Rocksolid Light

Welcome to Rocksolid Light

register   nodelist   faq  


rocksolid / rocksolid.nodes.help / Re: fudforum quick hacks thread

SubjectAuthor
* fudforum quick hacks threadtrw
+* Re: fudforum quick hacks threadRetro Guy
|`- Re: fudforum quick hacks threadtrw
`* Re: fudforum quick hacks threadtrw
 `* Re: fudforum quick hacks threadtrw
  `* Re: fudforum quick hacks threadRetro Guy
   `* Re: fudforum quick hacks threadtrw
    `* Re: fudforum quick hacks threadRetro Guy
     `- Re: fudforum quick hacks threadtrw

Subject: fudforum quick hacks thread
From: trw@i2pmail.org (trw)
Newsgroups: rocksolid.nodes.help
Organization: Dancing elephants
Date: Sun, 22 Sep 2019 20:58 UTC
here i will collect all the info about fudforum i have/will find out, mostly how to adapt the software to the specific requirements of hosting in the darknets, or about my installation.

starting with the first little hack, which prevents users of posting their own session token when they post links from this forum. given the fact that we only work with url sessions now, this could attackers enable to take over the account (if the session should still be open at the point in time). a little regex prevents this, to be inserted in post.php, line 826 at the start of the function apply_custom_replace:

return preg_replace("/&S=(\w{32})/", "&S=replaced.session.token.for.opsec", $text);

this will shortcircuit the function to do only one replacement, which replaces the session token with a string.

cheers

trw
Posted on def3


Subject: Re: fudforum quick hacks thread
From: retro.guy@retrobbs.rocksolidbbs.com.remove-8ar-this (Retro Guy)
Newsgroups: rocksolid.nodes.help
Organization: RetroBBS
Date: Mon, 23 Sep 2019 09:23 UTC
  To: trw
trw wrote:

here i will collect all the info about fudforum i have/will find out, mostly
how to adapt the software to the specific requirements of hosting in the darknets, or about my installation.

Good idea. At some point we should collect the previous changes we made (nntp.inc, etc) and put it all in one place.

We have made a few small changes to several files at this point (also, I've written two plugins). I'll collect my stuff next week and we can place this all somewhere.

BTW, nice work on your progress with the sessions!

Retro Guy



--
Posted on RetroBBS



Subject: Re: fudforum quick hacks thread
From: trw@i2pmail.org (trw)
Newsgroups: rocksolid.nodes.help
Organization: Dancing elephants
Date: Mon, 23 Sep 2019 11:23 UTC
BTW, nice work on your progress with the sessions!

yeah, thanks. it's a load of my mind. and it makes ff much more usable and secure (for the server admin, anyway).

what plugins have you written for ff ? do you the auth and the spam killer ?
Posted on def3


Subject: Re: fudforum quick hacks thread
From: trw@i2pmail.org (trw)
Newsgroups: rocksolid.nodes.help
Organization: Dancing elephants
Date: Sun, 6 Oct 2019 16:42 UTC
and another quick'n'dirty one: the script below (hacked from pieces of admforum.php and admnntp.php) reads from a file called groups_to_create.txt in webroot/adm/, and creates all the forums listed in that file, plus the update rule to sync over nntp. it's very raw yet, and throws an exception for the display of the results, but the creation as such works.

<?php
/**
* copyright            : (C) 2001-2013 Advanced Internet Designs Inc.
* email                : mailto:forum@prohost.org
* $Id: admforum.php 5707 2013-10-12 11:05:47Z naudefj $
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; version 2 of the License.
**/

/** Return PHP's maximum upload size in bytes. */
function get_max_upload_size()
{
$us = strtolower(ini_get('upload_max_filesize'));
$size = (int) $us;
if (strpos($us, 'm') !== false) {
$size *= 1024 * 1024;
} else if (strpos($us, 'k') !== false) {
$size *= 1024;
}
return $size;
}

/* main */
require('./GLOBALS.php');
fud_use('adm.inc', true);
fud_use('forum_adm.inc', true);
fud_use('cat.inc', true);
fud_use('widgets.inc', true);
fud_use('logaction.inc');

$tbl = $GLOBALS['DBHOST_TBL_PREFIX'];

// AJAX call to reorder forums.
if (!empty($_POST['ajax']) && $_POST['ajax'] == 'reorder') {
$new_order = 1;
foreach ($_POST['order'] as $id) {
q('UPDATE '. $tbl .'forum SET view_order = '. $new_order++ .' WHERE id = '. $id);
}
rebuild_forum_cat_order();
exit('Forums successfully reordered.'); // End AJAX call.
}

require($WWW_ROOT_DISK .'adm/header.php');
$max_upload_size = get_max_upload_size();

/* This is here so we get the cat_id parameter when cancel button is clicked. */
$cat_id = isset($_GET['cat_id']) ? (int)$_GET['cat_id'] : (isset($_POST['cat_id']) ? (int)$_POST['cat_id'] : '');
if (empty($cat_id)) { // Or get it from DB.
$cat_id = q_singleval('SELECT MIN(id) FROM '. $tbl .'cat');
}
$cat_name = q_singleval('SELECT name FROM '. $tbl .'cat WHERE id='. (int)$cat_id);

$edit = isset($_GET['edit']) ? (int)$_GET['edit'] : (isset($_POST['edit']) ? (int)$_POST['edit'] : '');
if (file_exists('groups_to_create.txt'))
{
echo 'opened file';
$file_handle = fopen("groups_to_create.txt", 'r') or die("File does not exist or you lack permission to open it");
$_POST['frm_parent']= '0';
$_POST['frm_url_redirect']= '';
$_POST['frm_tag_style']= '16';
$_POST['frm_passwd_posting']= '0';
$_POST['frm_post_passwd']= '';
$_POST['frm_moderated']= '0';
$_POST['frm_max_attach_size']= '2048';
$_POST['frm_max_file_attachments']= '2';
$_POST['frm_mod_attach']= '0';
$_POST['frm_mod_notify']= '0';
$_POST['frm_message_threshold']= '0';
$_POST['frm_forum_icon']= '';
$_POST['frm_pos']= 'LAST';
$_POST['frm_forum_opt'] = (int) $_POST['frm_mod_notify'] | (int) $_POST['frm_mod_attach'] | (int) $_POST['frm_moderated'] | (int) $_POST['frm_passwd_posting'] | (int) $_POST['frm_tag_style'];
$_POST['nntp_server']= 'my.server.ip';
$_POST['nntp_port']= 'my.server.port';
$_POST['nntp_login']= 'my.login';
$_POST['nntp_pass']= 'my.password';
$_POST['nntp_timeout']= '25';
$_POST['nntp_auth']= '128';
$_POST['nntp_imp_limit']= '5000';
$_POST['nntp_custom_sig']= '';
$_POST['nntp_nntp_post_apr']= '0';
$_POST['nntp_allow_frm_post']= '2';
$_POST['nntp_skip_non_forum_users']= '0';
$_POST['nntp_create_users']= '32';
$_POST['nntp_complex_reply_match']= '16';
$_POST['nntp_allow_nntp_attch']= '8';
$_POST['nntp_frm_post_apr']= '0';
fud_use('nntp_adm.inc', true);
while(! feof($file_handle))
  {
  $line = fgets($file_handle);
list($category, $forum, $description, $newsgroup) = explode(":", $line);
$cat_id = $category;
$_POST['frm_name']= $forum;
$_POST['frm_descr']= $description;
$frm = new fud_forum;
fud_use('groups_adm.inc', true);
fud_use('groups.inc');
$frm->cat_id = $cat_id;
$frm->add('LAST');
rebuild_forum_cat_order();
logaction(_uid, 'ADDFORUM', $frm->id);
echo successify('Forum was successfully created.');
$_POST['nntp_forum_id']= $frm->id;
$_POST['nntp_newsgroup']= $newsgroup;
$nntp_adm = new fud_nntp_adm;
$nntp_adm->add();
echo successify('Newsgroup rule successfully added (see <a href="#list">list</a> at bottom of page).');
}
}
else
  {
        echo 'groups_to_create.txt does not exist';
  }
fclose($file_handle);
if ($edit && ($c = db_arr_assoc('SELECT * FROM '. $tbl .'forum WHERE id='. $edit))) {
foreach ($c as $k => $v) {
${'frm_'.$k} = $v;
}
} else {
$c = get_class_vars('fud_forum');
foreach ($c as $k => $v) {
${'frm_'.$k} = '';
}

/* Some default values for new forums. */
$frm_pos = 'LAST';
$frm_max_attach_size = floor($max_upload_size / 1024);
$frm_message_threshold = '0';
$frm_max_file_attachments = '5';
$frm_forum_opt = 16;
}

if (isset($_GET['chpos'], $_GET['newpos'])) {
frm_change_pos((int)$_GET['chpos'], (int)$_GET['newpos'], $cat_id);
rebuild_forum_cat_order();
unset($_GET['chpos'], $_GET['newpos']);
echo successify('Forum position was successfully set.');
} else if (isset($_GET['del'])) {
if (frm_move_forum((int)$_GET['del'], 0, $cat_id)) {
rebuild_forum_cat_order();
$frm_name = q_singleval('SELECT name FROM '. $tbl .'forum WHERE id='. (int)$_GET['del']);
logaction(_uid, 'FRMMARKDEL', (int)$_GET['del']);
echo successify('The <b>'. $frm_name .'</b> forum was moved to the <b><a href="admforumdel.php?'. __adm_rsid .'">trash bin</a></b>.');
}
} else if (isset($_POST['btn_chcat'], $_POST['frm_id'], $_POST['cat_id'], $_POST['dest_cat'])) {
if (frm_move_forum((int)$_POST['frm_id'], (int)$_POST['dest_cat'], $cat_id)) {
rebuild_forum_cat_order();
$r = db_saq('SELECT f.name, c1.name, c2.name FROM '. $tbl .'forum f INNER JOIN '. $tbl .'cat c1 ON c1.id='. $cat_id .' INNER JOIN '. $tbl .'cat c2 ON c2.id='. (int)$_POST['dest_cat'] .' WHERE f.id='. (int)$_POST['frm_id']);
logaction(_uid, 'CHCATFORUM', (int)$_POST['frm_id']);
echo successify('Forum was successfully moved.');
}
}

// Reorder forum display order.
if (isset($_GET['o'], $_GET['ot'])) {
if (in_array($_GET['ot'], array('name', 'descr', 'date_created'))) {
$i = 0;
$r = q('SELECT id FROM '. $tbl .'forum WHERE cat_id='. $cat_id .' ORDER BY '. $_GET['ot'] . ((int)$_GET['o'] ? ' ASC' : ' DESC'));
while ($o = db_rowarr($r)) {
q('UPDATE '. $tbl .'forum SET view_order='. ++$i .' WHERE id='. $o[0]);
}
rebuild_forum_cat_order();
}
}

// Get list of categories.
$cat_sel = create_cat_select('cat_id', $cat_id, 0);
?>
<h2>Forum Management System</h2>

<fieldset class="fieldtopic">
<legend><b>Change category:</b></legend>
<table width="100%">
<tr><td>
<?php
if (empty($cat_sel)) {
pf(errorify('Your forum doesn\'t have any categories.<br />Please use the Category Manager to create some before returning to this screen.'));
} else {
?>
<form method="post" action="admforum.php">
Manage forums in catagory:
<?php echo _hs; echo $cat_sel; ?> 
<input type="submit" name="frm_submit" value="Change" />
</form>
<?php } ?>
</td><td>
<nobr>[ <a title="List forums in the recycle bin" href="admforumdel.php?<?php echo __adm_rsid; ?>">Deleted Forums</a> ]</nobr>
</td></tr>
</table>
</fieldset>

<?php
if (empty($cat_sel)) {
require($WWW_ROOT_DISK .'adm/footer.php');
exit;
}
if (!isset($_GET['chpos'])) { // Hide this if we are changing forum order.
echo '<h3>'. ($edit ? '<a name="edit">Edit forum:</a>' : 'Add forum to <i>'. $cat_name .'</i>:') .'</h3>';
?>

<form method="post" id="frm_forum" action="admforum.php">
<?php echo _hs; ?>
<table class="datatable">
<tr class="field">
<td>Forum Name:<br /><font size="-2">The forum's name.</font></td>
<td><input type="text" name="frm_name" value="<?php echo $frm_name; ?>" maxlength="100" /></td>
</tr>

<tr class="field">
<td valign="top">Description:<br /><font size="-2">Description that will be shown on the forums main index page. Can contain HTML.</font></td>
<td><textarea nowrap="nowrap" name="frm_descr" cols="28" rows="5"><?php echo htmlspecialchars($frm_descr); ?></textarea></td>
</tr>

<?php
$forum_names = "forum index\ndon't display it";
$forum_ids   = "0\n-1";
$c = uq('SELECT id, name FROM '. $tbl .'forum WHERE cat_id='. $cat_id .' AND id != '. (empty($edit) ? 0 : $edit) .' ORDER BY name');
while ($r = db_rowobj($c)) {
$forum_names .= "\n". $r->name;

Click here to read the complete article
Subject: Re: fudforum quick hacks thread
From: trw@i2pmail.org (trw)
Newsgroups: rocksolid.nodes.help
Organization: Dancing elephants
Date: Sun, 6 Oct 2019 19:44 UTC
this thing works, i have just created all the feeds with it. one was missing an entry, so the code is really not finished. Posted on def3


Subject: Re: fudforum quick hacks thread
From: retro_guy@retrobbs.rocksolidbbs.com (Retro Guy)
Newsgroups: rocksolid.nodes.help
Organization: RetroBBS
Date: Mon, 7 Oct 2019 02:59 UTC
On Sun, 06 Oct 2019 15:44:10 -0400
trw <trw@i2pmail.org> wrote:

this thing works, i have just created all the feeds with it. one was
missing an entry, so the code is really not finished. Posted on def3

Looks good. This will really help in building ff site, as it takes a
long time to create and configure a lot of groups at once. (It's really
boring!)

Thanks for this!

Retro Guy



Subject: Re: fudforum quick hacks thread
From: trw@i2pmail.org (trw)
Newsgroups: rocksolid.nodes.help
Organization: Dancing elephants
Date: Sat, 12 Oct 2019 13:12 UTC
and the one that I used to jump over a certain message in comp.lang.python that had a subject with an encoding that caused the sql statement to crash:
insert in /Fudforum_data_dir/scripts/nntp.php in line 131:
$nntp->group_first = 1500; which will set the counter of the group to 1500. of course, you will have to remove this line after the run, or before you use it for other groups. the easiest is to save the file under a new name and run it only once. Posted on def3


Subject: Re: fudforum quick hacks thread
From: retro.guy@retrobbs.rocksolidbbs.com.remove-5vl-this (Retro Guy)
Newsgroups: rocksolid.nodes.help
Organization: RetroBBS
Date: Sun, 13 Oct 2019 07:23 UTC
  To: trw
trw wrote:

and the one that I used to jump over a certain message in comp.lang.python
that had a subject with an encoding that caused the sql statement to crash:
insert in /Fudforum_data_dir/scripts/nntp.php in line 131:
$nntp->group_first = 1500; which will set the counter of the group to 1500. of course, you will have to
remove this line after the run, or before you use it for other groups. the easiest is to save the file under a new name and run it only once.
Posted on def3

I can't find anywhere in that loop that it breaks out for any reason (only 'continue', which is good). My nntp.php seems a little different than yours, the line is 134 in mine.

Is it crashing execution of the file itself?

--
Posted on RetroBBS



Subject: Re: fudforum quick hacks thread
From: trw@i2pmail.org (trw)
Newsgroups: rocksolid.nodes.help
Organization: Dancing elephants
Date: Sun, 13 Oct 2019 08:25 UTC
Is it crashing execution of the file itself?

it is this topic here: http://x5qrtsbiebrxj65t.onion/index.php?t=msg&th=46384&goto=63843&S=replaced.session.token.for.opsec#msg_63843

There is a call from nntp.php to a function, trying to determine if the message is a first in the thread or not. The sql statement in that function crashes if a message has certain characters (because this changes implicitly the encoding, or so it seems). When that function crahes, nntp.php stops to import that group, and goes to the next one.
Posted on def3


1
rocksolid light 0.6.5e
clearnet i2p tor