MyBB Community Forums - MyBB 1.4.4

[F] [BROKEN] Show users who have posted with this IP

Sun, 19 Apr 2009 18:53:55 +0000

Admincp problem.

SQL Error:
1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right 
syntax to use near ')' at line 3
Query:
SELECT COUNT(u.uid) AS num_results FROM mybb_users u WHERE 1=1 AND u.uid IN()

That isn't working anymore. I tested both upgrade package and full package files just in case.

I need a fix for this asap. It's very important I can search via PMs to prevent fraud on my sites.

[F] Upgrade does not work [R]

Sun, 19 Apr 2009 14:35:36 +0000

Hello,

I tried an upgrade from 1.4.3 to 1.4.5, but the the upgrade, after chhosing the version, does only got to the following

Performing necessary upgrade queries..

I don't know, which of all the sql-statements got sent, but from there, it does nothing and seems ready with the filetransfer.

The files should all be correct, because I loaded them directly on the server.

Any Idea?

Forgot to mention: Database PostgreSQL 8.3.7, PHP 5.2.9, lighttpd 1.4.20, Firefox 3.0.8, scripts allowed

[F] Server load: nothing (MyBB 1.4.5) [R]

Sun, 19 Apr 2009 13:13:41 +0000

Hello all.
I just upgrade my forum to mybb 1.4.5

and the server load in the debug status became an empty string.

and in the ACP it's unknown

my server details are.

OS ubuntu 8.10
Php version 5.2.6
Apache 2.2.9

is there is something I missed?

[F] WOL Innacuracies [C-Imad Jomaa]

Tue, 07 Apr 2009 15:21:34 +0000

OK, first off, I don't know how to reproduce this, but I see this on a daily basis, since I first saw this in January, and have various ways of showing something is wrong.

See this screenshot:

WOLbroken.png (Size: 33.51 KB / Downloads: 763)

Now, user A was viewing the thread the WOL said they were. However, user B wasn't. I know this, because I had seen this issue for a while, so wanted to see if it was real... I asked user B if they were actually replying to that thread, and they said they weren't. Now, what I've noticed is that when user A is viewing a thread, user B is replying to it. It seems that the action for user A is accurate but the action for user B is more random. It usually seems that user B is replying to the thread user A user viewing at the same time, user B is usually directly under user A, like in the screenshot.

I've also seen how the location of a user can change, even if they have been inactive for ages. So, they are viewing/replying to thread/forum X, and after a while, it says they are viewing/replying to thread/forum Y, despite the fact their last active time hasn't changed. So say they view thread/forum X at 12:00, after, say, 10 minutes, their last active time is still 12:00 but they now seem to be viewing thread/forum Y. Thing is, thread/forum Y is also being viewed at that same time by somebody else. It's as though their location is governed by where other people are. Or, it just says 'Viewing Forum' or 'Reading Thread'. When this happens, the location in their profile is usually 'Unknown Location' instead of where the WOL says they are. Sometimes clicking this link takes you to a link that even the WOL isn't showing.

Another thing is people viewing things they shouldn't be. This isn't directly related to the issue where it should say 'Viewing No Permissions Page'. This is when someone is viewing a thread/forum they can't possibly even have a URL to, for example, a staff thread/forum. I've noticed here that when a staff member is viewing a staff forum/thread, another user also seems to view it. Then, when that staff member goes somewhere else, the regular user who seemed to be viewing it, changes to something else, something that someone else is seeing, similar to my paragraph above, but their last active time doesn't change, so they haven't clicked anything, it's like I said above, it's as though their location is governed by where other people are. This has been reported by various people, someone is viewing something they can't possibly have any sort of access to at all, short of guessing the URL.

Now, as I said above, I have no idea how to reproduce it, it just... happens. I idle on the WOL when I'm doing other things and notice this a lot. I'm hoping that by posting this, someone might be able to think what might be happening here. I also don't think that this should be marked as bogus straight away because of no reproduction steps, idle on the WOL whilst you're watching TV and you'll see what I'm saying eventually. I could easily fill this page with screenshots of each of the 3 points too.

[F] Custom Profile fields - possible XSS?

Sat, 04 Apr 2009 11:26:56 +0000

Hi,

I am using MyBB 1.4.4 and have one custom profile textfield users are required to fill in.
It seems it isn't properly escaped/checked when viewing threads.

For example when I specify something like "" it's getting executed by the javascript interpreter when viewing the post - I get an alertbox displaying "foo".
When viewing the profile itself the box isn't displayed though.

Is this a bug or do I have to validate the field myself?

[F] Warnings not deleted when member deleted [C-Michael83]

Sun, 29 Mar 2009 06:29:41 +0000

As per title..

In the user.php for admincp...

		// Delete the user
		$db->update_query("posts", array('uid' => 0), "uid='{$user['uid']}'");
		$db->delete_query("userfields", "ufid='{$user['uid']}'");
		$db->delete_query("privatemessages", "uid='{$user['uid']}'");
		$db->delete_query("events", "uid='{$user['uid']}'");
		$db->delete_query("moderators", "uid='{$user['uid']}'");
		$db->delete_query("forumsubscriptions", "uid='{$user['uid']}'");
		$db->delete_query("threadsubscriptions", "uid='{$user['uid']}'");
		$db->delete_query("sessions", "uid='{$user['uid']}'");
		$db->delete_query("banned", "uid='{$user['uid']}'");
		$db->delete_query("threadratings", "uid='{$user['uid']}'");
		$db->delete_query("users", "uid='{$user['uid']}'");

A line needs to be added for warnings. This might be why warning points are not being removed sometimes. Either way it's a bug.

[F] Orphaned attachment deletion [C-Imad Jomaa]

Fri, 27 Mar 2009 00:56:57 +0000

The orphaned attachments search finds attachments that were uploaded over 24 hours ago but not attached to a post. In this case there's a file in the uploads folder and an entry in the database. If you delete such an attachment the file remains on the server (It is found in a second search though because of the missing database entry).

The reason can be found in the file inc/functions_upload.php in the functions remove_attachment() and remove_attachments():

@unlink($mybb->settings['uploadspath']."/".$attachment['attachname']);
if($attachment['thumbnail'])
{
    @unlink($mybb->settings['uploadspath']."/".$attachment['thumbnail']);
}

$mybb->settings['uploadspath'] by default is set to ./uploads. If you call the function from the ACP it tries to delete the file in ROOT/admin/uploads/.

A solution would be to use MYBB_ROOT or to differ like it is done in the function remove_avatars():

if(defined('IN_ADMINCP'))
{
    $avatarpath = '../'.$mybb->settings['avataruploadpath'];
}
else
{
    $avatarpath = $mybb->settings['avataruploadpath'];
}

[F] Server load reported as Unknown when 0.00 [C-Imad Jomaa]

Fri, 20 Mar 2009 21:31:11 +0000

Server load in admin returns as 'Unknown' if the load is 0.00. This is due to code @ line 1619 in functions.php simply checking for !$serverload, which naturally returns false for zero. Changing it to " if(!is_numeric($serverload))" fixes it quite easily.

[F] portal.php links to guest user profiles [C-Michael83]

Wed, 11 Mar 2009 23:07:12 +0000

If a posting / thread listed on portal.php was written by a guest, the guest name is still a link to the profile page member.php?action=profile&uid=0

Steps to reproduce:
Configure MyBB to allow posting for guests, write a thread as a guest, make that thread show up on the portal page (in the main column).

[F] /me bug in PM [R] [C-Chris]

Wed, 11 Mar 2009 02:24:47 +0000

When you send a PM and include the /me, it works fine. However, when someone replies to you, which quotes your text, the /me username becomes the username of who replied. Shouldn't it just quote it and put it in plain text?

Reproduce:

1) Login to one account, send a PM containing a '/me' (without the quotes and some text).

2) Now login to the account that you sent the PM to, click on "reply" and send it.

3) Now login back to the first account and view the PM, you'll notice the '/me' username becomes the one who replied to your PM.

Can anyone reproduce?

[F] [WOL] Unknown location [C-Chris]

Mon, 09 Mar 2009 01:43:31 +0000

If someone is editing his buddy/ignore list he's shown at an unknown location in the who's online list.

Fix: Open the file inc/functions_online.php and search for:

// usercp.php functions

Below add:

case "usercp_editlists":
    $location_name = $lang->managing_buddyignorelist;
    break;

In the language file online.lang.php add:

$l['managing_buddyignorelist'] = "Managing Buddy/Ignore List";

[F] Logged In ACP Users [R] [C-Michael83]

Sat, 07 Mar 2009 23:16:21 +0000

I'm not 100% sure if this is a bug, but it can be confusing at times. Say for example, a regular user tries to log into the AdminCP without the admin permissions. The user will not be logged in, however they will show as an 'Online Admin' on the dashboard.

Steps to reproduce:

1) Create user account without admin CP access.
2) Navigate to AdminCP directory and attempt to log in.
3) Log into ACP as administrator with Admin CP access.
4) Look at the 'Online Admins' area.

[F] Template search issue [C-Michael83]

Sat, 07 Mar 2009 17:00:56 +0000

When searching for templates, if you search for this:



you see the following:


  templatesearchbug.png (Size: 22.59 KB / Downloads: 525)

[F] Missing images after merging posts [R] [C-Michael83]
Thu, 05 Mar 2009 22:34:59 +0000
One of my mods merged some posts into one, the merged post lost it's images. The attachements were showing as added into the page and all I see is text. So I deleted the attachments in the post and the images still wont show in the post in the attachments box. The images still show as attachments are their when in full edit, they just aren't showing. Couldnlt find anything in the bugs section that matched this. I could be wrong however because all I looked at are the titles since there are 99 bugs.



Using the lastest version 1.4.4




  bg1.png (Size: 29.1 KB / Downloads: 494)





  bg2.png (Size: 38.15 KB / Downloads: 525)


[F] Archive - bug with non-numeric $page [C-Chris]
Mon, 02 Mar 2009 12:27:51 +0000
MyBB 1.4.4, confirmed here too:

http://community.mybboard.net/archive/in...tpost.html



In archive mode links to threads with 0 replies and a string as param (e.g. "lastpost") produce error:

1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-10, 10' at line 1
Query:
SELECT pid FROM posts WHERE tid='34200' AND visible='1' ORDER BY dateline LIMIT -10, 10
because of variable $page with value "lastpost".

		if($page)
		{
			$start = ($page-1) * $perpage;
		}
		else
		{
			$start = 0;
			$page = 1;
		}
A possible solution is to replace first line with:

if(is_int($page))
or maybe add $page = intval($page) ; just before using $page?