Quick PM Sending (pop-up) v2

[AnhTuanCool]

Quick PM Sending
---------------------------------------

Description:
This hack normally adds an option in the menu when you click on an Username. When you click on it, vb will give you a pop-up with the content just like the page that you use to send a new PM with full functions as the original one, which is design for users with have to mass PM others in thread with different PM's content and that persons don't have to reload that thread again again each time, lessen time is lessen costed ;) You might find out its handy in someway.

Updated:
New newpm.php has cleared unwanted script and reduced extra queries when executing
Security Fixed
v2 includes pm sent with template and fixed security in newpm.php
v2.01 includes new bug XSS found in vb 3.0.* refer to this announcement here https://vborg.vbsupport.ru/showthread.php?t=74035 *Thank Erwin for heads-up :)

Note: If you want a better look for the page indicated your message has been sent then just see the pm_sent_with_template.txt file. ;)

Installating Instruction & Screenshot are in attachments. Enjoy :) And don't forget to click install if you use this hack ;)

[Johnny]

this is pretty cool and useful.
*clicks install* :)

[AnhTuanCool]

It IS. Thanks ;)

[Azhrialilu]

excellent....installed perfectly :D thank you!!

[dndog]

Niceness.

/me clicks install

[Red Blaze]

Works well, thanks. *clicks install*

[Surtain23]

Great idea! Good work!

[AnhTuanCool]

Works great. Just a couple of suggestions:

In the postbit, cursor='hand' needs to be cursor='pointer' otherwise you don't get the mouseover efefct in non-IE browsers.

A close window button would be handy under the 'sent succesfully' message, also would it be possible for that window to match the style of the site rather than being plain white?

If you want to have the window match the style so that would need one more template and few changes. You can do so just see the new udpate txt file. Enjoy ;)

[dndog]

Works great. Just a couple of suggestions:

In the postbit, cursor='hand' needs to be cursor='pointer' otherwise you don't get the mouseover efefct in non-IE browsers.

A close window button would be handy under the 'sent succesfully' message, also would it be possible for that window to match the style of the site rather than being plain white?

Thanks so much. I was running firefox and trying to figure out what the problem is.

[M1th]

Hmm, so basically you've copied/pasted chunks of code from the private.php file? I'm not even sure that is allowed, but you might want to ask around just to make sure. :)

[Floris]

Hmm, so basically you've copied/pasted chunks of code from the private.php file? I'm not even sure that is allowed, but you might want to ask around just to make sure. :)
Nope, you can addon or modify, but you can't duplicate and share.

[Logikos]

Nope, you can addon or modify, but you can't duplicate and share.
So basicly you cannot take code from the vb files and add them else where?

For instant, if i wanted to make the attachments in the new thread page instead of a popup and i just copyed /pasted chucks of the attachments.php file to the newthread.php file.

That is not allowed?

[AnhTuanCool]

I did the modify to the code and left the copyright notice as you can see :)

[Polo]

This looks nice ;) I will go ahead and install this mod ;)

[FleaBag]

Sweet.

[enginethatcan't]

is it me or what? For some reason I don't have a newpm.php file anywhere, are you sure that's what the file is called?

[AnhTuanCool]

It's(newpm.php) in my attachment at the first post, check it out ;)

[Erwin]

2 issues:

1. You have not cached a LOT of templates causing 20 extra queries for no reason.

You need to add these templates to be cached (including newpm - make that a global template to be cached, not an actiontemplate).

Replace globaltemplates with these ones:


// pre-cache templates used by all actions
$globaltemplates = array(
'PM',
'newpm',
'newwpm',
'pmsent',
'editor_clientscript',
'editor_jsoptions_font',
'editor_jsoptions_size',
'editor_smilie_wysiwyg',
'editor_smilie_standard',
'editor_smiliebox',
'editor_smiliebox_category',
'editor_smiliebox_row',
'editor_smiliebox_straggler',
'editor_smiliemenu_category',
'editor_smiliemenu_smilie',
'editor_toolbar_wysiwyg',
'editor_toolbar_standard',
'newpost_disablesmiliesoption',
'newpost_quote',
'posticonbit',
'posticons',
'forumrules',
'usercp_nav_folderbit'
);


And remove the actiontemplates bit - no need.

2. Get rid of the smilie panel by doing this:

Find:


require_once('./includes/functions_editor.php');


ABOVE this, ADD:


$vboptions['wysiwyg_show_smiliebox'] = '0';


Enjoy. :)

[AnhTuanCool]

Oh thank you Erwin, that would help :)

New newpm.php file updated ;)

[theArchitect]

*theArchitect clicks install*.

A great hack. Very useful. And thankyou Erwin for your corrections.

[Lionel]

why would I get a javascript error in there? That happened why after I did a copy n paste

[Lionel]

My problem is at line 116 character 2 object expected. Problem is that line is just plain html. But I could say that it pops up everytime I start typing in the editor's body textarea. Which function or which editor brings that up? And at what point? I am using the WYSIWYG

[Lionel]

I found the reason... I installed the excellent character counter hack, so I needed to adjust your templates accordingly.

[Erwin]

This hack has a potential huge security hole - there is no internal usergroup permission check, so unregistered members can use newpm.php to send PMs. :) I would add some sort of check in the newpm.php file itself, plus use templates to prevent unregistered users from accessing the link.

[Lionel]

@erwin

if I put the below in newpm.php, will that be sufficient?

if (!$vboptions['enablepms'])
{
eval(print_standard_error('pm_adminoff'));
}

// check permission to use private messaging
if ($permissions['pmquota'] < 1 OR !$bbuserinfo['userid'])
{
print_no_permission();
}

//check if the user will receive PMs
if (!$bbuserinfo['receivepm'])
{
eval(print_standard_error('pm_turnedoff'));
}

[AnhTuanCool]

This hack has a potential huge security hole - there is no internal usergroup permission check, so unregistered members can use newpm.php to send PMs. :) I would add some sort of check in the newpm.php file itself, plus use templates to prevent unregistered users from accessing the link.

Did you even test it? :)

I've just logged out of my board and try to access /newpm.php?do=newwpm&userid=... and I get the page said needed to login, although I haven't changed anything from the one I posted here. :)

[Lionel]

that would not hurt to incorporate the above. It checks for quotas, pm enabled etc...

[Erwin]

Did you even test it? :)

I've just logged out of my board and try to access /newpm.php?do=newwpm&userid=... and I get the page said needed to login, although I haven't changed anything from the one I posted here. :)
Obviously.

Unregistered visitors on my site were sending PMs and it took us a day to figure out it was this hack. Serves me right for not checking the code properly.

[integra99]

I changed the pmsent template a bit...


<script language="Javascript">
<!--
alert("$vbphrase[pm_sent]");
self.close();
//-->
</script>

[integra99]

Erwin, I had the same problem. I had to add in..

if (!($permissions['forumpermissions'] & CANVIEW) OR ($bbuserinfo['userid'] == '0')) {
print_no_permission();
}

[AnhTuanCool]

You're right Erwin, I found it now, and newpm.php had been updated too, you can look through and check it yourself, thanks everyone for reporting. :)

[RsX]

IT works well for me, only 1 prob..

After i sent a pm, i get no "message succesfull", nothing.. after i send the pm, i get a blank page :S

[AnhTuanCool]

Do this update, hope it helps ;)

https://vborg.vbsupport.ru/attachment.php?attachmentid=21736

[Sweet Evil]

Nice, Installed

[bendigo-tech]

Installed and working sweet. Thanks :)

[Erwin]

As per the private.php XSS loophole, you need to patch newpm.php as well or else you can be hacked.

Manual Patch Instructions

In newpm.php, find the following:

$pm['message'] = htmlspecialchars_uni($pm['message']);


BELOW it, add the following:

$pm['recipients'] = htmlspecialchars_uni($pm['recipients']);

Refer to announcement here:

https://vborg.vbsupport.ru/showthread.php?t=74035

[JKeats]

i noticed that when i select the quick pm link my curser is in the message box. i don't suppose there's a way to get the cursor in the title box first? seems it'd be a more appropriate place to start.

otherwise... great hack. thanks!

[Snitz]

/me loved it

[bryan09]

Good job! :)