vb.org Archive - where to place my safe custom functions?

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 Programming Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=15)

- - where to place my safe custom functions? (https://vborg.vbsupport.ru/showthread.php?t=313232)

where to place my safe custom functions?

Hi...

Possibly a new security feature of my vBulletin is stopping me from including my custom php file which has a custom-function within it and then using that function in a custom template, where should I place my 'safe' function and get my template working again?

The error I'm having is:

Fatal error: Call to undefined function customfunction() in /home/www/xxx/includes/adminfunctions_template.php(3950) : eval()'d code(277) : eval()'d code on line 47

please advise

Use hook: template_safe_faunctions

Code:

$safe_functions[] = 'my_php_function_name';

Hopefully, I understood your question correctly. :)

Quote:

Originally Posted by tbworld (Post 2508270)

Use hook: template_safe_faunctions

Code:

$safe_functions[] = 'my_php_function_name';

Hopefully, I understood your question correctly. :)

Yes I think you have...Not sure where to use it, but i'll try thanks

This should help. :)

http://www.vbulletin.com/docs/html/f...n_conditionals

If you have a specific question and you can show your work, then I can be of more assistance. :)

Thank you...

Yes were on the right track...

I have a custom php file in my forums directory which through a template is being included, all that php file really has in it is that function, the template is not being saved telling me it's undefined...

So in the php file I've included the line : $safe_functions[] = 'myFunction';
but it's a no show still...

It all used to work :) using vBulletin 3.8.7 Patch Level 4 - Just need to let vB know that myFunction is a good'un and I'm golden.. the custom php file is being included, just can't save the template without an error....

Thanks for the help.

\
EDIT, I'm getting it now I think....

Quote:

Originally Posted by b6gm6n (Post 2508279)

"Safe Functions" allows a PHP function or user function to be accessible via a template. It's main purpose was to limit harmful functions from being executed at presentation. "$safe_function" is an array that you can add the name of your function to, this is added to the array at template hook: "template_safe_functions". (See .. "/includes/adminfunctions_template.php" around line ~1888.

I have a notion that you are trying to send information to the template through output buffering, but cannot be sure without seeing your code. My forte' lies with vb4, so you could be still doing something I am not familiar with.

Yeah I dunno...

just want a function included simple as...

so I see in my 'adminfunctions_template.php' this line:

($hook = vBulletinHook::fetch_hook('template_safe_functions ')) ? eval($hook) : false;

What's a hook? do I need to create a new plugin for my function? insert some code into my custom php file to allow vB to accept it? or insert more code into my custom template? or create a new template with proper allowed custom functions? - I'm confused...

I'll explain, this should be easier you know :D

Got a custom php file, it's being included, here's the code

Code:

<?

function paginateRecords($dataFile,$page,$numRecs=10){



    $output='';



    // validate data file



    (file_exists($dataFile))?$data=(file



    ($dataFile)):die('Data file not valid.');



    // validate number of records per page



    (is_int($numRecs)&&$numRecs>0)?$numRecs=$numRecs:die



    ('Invalid number of records '.$numRecs);



    // calculate total of records



    $numPages=ceil(count($data)/$numRecs);



    // validate page pointer



    if(!preg_match("/^\d{1,2}$/",$page)



    ||$page<1||$page>$numPages){



    $page=1;



    }



    // retrieve records from flat file



    $data=array_slice($data,($page-1)*$numRecs,$numRecs);



    // append records to output



    foreach($data as $row){



    $columns=explode('_',$row);



    foreach($columns as $column){



    $output.=$column.'&nbsp;';



    }



    $output.='<br />';



    }



    // create previous link



    $output.='<div class="cheatpagenation">';



    if($page>1){



    $output.='<a href="'.$_SERVER['PHP_SELF'].'?page='.



    ($page-1).'">&lt;&lt; Previous</a>&nbsp;';



    }



    // create intermediate links



    for($i=1;$i<=$numPages;$i++){



    ($i!=$page)?$output.='<a href="'.$_SERVER



    ['PHP_SELF'].'?page='.$i.'">'.$i.'</a>&nbsp;':$output.=$i.'&nbsp;';



    }



    // create next link



    if($page<$numPages){



    $output.='&nbsp;<a href="'.$_SERVER['PHP_SELF'].'?page='.



    ($page+1).'">Next &gt;&gt;</a></div>';



    }



    // return final output



    return $output;



    }

?>

So in my custom template I have this line:

Code:

//  //    require_once('top10pagenation.php');

//    $page=$_GET['page'];

//    echo paginateRecords('top10.txt',$page);

It's all commented out at the moment as I can't save it without that error

Thanks ever so for the help, I just can't seem to understand what's what with this, cheers

--------------- Added [DATE]1406330921[/DATE] at [TIME]1406330921[/TIME] ---------------

I placed in the admin_functions template near those lines you mentioned

'$safe_functions = array(
'paginateRecords', // test
);

so it's like this now:

Code:

        static $safe_functions;

        if (!is_array($safe_functions))

        {

                $safe_functions = array(

                        // logical stuff

                        0 => 'and',              // logical and

                        1 => 'or',               // logical or

                        2 => 'xor',              // logical xor



                        // built-in variable checking functions

                        'in_array',              // used for checking

                        'is_array',              // used for checking

                        'is_numeric',            // used for checking

                        'isset',                 // used for checking

                        'empty',                 // used for checking

                        'defined',               // used for checking

                        'array',                 // used for checking



                        // vBulletin-defined functions

                        'can_moderate',          // obvious one

                        'can_moderate_calendar', // another obvious one

                        'exec_switch_bg',        // harmless function that we use sometimes

                        'is_browser',            // function to detect browser and versions

                        'is_member_of',          // function to check if $user is member of $usergroupid

                        'paginateRecords',          // test

                );

just to add my function at the end, still can't save my template.. same error

Quote:

Originally Posted by b6gm6n (Post 2508283)

What's a hook? do I need to create a new plugin for my function? insert some code into my custom php file to allow vB to accept it? or insert more code into my custom template? or create a new template with proper allowed custom functions? - I'm confused...

Other than using variables to build the output html, in general you cannot put php in a template. The exception is in a conditon (i.e <if condition="....), and then you can only put what would go in a php 'if' statement, and you can only use the "safe" functions.

But I don't think that's what you want. It looks to me like you are trying to call your custom function to do some formatting, in which case you would want to use a plugin. Your code would then create one or more variables and you'd use them in a template.

So, which hook location should you use? It depends on what you're trying to do. Hooks are just places in the vbulletin scripts where addon code can be called, so you need to find one in a location that's allows you to do what you want to do.

Quote:

Originally Posted by kh99 (Post 2508285)

Got ya... might need a little help, I'm getting there, I've created a plugin with that function, see below:

Code:

<?xml version="1.0" encoding="ISO-8859-1"?>



<plugins>

        <plugin active="1" executionorder="9" product="vbulletin">

                <title>paginateRecords</title>

                <hookname>template_safe_functions</hookname>

                <phpcode><![CDATA[function paginateRecords($dataFile,$page,$numRecs=10){







    $output='';







    // validate data file







    (file_exists($dataFile))?$data=(file



    ($dataFile)):die('Data file not valid.');







    // validate number of records per page







    (is_int($numRecs)&&$numRecs>0)?$numRecs=$numRecs:die



    ('Invalid number of records '.$numRecs);







    // calculate total of records







    $numPages=ceil(count($data)/$numRecs);







    // validate page pointer







    if(!preg_match("/^\d{1,2}$/",$page)



    ||$page<1||$page>$numPages){







    $page=1;







    }







    // retrieve records from flat file







    $data=array_slice($data,($page-1)*$numRecs,$numRecs);







    // append records to output







    foreach($data as $row){







    $columns=explode('_',$row);







    foreach($columns as $column){







    $output.=$column.'&nbsp;';







    }







    $output.='<br />';







    }







    // create previous link



    $output.='<div class="cheatpagenation">';



    if($page>1){



    $output.='<a href="'.$_SERVER['PHP_SELF'].'?page='.



    ($page-1).'">&lt;&lt; Previous</a>&nbsp;';







    }







    // create intermediate links







    for($i=1;$i<=$numPages;$i++){







    ($i!=$page)?$output.='<a href="'.$_SERVER



    ['PHP_SELF'].'?page='.$i.'">'.$i.'</a>&nbsp;':$output.=$i.'&nbsp;';







    }







    // create next link







    if($page<$numPages){







    $output.='&nbsp;<a href="'.$_SERVER['PHP_SELF'].'?page='.



    ($page+1).'">Next &gt;&gt;</a></div>';



    }







    // return final output







    return $output;







    }]]></phpcode>

        </plugin>

</plugins>

no errors, in my template which I can save now shows nothing on the page itself, just a white screen...

My template (incidentally I have php plugin which allows me to use php in templates, so for the 'echo' statement I'm hoping is all ok)

Code:

//    require_once('top10pagenation.php');

    $page=$_GET['page'];

    echo paginateRecords('top10.txt',$page);

So I'm getting there, do I need to call the hook/function in a different way within my custom template? please advise, thank you

Couple questions:
What modification are you using to include PHP in templates?
What template are you inserting this into?

You do not need "$safe_functions" for what you are doing, since you are circumventing the template system.

Give me a few minutes to get my bearing on this with VB3. :)

OK thanks for the help...

The plugin to allow PHP is called 'Product : Let PHP Live!' and looks like this:

Code:

if (!function_exists('let_php_live')) {

  function let_php_live($matches) {

          $starter = $matches[1] ;

                $code = str_replace(array('\'', '\"'), array('\\\'', '"'), $matches[2]) ;

        

                return $starter == '<?=' ? "\".eval('return $code;').\"" : "\".eval('ob_start();$code;return ob_get_clean();').\"" ;

        }

}



$template = preg_replace_callback('/(<\?=|<\?php|<\?)(.*)\?>/Us', 'let_php_live', $template);

Seems to work OK or did...
The template I'm using is a custom one, see below:

Code:

$stylevar[htmldoctype]

<html dir="$stylevar[textdirection]" lang="$stylevar[languagecode]">

<head>

<title>$vboptions[bbtitle]</title>

$headinclude

</head>

<body>

$header



$navbar



<table cellpadding="2" cellspacing="$stylevar[cellspacing]" border="0" width="100%" align="center">

<td width="100%"><img style="float:left" src="images/7ox10header.gif" border="0" /></td>

</table><br />

<div class="rounded-corners-forum">

<?

$cacheFile = 'top10.txt';



if ( (file_exists($cacheFile)) && ((fileatime($cacheFile) + 86400) > time()) )

{

    $content = file_get_contents($cacheFile);

} else

{

    ob_start();

    // write top10.txt file

    

$record = 1;

if (($handle = fopen("ftp://***", "r")) !== FALSE) {

    while (($data = fgetcsv($handle, 1000, ",")) !== FALSE) {

echo "<div class=\"cheatpagenation\"> </div><br /><div class=\"top10list\"><font color=grey>#0".$record." : </font><font color=white>".str_replace ("Umbra.PermaScore:Add(", " ", $data[0])."</font>_<font color=grey>KILLS-( <font color=CadetBlue>{$data[2]}</font><font color=grey> )_DEATHS-( <font color=FireBrick>{$data[3]}</font> <font color=grey>)_SUICIDES-( <font color=FireBrick>{$data[6]}</font> <font color=grey>)_HEADSHOTS-( <font color=CadetBlue>{$data[4]}</font> <font color=grey>)_DUELWINS-( <font color=Tomato>{$data[7]}</font> <font color=grey>)_LEVEL-( <font color=GoldenRod>{$data[9]}</font> <font color=grey>)</font></div>\n";

        $record++;

        if ($record > 100) { break; }

    }

    fclose($handle);

    }



    $content = ob_get_contents();

    ob_end_clean();

    file_put_contents($cacheFile,$content);

}



//    require_once('top10pagenation.php');

    $safe_functions[] = 'paginateRecords';

    $page=$_GET['page'];

    echo paginateRecords('top10.txt',$page);

    echo "<div class=\"cheatfooter\">TOP 100 UPDATED AUTOMATICALLY EVERY DAY</div>";

?>



</div><br />

<table cellpadding="2" cellspacing="$stylevar[cellspacing]" border="0" width="100%" align="center">

<td width="100%" align="left"><img src="images/top10.png" border="0" /></td>



<tr>

        <td class="shameheader"><font face="customfont4">&nbsp;&nbsp;? 7OX-10 PLAYERS - ( TOP 100 LISTED )</font></td>



</tr>



</table>



$footer

</body>

</html>

On my forum I just link to my php file which calls up my template:

Code:

<?php



error_reporting(E_ALL & ~E_NOTICE);



define('NO_REGISTER_GLOBALS', 1);



define('THIS_SCRIPT', 'top10');



$phrasegroups = array();



$specialtemplates = array();



$globaltemplates = array('top10',);



$actiontemplates = array();



require('global.php');



eval('$navbar = "' . fetch_template('navbar') . '";');



eval('print_output("' . fetch_template('top10') . '");');



?>

I've got that plugin with the custom-functions I want installed and there's no errors there, but my php top10 page is pure white at the moment, nothing shown... so dunno what to try next actually, but thanks for the help thus far.

--------------- Added [DATE]1406390365[/DATE] at [TIME]1406390365[/TIME] ---------------

Adding the hooks etc seems to work... just blank output

Code:

//    require_once('top10pagenation.php');

//    $page=$_GET['page'];

//  echo paginateRecords('top10.txt',$page);

That function when included from that file seemed relative to that $page variable on the next line down and so the echo was easy, but because the now safe function is running all the time for some reason the $page line isn't relative to that function anymore... and so balks and echos nothing... not sure.

Lovely... would you believe I was going along similar lines...

Anyway, if you could clear a few things up... I've followed everything here and it's very clear, getting a good understanding, I have one more template/php-file to do like this and I'll apply your enlightening way to that also...

Right, well it's working, kinda... I can see what's happening, top10.php seems fine, template is fine, when called I see my forum header, the outout header and graphic and the footer graphic and then the forum footer itself, but nothing inbetween...

What I'm doing as you would of guessed is reading a file from ftp, putting a 100 lines of it into a text file/flat-file and then trying to read it out nicely... seems like the fault of the 'top10.txt' which checking now is zero bytes, so it's making the file, putting nothing into it and then reading nothing out, so it's either my ftp url which I'm sure is right or line 94 of the top10.php which is:

Code:

$ftpurl = "./top10records.txt";

Before it was actually connecting via ftp and making the file for reading, so that line above would that need the full ftp url? I'm reading a text file (well a lua file) the ftpurl line is similar to this:

Code:

$ftpurl = "ftp://username:password@88.88.88.88/Data_PermaScore.lua"; // Your FTP uri

almost there old boy... but yeah I did think of putting everything into my php file and using a string to output it all, but you have done a much nicer job and I'll follow this way in future, thanks ever so for helping me.

Remove that line it is a typo. That was for my local test data. I will remove it from the message above, sorry. :)

Most of your html code could have easily been placed into the template. Which would have made it easier to code, once you get the hang of things.

Thanks, Done...

I'm still trying to work out why it's creating a zero-byte 'top10.txt' file and putting nothing into it for reading... hmmm so I'm getting an output of zilch, Can't see anything obvious...

EDIT, ahh right, removed the top10.txt and it worked, showing records... but all of them :D

Up to 95 records before it breaks... no pagenation

Example shown:

Code:

#0 1 : 'kkk-'_KILLS-( 51370)_DEATHS-( 22963)_SUICIDES-( 3444)_HEADSHOTS-( 1261)_DUELWINS-( 3)_LEVEL-( 89)

I was using the underscore _ to split the data

If you can attach a copy of the data file and your CSS then I can check it out further. Just capture the raw CSV, not the cache file.

See the attachment for my test output. This was before I posted the code here.

Quote:

Originally Posted by tbworld (Post 2508421)

See the attachment for my test output. This was before I posted the code here.

OK, well I changed the line:

Code:

if ($record > 50)

Just to see what happens and it shows the pagination now, but see the screeny

On page one, at the bottom the first two records are repeated after the fifty shown, then if you press next which works, page two shows again all records and the next two at the bottom are record 3 and 4 and so it go's on :) hopefully we're getting there, thanks ever so for this help.

The problem I think is in $numrecs. I changed the variable only at posting time for consistency. It should be $numRecs. So you might want to change all $numrecs to $numRecs. There should be two.

I will get a chance to take a look at this, later this evening. :)

Due to the possible exploits of the original code, it was easier to just write new code. I tried to keep things compatible with your existing code so that it would not be too difficult for you to modify.

I will post the main code here and your proprietary templates in a PM. Updating your HTML should be much easier now that this is using the vb3 conventions.

top10 -- Main template
top19bits -- Row data bits

Let me know when you get it running, I would like to see the finished product. :)

Code:

<?php



// ####################### SET PHP ENVIRONMENT ###########################

error_reporting(E_ALL & ~E_NOTICE);



// #################### DEFINE IMPORTANT CONSTANTS #######################

define('CSRF_PROTECTION', true);



// ################### PRE-CACHE TEMPLATES AND DATA ######################

// get special phrase groups

$phrasegroups = array();



// get special data templates from the datastore

$specialtemplates = array();



// pre-cache templates used by all actions

$globaltemplates = array('top10', 'top10bit');



// pre-cache templates used by specific actions

$actiontemplates = array();



// ######################### REQUIRE BACK-END ############################

require_once('./global.php');





// #######################################################################

// ######################## START MAIN SCRIPT ############################

// #######################################################################



    // Configuration

    define('TBWORLD_DIAG', true);        // Cache Diagnostics - False for normal operation



    $ftpurl     = "ftp://***";            

    $cachefile     = "top10.txt";            

    $cachetime  = 86400;    

    $cachefunc    = 'filemtime';            // 'filemtime' or 'fileatime'

    $ftpmaxrecs    = 90;                    // Maximum FTP records to process    

    $perpage    = 10;                      // Records per-page

    $cachetime  = 10;                    // Cachetime in seconds



      

    $vbulletin->input->clean_array_gpc('g', array(

        'page' => TYPE_UINT,

    ));

    $page = $vbulletin->GPC['page'];

                



    //--------------------------------------------------------------------------------------------------------

    // TBWORLD NOTERS::

    //       Some Unix filesystems can be mounted with atime updates disabled to increase the performance.

    //      Currently using "filemtime" as default, if caching is not working try "fileatime"

    //         See configuration "$cachefunc" above

    //---------------------------------------------------------------------------------------------------------

    

    if ((file_exists($cachefile)) && ((call_user_func($cachefunc, $cachefile) + $cachetime) > time()))

    {

        if (TBWORLD_DIAG===true) $out_diag="&nbsp --- Cached --- &nbsp ( " .htmlspecialchars_uni($cachefile)." ) accessed ... " . date("H:i:s", call_user_func($cachefunc, $cachefile));        

        $cache_data = json_decode(file_get_contents($cachefile));

    } 

    else

    {

        if (TBWORLD_DIAG===true) $out_diag="&nbsp --- Cache Written --- &nbsp ( " .htmlspecialchars_uni($cachefile)." ) ... " .date("H:i:s");        

        

        $record = 0;

        if (($fh = fopen($ftpurl,"r")) !== FALSE) {

            

            // I would have prefered the variable name 'datarow' instead of 'data', but that is what you 

            //   were currently using in your templates.

            while (($data = fgetcsv($fh, 1000, ",")) !== FALSE)

            {

                $record++;                

                $nofields = count($data);                

                

                //                    0                         1x         2      3     4   5x    6    7    8x     9     10x        11x   12x    13x    

                // Umbra.PermaScore:Add('EloSidzej-PL-', '288124117', 51370, 22963, 1261, 481, 3444, 3, 462968, 89, '20140715', 19121, 9666, 6120);    

                $data[0] = str_replace("Umbra.PermaScore:Add('", " ", $data[0]);

                $data[0] = rtrim($data[0], "'");

                $data     = array_map('trim', $data);

                $data     = array_map('htmlspecialchars_uni', $data);



                $cache_data[] = $data;  // datarow processed

                

                if ($record >= $ftpmaxrecs) { break; }

            }

            fclose($fh);

        }

        //-----------------------------------------------------------------------------------

        // If for some reason the cache cannot be written, then the routine

        //   falls back to a cacheless mode.

        //-----------------------------------------------------------------------------------

        file_put_contents($cachefile, json_encode($cache_data), LOCK_EX);    

    }





    // Page Count

    if (empty($record))  $record = count($cache_data);

    $numpages = $record/$perpage;

            

    // Page pointer bounds check

    if( !preg_match("/^\d{1,2}$/", $page) ||  $page < 1  ||  $page > $numpages) {

        $page=1;

    }

    



    //-----------------------------------------------

    // Output Top10bits Template  (data-bits)  ----  

    //-----------------------------------------------

    $page_data = array_slice($cache_data, ($page-1) * $perpage, $perpage);    unset($cache_data);  



    foreach ($page_data as $key => $data) { 

          $record = $key + ($page * $perpage);

          eval('$out_top10bit .= "' .fetch_template('top10bit'). '";');       

    }

    unset($page_data, $data);

      

      

    //---------------------------

    // Output Pagination  ----  

    //---------------------------

    $server_self   = "";  // Empty attribute method (Safer Method)

    //$server_self = htmlspecialchars_uni($_SERVER['PHP_SELF']);

    //$server_self = htmlspecialchars($_SERVER["PHP_SELF"], ENT_QUOTES, "utf-8");

        

    $out_pagination ="";



    if ( $page > 1 ) {

            $out_pagination .= "<a href=\"{$server_self}?page=" . htmlspecialchars_uni($page-1) . "\">&lt;&lt; Previous</a>&nbsp;";            

    }

    for ( $i = 1;  $i <= $numpages; $i++) {

        if ($i != $page) {

            $out_pagination .= "<a href=\"{$server_self}?page=" .$i. "\">" .$i. "</a>&nbsp;";

        } else {

            $out_pagination .= $i . "&nbsp;";

        }

    }

    if ($page < $numpages) {

            $out_pagination .= "&nbsp; <a href=\"{$server_self}?page=" . htmlspecialchars_uni($page+1) . "\">Next &gt;&gt;</a>";            

    }



     

   $navbits = construct_navbits($navbits);

   eval('$navbar      = "' . fetch_template('navbar') . '";');

   eval('print_output("'  . fetch_template('top10')  . '");');

X vBulletin 3.8.12 by vBS Debug Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (16)bbcode_code_printable (5)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (20)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages:

Phrase Groups Available:

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01238 seconds Memory Usage 1,893KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (16)bbcode_code_printable (5)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (20)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: