vb.org Archive - Quick PM Sending (pop-up) v2

Page 3 of 4

Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vBulletin 3.0 Full Releases (https://vborg.vbsupport.ru/forumdisplay.php?f=33)

- - Quick PM Sending (pop-up) v2 (https://vborg.vbsupport.ru/showthread.php?t=70085)

Lionel

10-14-2004 09:18 PM

why would I get a javascript error in there? That happened why after I did a copy n paste

Lionel

10-14-2004 10:42 PM

My problem is at line 116 character 2 object expected. Problem is that line is just plain html. But I could say that it pops up everytime I start typing in the editor's body textarea. Which function or which editor brings that up? And at what point? I am using the WYSIWYG

Lionel

10-14-2004 10:54 PM

I found the reason... I installed the excellent character counter hack, so I needed to adjust your templates accordingly.

Erwin

10-14-2004 11:56 PM

This hack has a potential huge security hole - there is no internal usergroup permission check, so unregistered members can use newpm.php to send PMs. :) I would add some sort of check in the newpm.php file itself, plus use templates to prevent unregistered users from accessing the link.

Lionel

10-15-2004 12:13 AM

@erwin

if I put the below in newpm.php, will that be sufficient?

if (!$vboptions['enablepms'])
{
eval(print_standard_error('pm_adminoff'));
}

// check permission to use private messaging
if ($permissions['pmquota'] < 1 OR !$bbuserinfo['userid'])
{
print_no_permission();
}

//check if the user will receive PMs
if (!$bbuserinfo['receivepm'])
{
eval(print_standard_error('pm_turnedoff'));
}

AnhTuanCool

10-15-2004 12:22 AM

Quote:

Originally Posted by Erwin

Did you even test it? :)

I've just logged out of my board and try to access /newpm.php?do=newwpm&userid=... and I get the page said needed to login, although I haven't changed anything from the one I posted here. :)

Lionel

10-15-2004 12:26 AM

that would not hurt to incorporate the above. It checks for quotas, pm enabled etc...

Erwin

10-15-2004 01:09 AM

Quote:

Originally Posted by AnhTuanCOol

Obviously.

Unregistered visitors on my site were sending PMs and it took us a day to figure out it was this hack. Serves me right for not checking the code properly.

integra99

10-15-2004 02:26 AM

I changed the pmsent template a bit...

Code:

<script language="Javascript">

<!--

alert("$vbphrase[pm_sent]");

self.close();

//-->

</script>

integra99

10-15-2004 02:38 AM

Erwin, I had the same problem. I had to add in..

Code:

if (!($permissions['forumpermissions'] & CANVIEW) OR ($bbuserinfo['userid'] == '0')) {

        print_no_permission();

}

All times are GMT. The time now is 08:00 AM.

Page 3 of 4

Show 40 post(s) from this thread on one page

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01156 seconds Memory Usage 1,734KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (2)bbcode_code_printable (2)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (3)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: