Provided force_redirect is set to 0, the file location is not revealed.

I'll give this some attention. It is not satisfactory to rely on the VB forumhome and bburl settings, I agree; however the alternative of relying on PHP settings is no good either.

I know what you mean. This can be a bit tricky. Not even a simple:
..can be fully trusted in all situations. ;)

I'll have a look myself if i can spot the problem. Although fairly inefficient since it is not my code, and thus not too familiar with it.
Is it somewhat like the forests in Denmark? :squareeyed: :ogre: :P

Regards, Johan

PS: Ill stick to "force_redirect = 0" for safety.

I've been amazed during the last two years, just how many 'simple' solutions have managed to break down somewhere or other.....

1)

Looking at some HTML generated in a photo category view i found this:

There is two interesting things in this line of HTML:

1. The quotes are singlequotes, not doublequotes
2. Ampersand is coded as "&" instead of "&"

I believe it ought to be something like this:

The code highlighting here kind of proves it too.

2)

I had a look in local_links.php and found this line:

I would rewrite it as:

Substituting as follows

1. doublequotes ==> singlequotes
2. & ==> &

3)

Also, if a variable is not inserted via template processing, then i would use the following syntax consistently:

Rather than the following syntax:

4)

Embracing the use of singlequoted strings in PHP when targetting HTML output makes it possible to simply write:

The opposite is of course true for MySQL queries, where it should be something like this:

I guess it is quite some work to rewrite the code for the LDM. Lots of code there.
But it is very well worth it, since it is such a good product.

Thanks for the remarks. Perhaps you can send these to me by email - keeps the thread from blocking.

I run pages through validator.w3.org from time to time to pick up on inconsistencies. Keeping the php and sql clean and consistent is a major task, as from time to time I decide I like a new coding style better than another. A rod to beat one's back, really.

Wilco! :cool:

I agree with you about keeping code clean. It's a moving target.

Andrew, in the past few days I've been experiencing one of these 'bots' coming to my site and generating a whole bunch of 'report bad link' emails. Yesterday I went into LDM permissions and unchecked Unregistered Users abilities to report bad links, but today it happened again. Here's a snapshot of what was sent to me:

And on and on. Obviously junk. Do you have any thoughts on how they did it again? Or could it just be a remnant of an earlier session they had access to? If they did do it again, what have I missed to prevent this from happening?

S

Are you sure the message comes from the forum?
Check the email header carefully to see where it really comes from.

The main reason for theese pesky bots to be able to send the emails is that they search the web for email addresses visible on webpages.
And they use Google, Yahoo and other searchers to find the addresses.
Then the bots send these lame, wanky messages about free software, and why you need to buy pills from the blackmarket.

It is becomming more and more impossible to have email addresses openly visible on the web. Some of these bots can also send their messages in unprotected webforms.

There is only one method to handle this problem: Arrest them who spam the internet, and implement enforced sender authentication on SMTP.

So this problem has probably nothing to do with the LDM at all.

No, I'm sure it came from my vBulletin/LDM. The headers my headers, and it's coming from my vBulletin's php mail forms.

I do understand how this originally started, as my LDM 'report bad link' setting was unprotected. But then I changed it yesterday, so I don't understand how it happened again today.

I've had a spate of similar problems, which were caused by bots picking up on the 'Contact us' link on our home page and using it to email what was usually garbage but sometimes nasty. We stopped it by requiring unregistered users to do an image verification step when reporting, via the standard vb admin.

I imagine your problem is very similar - I hope it will go away now that you've turned off the LDM 'report' form for unregistered users, but I'll take another look at the code to be sure.