics section.

Like this.

‘

<table id=”latest” role=”main”>

<tr>

<th><?php _e(‘Topic’); ?> — <?php bb_new_topic_link(); ?></th>

<th><?php _e(‘Posts’); ?></th>

<!– <th><?php _e(‘Voices’); ?></th> –>

<th><?php _e(‘Last Poster’); ?></th>

</tr>

<?php if ( $stickies ) : foreach ( $stickies as $topic ) : ?>

<tr<?php topic_class(); ?>>

<td><?php bb_topic_labels(); ?> <big>“><?php topic_title(); ?></big><?php topic_page_links(); ?></td>

<td class=”num”><?php topic_posts(); ?></td>

<!– <td class=”num”><?php bb_topic_voices(); ?></td> –>

<td class=”num”><?php topic_last_poster(); ?></td>

</tr>

<?php endforeach; endif; ?>

<?php if ( $topics ) : foreach ( $topics as $topic ) : ?>

<?php if( $topic->forum_id != 4 ) { ?>

<?php if( $topic->forum_id != 5 ) { ?>

<?php if( $topic->forum_id != 6 ) { ?>

<tr<?php topic_class(); ?>>

<td><?php bb_topic_labels(); ?> “><?php topic_title(); ?><?php topic_page_links(); ?></td>

<td class=”counter”><?php topic_posts(); ?></td>

<!– <td class=”num”><?php bb_topic_voices(); ?></td> –>

<td class=”last-post-avatar”><?php echo bb_get_avatar( $topic->topic_last_poster , ’36’); ?></td>

</tr>

<?php } ?>

<?php } ?>

<?php } ?>

<?php endforeach; endif; ?>

</table>

<table id=”latest” role=”main”>

<tr>

<th><?php _e(‘Topic’); ?> — <?php bb_new_topic_link(); ?></th>

<th><?php _e(‘Posts’); ?></th>

<!– <th><?php _e(‘Voices’); ?></th> –>

<th><?php _e(‘Last Poster’); ?></th>

</tr>

<?php if ( $stickies ) : foreach ( $stickies as $topic ) : ?>

<tr<?php topic_class(); ?>>

<td><?php bb_topic_labels(); ?> <big>“><?php topic_title(); ?></big><?php topic_page_links(); ?></td>

<td class=”num”><?php topic_posts(); ?></td>

<!– <td class=”num”><?php bb_topic_voices(); ?></td> –>

<td class=”num”><?php topic_last_poster(); ?></td>

</tr>

<?php endforeach; endif; ?>

<?php if ( $topics ) : foreach ( $topics as $topic ) : ?>

<?php if( $topic->forum_id != 3 ) { ?>

<?php if( $topic->forum_id != 4 ) { ?>

<?php if( $topic->forum_id != 6 ) { ?>

<tr<?php topic_class(); ?>>

<td><?php bb_topic_labels(); ?> “><?php topic_title(); ?><?php topic_page_links(); ?></td>

<td class=”counter”><?php topic_posts(); ?></td>

<!– <td class=”num”><?php bb_topic_voices(); ?></td> –>

<td class=”last-post-avatar”><?php echo bb_get_avatar( $topic->topic_last_poster , ’36’); ?></td>

</tr>

<?php } ?>

<?php } ?>

<?php } ?>

<?php endforeach; endif; ?>

</table>’

But know i have a problem with using this plugin.

http://bbpress.org/plugins/topic/front-page-topics/

I only want to show the latest 5 topics of each forum ID (excluding the once i’m hiding)

Know with this plugin it also counts the topics i’m hiding..

Isn’t there some code that says: show only the latest 5 topics from forum ID 3

Thanks,

[citizenkeith]

Still alien to me, you see all the replies, but you don’t see the original post!

Well, yes… that is annoying. A link to an individual post is great and useful. The weird behavior that’s in your test install isn’t quite right.

[Snat]

I plan to do so after I have cleaned up the code and then test it on a few different IP.Board sites. My current code is not the most “prettiest” at the mo.

I am currently working on all this so you should likely see something in the coming weeks or so

[Snat]

I plan to do so after I have cleaned up the code and then test it on a few different IP.Board sites. My current code is not the most “prettiest” at the mo.

I am currently working on all this so you should likely see something in the coming weeks or so

[Ashish Kumar (Ashfame)]

And if you want to display more stuff then you can do so by directly querying the bbPress database.

[Ashish Kumar (Ashfame)]

And if you want to display more stuff then you can do so by directly querying the bbPress database.

[Ashish Kumar (Ashfame)]

Yes it is!

In front-page.php, instead of just echoing the loop in the foreach loop, return it into a variable, compare it and then decide you want to show it up or skip it.

If you are not into code, then it will be hard for you.

[Ashish Kumar (Ashfame)]

Yes it is!

In front-page.php, instead of just echoing the loop in the foreach loop, return it into a variable, compare it and then decide you want to show it up or skip it.

If you are not into code, then it will be hard for you.

[Jaja..]

I was just wondering if this is possible.

on the front-page.php

<latest topics>

<topic 1>

<topic 2>

<topic 3>

<topic 4>

<Forum category>

<forum cat 1>

<forum cat 2>

<forum cat 3>

<forum cat 4>

<forum cat 5>

So forum category 5 will be a off topic forum (like small talk) and i would like that the new topics inside this category will NOT be visible inside the latest topics at the top because they are never really important.