Miscellaneous Hacks - Rotating Banner System

With the Rotating Banner System software, you may publish literally anywhere standard banners and advertising, with no restriction but your imagination. Unlike many other products, it allows to show an unlimited amount of banners and advertising, which are randomly shown at the places you choose, and you may refer generically to an Ad by using specific placeholders.

Also the management is straight-forward and simple to use. Forum administrators with maintenance rights may add, edit and delete records from the Administration Control Panel (ACP), one of each representing a banner. After saving the new banner settings, they are immediately visible at your board.

Compatibility: from vBulletin 3.6.5 onwards

By the way, I do also install the hack on your boards, but since I am very, very busy, it may take some time (weeks) until it gets done.


Tutorials:

• How-to create my first banner (Flash).

Updates:

• 2.0.1: Simple click tracker added, HTML help included.
• 2.0.3: Small bug fixes; additional banner list, navigation bar, E-Mail field for banner event notifications and automatic save on scroll setting; absolute URL to rbs_banner.php in order to allow click tracking on non-standard pages; supported languages: English, Italian; Help file clean-up.
• 2.0.5: Small bug fixes; additional details in banner list; email notification for epired banners.
• 2.0.6: vbCMS compatibility bug fix; additional banner lists.
• 2.0.7: Usergroups filter: now it is possible to define a list of usergroups which may show a banner; additional vbCMS compatibility bug fix.
• 2.0.8: Various fixes and most of all, inclusion of the right files: admin_rbs.php, cpnav_rbs.xml
• 2.0.9: Extra comma fix in new record creation.
• 2.1.0: Fix for an occasional banner type selection bug, when the sample banners have been deleted or disabled.
• 2.2.0 (Major upgrade): Up to 10 different banner locations. Requires changes to your existing placeholders in your templates, since a more generic format has been chosen. If you don't need more than 2 different locations, you don't need to upgrade. Changed files: rbs_banner.php, admin_rbs.php
• 2.2.1: Minor bug fix in files: admin_rbs_h_banner_list.php, admin_rbs_v_banner_list.php
• 2.2.1: Hotfix for Max Clicks saving bug.
• 2.2.2: More listings and less files. PDF Help. Separate Italian add-ons and help. Duplicate button.
• 2.2.3: Minor bug fixes. Changed files: product-rbs.xml
• 2.2.4: Flash Banner support (beta). Changed files: product-rbs.xml, rbs_wrapper.swf, admin_rbs.php, English Help.
• 2.2.5: Hotfix for vBulletin 4.0.2 compatibility bug.
• 2.2.6: Checking for installed Flash Wrapper rbs_wrapper.swf; A few English FAQ; Help files. Changed files: product-rbs.xml
• 2.3.0 (Major upgrade): New modules: Delete Expired Banners, Disable Expired Banners; Detail Banner Statistics with unique access key for your customers; Updated help; Changed files: all.
• 2.3.1: Hotfix for missing field in rbs_hist table. Changed files: none, just update product.
• 2.3.2: Added: Unsupported option for setting any number of available positions between 1 and big bang. Fixed: Small bug and speed issues. Removed: Italian translation. Italians may now request support at www.vbulletin.it. Changed files: admin_rbs.php.
• 2.3.3: Fix: Copy selected forum ID's during banner duplication. Changed: start and end hours for new banners are set to 0:00 and 23:59 respectively. Changed files: admin_rbs.php.
• 2.3.4: Option: Send Mail Before. This option allows to schedule expiring banners differently. New variables for emails: $rbs_enddate: This variable holds the formatted banner ending date and time based on the standard formats for date and time in vBulletin settings; $rbs_name: This variable holds the banner name. EMail Notifications option description: Added direct links to the email phrases for quick changes. Changed files: rbs_mail_cron.php.
• 2.4.0 (Major upgrade): Removed: Option to enable or disable mailing. Banners with email addresses to notify are handled. Setting to reset mailing in single banners. Now, if mailing should be repeated, you will have to edit the banner from phpMyAdmin. Added: Order links in lists. The initial state is ordered by ID, as before. By clicking the titles, the other voices can be ordered. Clicking twice inverts the order. This works in all lists. Options to prevent counting and reducing thus a tiny bit of load. A new bunch of demo banners for new installations. Demo banners are locked into database in order to avoid 30% of the questions because of the 'experts' deleting them before trying the product. They can be disabled and modified though. The true experts can delete them after all testing from the database by using phpMyAdmin without side effects. Changes: Phrase for emailing about expiring banners, now also with direct links to the phrases. Demo banners. Our old publisher ID is replaced with the new ones, and old demo banners are updated with the new ones, if found. The functions have been exported to includes/functions_rbs.php. This makes the product code smaller and easier to maintain, and runs faster on sites where caching/acceleration is enabled. Changed Files: all *.php
• 2.4.1: Option Likelihood. This new option adds a weight to banners and allows thus to show one banner more often than another. The default weight is 100%. We also make sure that the final date of the default banners falls into a valid range. Changed files: includes/functions_rbs.php and rbs_stats.php.
• 2.4.2: Workaround for update sequence problems.

Hacks and unsupported add-ons:

• Banner Rotator Widget To CMS
• Rotate banners in-place
• Italian Translation

[s_cocis]

Hi y2ksw ,

from some days, an unknown users, uses "sql injection" in the rbs_banners table appending malware script in the field "text"

there are vulnerabilities to be corrected?
Can you help me ?

Thank you
Sandro
vbulletin: 3.8.9 Patch Level 1
PHP: 5.3.8
MYSQL: 5.5.16

[Bulent Tekcan]

Hello

My banner images on my server. How can I put local link without www like /banner/sample.gif ? My other problem is start and end date always change when I edit any banners,why ?

Regards

[y2ksw]

Originally Posted by s_cocis

Hi y2ksw ,

from some days, an unknown users, uses "sql injection" in the rbs_banners table appending malware script in the field "text"

there are vulnerabilities to be corrected?
Can you help me ?

Thank you
Sandro
vbulletin: 3.8.9 Patch Level 1
PHP: 5.3.8
MYSQL: 5.5.16

Everything is correctly escaped, but if some malicious software has access to your forum, it can do what it wants.

The most recent WORM attacks write directly to the plugin cache and are untraceable through the plugin list. The real problem however are one or more scripts which have been introduced to your system or site, which can be called from attackers at will.

I have solved the problem with a dedicated server and strict rules: 1 forum administrator, 1 system operator, secure Apache build (no fast_cgi etc) with security modules enabled, binding and local security rules for PHP (open_basedir, upload_tmp_dir to dedicated folders for each site), and, last not least, fail2ban against insisting hackers.

To clean a broken system, practice has revealed that downloading all scripts and passing them through Avast helps to find all hacked scripts and intruders, while printing styles, plugins and cache tables help to find already injected code.

All together it takes 10-20 minutes to clean an infected system, but unless then, everything is "mayhem".

[y2ksw]

Originally Posted by Bulent Tekcan

Hello

My banner images on my server. How can I put local link without www like /banner/sample.gif ? My other problem is start and end date always change when I edit any banners,why ?

Regards

You can use the "Text" field in order to use HTML, if the standard does not fit your needs.

Start and end dates may change on edit depending on your server settings and some time setting discrepancies between the system server and mysql server. I don't know the exact reason, but some servers work flawlessly while others do cause even irregular time skips, such as 1 hour and 42 minutes. It might be a missing or defective time synchronization between both.

[Bulent Tekcan]

Originally Posted by y2ksw

You can use the "Text" field in order to use HTML, if the standard does not fit your needs.

Start and end dates may change on edit depending on your server settings and some time setting discrepancies between the system server and mysql server. I don't know the exact reason, but some servers work flawlessly while others do cause even irregular time skips, such as 1 hour and 42 minutes. It might be a missing or defective time synchronization between both.

Thanks for your reply Is it possible to show all banner stats in one clear table in admin cp ?

Regards

[y2ksw]

Originally Posted by Bulent Tekcan

Thanks for your reply Is it possible to show all banner stats in one clear table in admin cp ?

Regards

The full statistics are available only at the database level and require some additional work (queries or scripts). It has worked out that in the end, even the single banner statistics were too detailed to most of the users, and the banner lists were just the statistics everybody needed.

[Bulent Tekcan]

Hi Again,

I'm sure some time problem in this product. When I enter any start or end time for example

Start : 23 Sep 2016 17:00
End : 25 Sep 2016 15:00

And save this and enter again same banner time seems like that

Start: 24 Sep 2016 03:00
End: 26 Sep 2016 01:00

+10 hours different when I enter again. Our server time is sync and mysql also sync with same clock. And never seen before similar problem. My forum version is 4.2.3

Here is my server result

root@ [~]# date
Thu Sep 29 20:24:25 EEST 2016

root@ [~]# mysql -e "SELECT NOW();"
+---------------------+
| NOW() |
+---------------------+
| 2016-09-29 20:24:30 |
+---------------------+

Any idea ? Because I never see any problem before other software or plugin etc.

[y2ksw]

Originally Posted by Bulent Tekcan

Hi Again,

I'm sure some time problem in this product. When I enter any start or end time for example

Start : 23 Sep 2016 17:00
End : 25 Sep 2016 15:00

And save this and enter again same banner time seems like that

Start: 24 Sep 2016 03:00
End: 26 Sep 2016 01:00

+10 hours different when I enter again. Our server time is sync and mysql also sync with same clock. And never seen before similar problem. My forum version is 4.2.3

Here is my server result

root@ [~]# date
Thu Sep 29 20:24:25 EEST 2016

root@ [~]# mysql -e "SELECT NOW();"
+---------------------+
| NOW() |
+---------------------+
| 2016-09-29 20:24:30 |
+---------------------+


Any idea ? Because I never see any problem before other software or plugin etc.

I have no solution for this problem.

[Bulent Tekcan]

Originally Posted by y2ksw

I have no solution for this problem.

Who know ? Because time read is wrong, when I edit banner time get wrong and I forgot sometimes correction again. This is bug

[y2ksw]

Originally Posted by Bulent Tekcan

Who know ? Because time read is wrong, when I edit banner time get wrong and I forgot sometimes correction again. This is bug

It is not a blocking bug. It is an annoyance to which there is no real solution, because there are many server settings and there is no such thing as a "right" setup.

The queries you made in order to find out, are relative to the user account. If you query the system time of your server, you can only rely upon UTC.

# date -u
Fri Sep 30 13:05:50 UTC 2016
# date
Fri Sep 30 15:05:56 CEST 2016

Similarily, the mysql server time relies upon the settings of the server and your timezone settings for that mysql server, which may or may not differ. Thus, a mysql query

SELECT NOW();

may or may not show the current date and time. If you have a 10 hours offset each time you save, then you have probably a largely different UTC time compared to your "user" time.

mysql> SELECT NOW(), UTC_TIMESTAMP();
+---------------------+---------------------+
| NOW()               | UTC_TIMESTAMP()     |
+---------------------+---------------------+
| 2016-09-30 15:11:51 | 2016-09-30 13:11:51 |
+---------------------+---------------------+
1 row in set (0.00 sec)