Miscellaneous Hacks - Cyb - Advanced Forum Rules

Info:
Advanced Forum Rules system for vBulletin.

Main Features:
-Rules shown on separate page (no file uploads required)
-Several sets of rules can be created and applied to individual forums
-Choose between BB codes and HTML in rules
-Options to force users to accept Forum Rules before can view forums or threads, post replies, PMs, or e-mails...
-Option to replace registration rules with this product ones
-Option to reset user acceptance status when infraction is received

View screenshots.


Installation:
1. Import XML file (as product): AdminCP > Plugin System > Manage Products > [Add/Import Product]
2. OPTIONAL (for some customized styles)
Open template "navbar" and add "$cyb_frules_link" after "vbphrase[faq]</a></td>".
3. OPTIONAL (to add 'reset acceptance status' to different place than default one)
Open template "MEMBERINFO" and add "$cyb_frules_force" wherever you wish.


To set options:
Go to: AdminCP > vBulletin Options > Cyb - Advanced Forum Rules


Versions:
v1.0 - Oct 06. 2005.
-First version
v1.5 - Apr 22. 2006.
-Navbar link is added automatically now (one installation step less)
-Navbar "Forum Rules" link can be disabled in hack settings
-"Manage Rules" link is on settings page now (no need for .xml menu file anymore - one file less to upload when installing)
-"Unknown Location" fixed
-Added function to enable/disable whole hack (predefined error message is displayed instead)
-Templates now goes to "Cybernetec" group in Style Manager
To upgrade from 1.0 to 1.5:
-Import product XML through AdminCP > Plugin System > Manage Products > [Add/Import Product] (Be sure "overwrite" is checked). Upload cfrules.php and cfrulesadmin.php (replace old files). Delete file \includes\xml\cpnav_cfrulesadmin.xml.
v1.6 - Aug 04. 2006.
-Release of this hack for vB v3.6
v1.7 - Aug 05. 2006.
-Uncached template bug fixed
v2.0 - Aug 07. 2006.
-Completely changed way this hack works. No more queries, no more file uploads. Now Rules can be exported because it's part of vB settings. Now you can use BB Codes, which means you can use all standard text formatting functions, smilies, etc. To upgrade: Uninstall old version > Import XML as product > Delete "cfrules.php" from your forums root > Delete "cfrulesadmin.php" from "admincp" folder of your forums
v2.1 - Aug 07. 2006.
-Fixed "Edit Forum Rules" link (didn't worked for some users)
v2.2 - Aug 25. 2006.
-If your forum's index.php file was renamed, for any reason, now you can enter new filename in ACP hack options to have this hack working properly
-Added "Product Version Checking" - https://vborg.vbsupport.ru/showthread.php?t=124679
v2.3 - Aug 26. 2006.
-New: User must accept Rules to be able to post on Forums (option can be disabled/enabled)
-Look improved (see screenshots)
-Codes improved
-Hack name changed to "Cyb - Advanced Forum Rules"
v2.4 - Aug 27. 2006.
-Fixed small javascript bug
-Removed redirection to forum index after Rules acceptance
-Note 1/2 lines replaced by boxes in hack settings
-Removed navbar link HTML Markup options
-Separate phrase created for navbar link
v2.5 - Aug 31. 2006.
-Added ability to reset read status for all users. After this they will need to accept the Forum Rules again
-Added note at the top of Forum Rules when user need to accept it to be able to post on forums
-Added explanation on how to check which users had (not) accepted Rules
v2.6 - Aug 31. 2006.
-Fixed bug (index file location/name setting doesn't work)
-Fixed bug (if user who haven't accepted Rules try to post via quick reply in IE he gets undefined error)
-Fixed bug (resetting the accepts doesn't work if index file was renamed)
-Added: Guests now also need to accept Forum Rules to be able to post (cookie-based)
-Added: redirection message for user who try to post but haven't accepted Rules
v2.6.1 - Aug 31. 2006.
-Fixed bug (if user has no permissions to post he will get standard "no permission" message, not redirection to Forum Rules)
v2.7 - Sep 11. 2006.
-After acceptance users are redirected to the page they were previously viewing
-No more need to set filename for "index.php" if it was renamed. Now misc.php is used, which nobody has need to rename.
NOTE: Don't forget to update the links to the Rules you were posted on your site - change it to YOURFORUMS/misc.php?do=cfrules
-Added confirmation dialog for resetting acceptance status for all registered users
v2.8 - Sep 14. 2006.
-Added option to exclude usergroups from accepting Rules
-Navbar link title moved from phrases to settings for easier translation/make-up
v2.9 - Sep 24. 2006.
-Added option to reset acceptance status for individual member
v3.0 - Oct 30. 2006.
-Whole code is now valid XHTML 1.0 Transitional
v3.1 - Nov 13. 2006.
-Option to force user to accept rules again in member profile can be turned off
-Added variable for above function that you can place it to another place in MEMBERINFO template ($cyb_frules_force)
-Bug fixed (if some user knows exact link for resetting acceptance status he can do it)
-Several other improvements/fixes
v3.2 - Mar 06. 2007.
-New: User must accept Rules before can send PMs
-New: Options to choose what user can't do before accepting Rules
-New: Option to replace Registration Rules with this hack's one
-New: Better counter (with miliseconds, improved browser compatibility)
-Fixed some "invisible" bugs in code and improved compatibility with the latest vB releases
v3.3 - Apr 21. 2007.
-New: Option to force user to accept Rules before can view forums
-Fixed bug where three queries are executed on places where not needed
-Fixed bug where blank rows are shown twice on registration rules page
-New in registration rules options (disable completely)
-Better redirection after Rules acceptance
-Some other optimizations in codes...
v3.4 - Apr 22. 2007.
-Fixed bug where PMs can not be sent even Rules are accepted
-Fixed bug where Quick Reply does not work even Rules are accepted
-Improved counter and added ability to completely disable it (tested and worked on IE, Firefox, and Opera)
-Improved compatibility with right-to-left styles (note: in Rules use [right] tags anyway)
-Fixed navbar link
v3.5 - Jul 22. 2007.
-Fixed bug (MySQL injection vulnerability - attacker can trick admin to reset rules acceptance status for all members)
-Group membership checking works now for supplementary usergroups too
-Several code improvements
v3.5.1 - Jul 22. 2007.
-Fixed bug (XSS Vulnerability)
v3.5.2 - Jul 23. 2007.
-Another security exploit fixed
v3.5.3 - Jul 25. 2007.
-Fixed bug where user is not properly redirected after accepting rules
v3.5.4 - Jul 25. 2007.
-Bug fixed where username info is not shown when going to reset acceptance status
v3.6 - Oct 14. 2007.
-Fixed bug where some mods are not able to reset acceptance status
-Improved javascript code to fix problems with the counter some users reported
-Minor bug fixes
v3.7 - Apr 30. 2008.
-CSRF protection added
-Compatible with vBulletin 3.7 Gold (may not work with Beta/RC releases)
-Fixed bug where "reset all" button in hack options does not work in IE
-Minor bugs fixed
v3.8 - Jun 19. 2008.
-Fixed bug where user is able to submit form without checking "agree"
-Option to disable BB Codes in Forum Rules
-Option to change "Forum Rules" link color or set to style's default
-Better placement of "Force User To Accept Forum Rules" link in user profiles
v3.9 - Apr 19. 2009.
-New: Ability to create several rules sets, and apply them to individual forums
-New: Exclude individual forums from restrictions
-New: Rules management page where rules sets can be easily added/deleted/edited/applied to forums
-'General Forum Rules' item can be changed but not deleted. Please use it always as general rules.
-Bug fix: Option to disable registration rules does not work on vB 3.8.x
-Bug fix: Counter on 'Accept rules' button does not work on some configs
-Forum Rules link in showthread now leads to this product's 'General Forum Rules'
-If user has not accepted rules, then 'Force to accept rules' link in their profile is not shown
-New: Option to reset user acceptance status when infraction is received
-Some minor bugs fixed
v3.9.1 - Apr 20. 2009.
-Fixed bug: Forum Permissions sometimes needs to be rebuild manually after upgrade
-Fixed bug: Redirection after accepting rules does not work properly in some cases
v3.9.2 - Apr 21. 2009.
-New: Drop-down menu with the rule set list on Rules page
-New: General Rules always shown at the top of table, requested Rules below it
-New: 'Forum Rules' link at the bottom of forumdisplay will lead user to that forum's rule set
-Fixed bug: Navbar link is not disabled when you disable product in options
-Fixed bug: Quick Reply hidden for users who have not accepted Rules even if forum is excluded from restrictions
-Forums better sorted on the list, now linked and some more details are shown
v3.9.3 - Apr 25. 2009.
-New: User can not view Rule sets applied to no-permissions-to-view forums
-Above works also with 'Cyb - Advanced Permissions Based on Post Count' add-on
-New: Choose if General Rules will be Always shown, Collapsed if there is another rule set requested, or Disabled when there are other rules shown
-'Forum Rules' links in showthread, newthread, and newreply are also now redirected to the Cyb Forum Rules
-New: "Rules NOT accepted" shown in user profiles when they have this status
v4.0 - Apr 28. 2009.
-New: User must accept Rules to be able to view thread content
-New: User must accept Rules to be able to send e-mails ('contact us' or 'e-mail user')
-New: Different Rule sets are accepted individually
-New: Reset acceptance status for individual Rule sets
-New: Rules acceptance date/time info shown in member profile
-Fixed bug: Quotes can not be used in Rule Set name
-Some minor bugs fixed
v4.0.1 - Apr 28. 2009.
-Fixed bug: Reply w/quote switches to basic reply after redirection
-Fixed bug: Forums exclusion does not work properly in v4.0
-New: When PM restrictions are enabled Quick Reply is hidden in ShowPM until General Rules are accepted
v4.0.2 - May 08. 2009.
-Fixed bug: In some cases wrong items are listed in 'Accepted Rules' drop-down
-Fixed bug: 'Reset user acceptance status when infraction received' does not work properly
v4.0.3 - May 04. 2011.
-Security bug fixed
v4.0.4 - May 06. 2011.
-Fixed: vbseo users not able to switch rules
v4.0.5 - May 18. 2011.
-Fixed: Security bug
-Improved rule acceptance check


If you like this hack please click INSTALL.

[cellarius]

Originally Posted by FreshFroot

That may have happened, but I believe they quarantined the mod so late that many websites were already hacked at that point.

You expect them to quarantine the mod before they know about it?

[FreshFroot]

Originally Posted by cellarius

You expect them to quarantine the mod before they know about it?

Well that is obvious.. he's not god and can't do that. But it seemed like members had posted about it and there was no response from Valter to confirm the problem.

My guess is he just went ahead to fix it instead of posting that he is looking at it and will address it.

Anyways I am not here to fight. So I am done with this discussion.

I posted my points and some people will agree and some won't and heck some might not get them. And that is all fine by me.

All the best to all the forums that were hacked and I hope they had backups to fix the major take downs.

[FreshFroot]

Originally Posted by septimus

When I came back to thank you the mod had been quarantined and I couldn't reply. So thank you very much for answering my question.

I personally love the concept of this mod, but I think some jerks are going to continue to try to break it.

The main feature I liked about this mod was redirecting users who've received an infraction to the general rules page. I also liked being able to setup different rules.

We have general, marketplace, and developers. I ended up creating FAQ pages for each and then created a pulldown in my navbar to get to them. So the only feature I am missing out on is the redirect for infractions. Maybe I'll write my own plugin that does that someday.

Ya jerks like that will exist sadly.. No matter what script someone will always try to break it for their own reasons.

I just hope the people that were affected are better now. I read someones post earlier stating they had no backups and the forum was pretty much destroyed.

[Daverball]

Well if you don't backup you're pretty much asking for it, if you have the funds to buy vBulletin you should have the funds to make a daily backup of the forums, otherwise you will eventually regret it, it could've happened with any other mod or with vbulletin itself.

[Slepur]

Just so you know, this version is still vulnerable, you might wish to check through the code again.

[Daverball]

Originally Posted by Slepur

Just so you know, this version is still vulnerable, you might wish to check through the code again.

Then maybe you wish to inform Valter of the exact nature of the vulnerabilities in a private message, instead of just claiming that it is vulnerable.

[Diggo11]

I believe a version of Internet Explorer has had this problem for a while, but now this mod doesn't seem to work for users with Chrome? (Tested Chrome 12.) When viewing a forum protected by a rules set, users are shown only the general forum rules (not the forum specific rule set) and hence when clicking accept are only looped back to the "You must accept the rules to proceed!" page...

EDIT: Okay, only seems to be affecting my latest forum. Use a set of rules I created yonks ago and it works perfectly in Chrome, use a set of rules I created ten minutes ago and nothing shows.

[Paul M]

Originally Posted by Slepur

Just so you know, this version is still vulnerable, you might wish to check through the code again.

If you have information on an issue then use the report post facility to report it, with exact details. Posting cryptic messages like this helps no one.

[LauraM]

So, is this safe to turn back on, now?

[HMBeaty]

Originally Posted by LauraM

So, is this safe to turn back on, now?

If you've upgraded to the latest version, yes