vb.org Archive
Page 38 of 107 « First 283637 38 39404888 Last »
Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   vBulletin 3.6 Add-ons (https://vborg.vbsupport.ru/forumdisplay.php?f=194)
-   -   Major Additions - Email Integration (New threads/replies by email) (https://vborg.vbsupport.ru/showthread.php?t=151222)

Cyricx 08-28-2007 08:10 PM
I'll have to check into the code. I'll check it out when I start on the vbmail handling for the cron job.

cgmckeever 08-28-2007 08:18 PM
Thanks -- side note.....

in the cron script, you may want to change:
$fromaddress = $letter->sender[0]->mailbox ."@".$letter->sender[0]->host;
to:
$fromaddress = $letter->reply_to[0]->mailbox ."@".$letter->reply_to[0]->host;
if(strlen($fromaddress) == 0) $letter->sender[0]->mailbox ."@".$letter->sender[0]->host;

the script fails for gmail sent as another user ... such as when I send from my company profile in gmail, the script still sees me as host=gmail.com

Cyricx 08-28-2007 08:20 PM
Quote:
Originally Posted by cgmckeever (Post 1327626)
Thanks -- side note.....

in the cron script, you may want to change:
$fromaddress = $letter->sender[0]->mailbox ."@".$letter->sender[0]->host;
to:
$fromaddress = $letter->reply_to[0]->mailbox ."@".$letter->sender[0]->host;

the script fails for gmail sent as another user ... such as when I send from my company profile in gmail, the script still sees me as host=gmail.com
It's supposed to fail :)

That's what keeps people from pretending they are someone else :)

If I didn't have that check in there, you could set your reply to address in gmail or yahoo as the admins email address and you would show to the forums as posting as the admin :)

To avoid that security loop hole, it checks who the actual domain is that is sending the email :)

Just use your true gmail address for your account and you will be fine.

cgmckeever 08-28-2007 08:30 PM
Quote:
Originally Posted by Cyricx (Post 1327627)
It's supposed to fail :)

That's what keeps people from pretending they are someone else :)

If I didn't have that check in there, you could set your reply to address in gmail or yahoo as the admins email address and you would show to the forums as posting as the admin :)

To avoid that security loop hole, it checks who the actual domain is that is sending the email :)

Just use your true gmail address for your account and you will be fine.

The only issue is, that if I really want to post as the ADMIN, I could just set up a whole profile in thunderbird or outlook and truly send as that person. Then the script will still pass the tests and post as a fake author.

So, putting that test in limits people who use services like gmail but have multiple profiles.

Cyricx 08-28-2007 08:49 PM
Quote:
Originally Posted by cgmckeever (Post 1327636)
The only issue is, that if I really want to post as the ADMIN, I could just set up a whole profile in thunderbird or outlook and truly send as that person. Then the script will still pass the tests and post as a fake author.

So, putting that test in limits people who use services like gmail but have multiple profiles.
You would have to have the password to login to the domain.

With yahoo I can go to the options, type whatever email name I want, and that would show up as me. I wouldn't need any passwords.

With outlook and thunderbird you have to have the password.

This is also why the error email that gets sent to you for the incorrect email address shows you the address that the modification sees you as having and has a link to update your email address :)

Your solution, doesn't require that people have a password or any access to the mailbox.

I'm not saying the method I'm using is perfect security... but it at least requires that you are on sending from the same domain as the email your trying to fabricate.

I'm sorry but I will not remove this feature for anything less then a more secure method.

Removing the prime security feature to me, is just not wise even if it's not the perfect method.

cgmckeever 08-28-2007 09:11 PM
Quote:
Originally Posted by Cyricx (Post 1327646)
You would have to have the password to login to the domain.

With yahoo I can go to the options, type whatever email name I want, and that would show up as me. I wouldn't need any passwords.

With outlook and thunderbird you have to have the password.
.
I dont need a password to send an email from a yahoo (or other webmail account) that is not mine -- PM me your email address and I will demonstrate this. Thus, anyone can get around the simple 'from' check ..

That is why I am saying it is not a security feature, it is reducing the usability actually more so than any security feature.

cgmckeever 08-28-2007 10:40 PM
If you add this code (in all spots cron and product xml) right after text_subject is defined, the EmailIntegration script will handle the custom prefixes _and_ use a default one if none is found - it seemed to already take into account the original prefixing anyhow [\$foruminfo[title_clean]-t-\$threadinfo[threadid]]:

Code:
// prefix code - cgmckeever

// use default
if (strlen($threadinfo[threadprefix]) == 0){
  $prefixes = explode("\r\n", trim($foruminfo['threadprefix']));
  $threadinfo[threadprefix] = $prefixes[0];
}
                                                       
// wrap the prefix
if (strlen($threadinfo[threadprefix]) != 0){
  $threadinfo[threadprefix] = str_replace('{1}',$threadinfo[threadprefix],$vbulletin->options['prefixmarkupalt']);
  $threadinfo[threadprefix] = str_replace(' ',' ',$threadinfo[threadprefix]);
  // get rid of built in prefix
  $text_subject = trim(str_replace("[\$foruminfo[title_clean]-t-\$threadinfo[threadid]]",'',$text_subject));
  $text_subject = trim("\$threadinfo[threadprefix] " . $text_subject);
}

// end prefix code - cgmckeever

Cyricx 08-29-2007 10:17 AM
Quote:
Originally Posted by cgmckeever (Post 1327663)
I dont need a password to send an email from a yahoo (or other webmail account) that is not mine -- PM me your email address and I will demonstrate this. Thus, anyone can get around the simple 'from' check ..

That is why I am saying it is not a security feature, it is reducing the usability actually more so than any security feature.
I emailed you an address for my test site and my admin address there to try to fake :)
Good luck! :)

Quote:
Originally Posted by cgmckeever (Post 1327700)
If you add this code (in all spots cron and product xml) right after text_subject is defined, the EmailIntegration script will handle the custom prefixes _and_ use a default one if none is found - it seemed to already take into account the original prefixing anyhow [\$foruminfo[title_clean]-t-\$threadinfo[threadid]]:

Code:
// prefix code - cgmckeever
 
// use default
if (strlen($threadinfo[threadprefix]) == 0){
  $prefixes = explode("\r\n", trim($foruminfo['threadprefix']));
  $threadinfo[threadprefix] = $prefixes[0];
}
 
// wrap the prefix
if (strlen($threadinfo[threadprefix]) != 0){
  $threadinfo[threadprefix] = str_replace('{1}',$threadinfo[threadprefix],$vbulletin->options['prefixmarkupalt']);
  $threadinfo[threadprefix] = str_replace(' ',' ',$threadinfo[threadprefix]);
  // get rid of built in prefix
  $text_subject = trim(str_replace("[\$foruminfo[title_clean]-t-\$threadinfo[threadid]]",'',$text_subject));
  $text_subject = trim("\$threadinfo[threadprefix] " . $text_subject);
}
 
// end prefix code - cgmckeever

I'll get this into the next live version! :)

Thank you!

Cyricx 08-29-2007 11:25 AM
Remember all, I am looking for beta testers!! be sure to PM me if you would like to help test the next version because I'll be rewriting the regexs in the upcoming version!

cgmckeever 08-29-2007 02:40 PM
OK - although the THREAD PREFIX script has its place, I didn't like the need for it to be installed to get the EI prefix to work.

You need to add a DB field ei_prefix:

Code:
ALTER TABLE forum ADD ei_prefix VARCHAR( 50 ) NULL;
This needs to be manually changed since I dont want to tinker with the EI admin script and keep this as simple to reimplement when changes to the EI codebase are made. (HINT HINT)

The below snippet needs to be added to the EI cron and product files right after:
Code:
$text_subject = replace_template_variables($text_subject);

Code:
// prefix code - cgmckeever
// check for ei_prefix defined
if (strlen($foruminfo[ei_prefix]) != 0){
  // get rid of built in prefix
  $text_subject =  trim(str_replace("[\$foruminfo[title_clean]-t-\$threadinfo[threadid]]",'',$text_subject));
  $text_subject = trim("\$foruminfo[ei_prefix] " . $text_subject);
}
// end prefix code - cgmckeever


All times are GMT. The time now is 04:36 AM.
Page 38 of 107 « First 283637 38 39404888 Last »
Show 40 post(s) from this thread on one page

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01875 seconds
  • Memory Usage 1,758KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (5)bbcode_code_printable
  • (6)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (4)pagenav_pagelink
  • (3)pagenav_pagelinkrel
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (10)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • pagenav_page
  • pagenav_complete
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete