[AJAX] vBShout v2.0

[high]Staff Edit/Update[/high]

I have released an updated version of this hack (version 2.0.1), this version fixes some security issues with this hack. All version prior to this one allow users to insert html in their shouts, this can cause problems with them using html that breaks the site layout or malicious javascript. Download the new zip file (vBshout_fixed.zip) and upload the new vbshout.php file to patch/upgrade. If you want to manual instructions they are in the zip file, in the file bugfixes.txt

Second Staff update

I've uploaded a new version of this hack, dubbed '2.0.2'. This one should fix the html injection issues without breaking special characters. To upgrade, download the new zip file and upload the new vbshout.php file.

Please note that this only fixes the html injection issues. I do not use this hack on my own forum (although I've tested this on a client's board) so I will not be fixing the server load issues. I suggest you do not install this hack if you can't deal with the extra server load, as it's rather intensive.

- Brad

[high]End staff edit[/high]

Well, been a while since I've been to vb.org and released anything, thought i'd break the trend and whip up something quick while I have a little spare time.

A shoutbox as you would assume, a very simple one to start off with, but does include AJAX Technology, which pushes the shoutbox 1 step closer to live, messages from other people will appear with no refreshing, and so will yours that you post

A preview is below, i'd estimate a 50 second installation max

Primary Features:
- AJAX Technology (no refreshing)
- Administration control an display element options
- Fast format editor

Change Log::

- v1.1:
WOL (Who's Online) Correction

- v1.2:
New Posting Featurs (Bold/Italic/Underline/Colour/Font)
Admin Controls

- Change location/position of shoutbox
- Change number of shouts displayed
- Switch vbcode/similes on/off

- v1.3
Firefox javascript issue fixed
New Admin Controls

- Command Activation
- Swtch extra format options on/off
- Change position of editor (above/below messages)

New Commands

- /prune (Clears the shoutbox completely)
- /prune [username] (Clears all shouts posted by specified user)

- v1.4
Usergroup HTML Markup For Usernames
Clear Editor Button
Emoticons Pop Up Menu
Time display configurated to vBulletin settings
Username Links To Profile
New Admin Conrols

New vBShout Position (Directly Above Forums)
Banned Users
Banned Usergroups
Banned Permissions
Smilie Pop-Up Box Height
Smilie Pop-Up Box Width

New Commands

"/me" - Action message (all users are able to use this command)
/pruneshout [shout] - Deletes a single shout

- v1.5
Improved Smilies Display
XHTML 1.0 Transitional Valid (couple of errors fixed)
New Admin Options

Shoutbox Height
Smilies To Show
Shout Messages Order
Banned Permissions (fixed)

- v1.6
Bug Fixes:

- Unable to delete shouts that used /me command fixed
- Shouts being displayed from bottom-upwards only showed first 20 shouts

Automatically parses URL's

- v2.0
New Archive

- Displays shouts and pages
- Stats and top 10 shouters
- AJAX Edit/Delete (staff can edit/delete all shouts)

Enjoy,

- Zero Tolerance

[lierduh]

Originally Posted by Brad

If you are one of the people having issues with the last fix I posted, try using the attached file instead. Let me know if this one works or not.

PHP Code:

function bbcodeparser($text = '', $striphtml = true)
{
    global $vbulletin;

    if ($vbulletin->options['shout_bbcode'])
    {
        return $vbulletin->vbshout_parse->parse(convert_url_to_bbcode($text), 'nonforum');
    }
    else
    {
        return $text;
    }

    if ($striphtml)
    {
        $text = htmlspecialchars_uni($text);
    }
} 


Have not checked the rest of the script you attached, but what is the purpose of the last bit?

	if ($striphtml)
	{
		$text = htmlspecialchars_uni($text);
	}

I thought the latest version is supposed to filter out html tags to avoid java script inject. Your code seems on the surface to bypass the fix?

[lierduh]

A better way to handle html inject will be:

PHP Code:

function bbcodeparser($text = '', $striphtml = true)
{
        global $vbulletin;

        if ($vbulletin->options['shout_bbcode'])
        {
                if ($striphtml)
                {
                        $vbulletin->options['allowhtml'] = false;
                }

                return $vbulletin->vbshout_parse->parse(convert_url_to_bbcode($text), 'nonforum');
        }
        else
        {   
                if ($striphtml)
                {
                        $text = htmlspecialchars_uni($text); 
                }
                return $text;
        }
} 


$vbulletin->options['allowhtml']

Defaults to off when bbcode is used. That is why everyone is getting the > etc. using the latest version.

Basically if one uses bbcode in the shouter. That is no need to worry about html inject because bbcode parser will handle special html tags by default.

[Zelda-King]

There appears to be a bug with speech marks. " is replaced with "

Tested on vB 3.5.4
Using the vBShout fixed v3 zip.

[Hemanth]

Hi,

How many shouts will be stored in database?

I'm using it over a few months. Is all the shouts so far'll be in the DB or it'll be cleared?

[Zelda-King]

They're all saved until you prune them.

[Zweeper]

Can please help me somebody with a function that cut long words??
look @ attachment

[furst]

Any way to get the ignore list to work with this?

[lucky64]

Still hoping on figuring out why it doesn't show the last shout when reloading the page just jumps to the middle.

Originally Posted by kafi

I couldn't find this yet here>

I would like to show VBShout only with specific forum.

1. please can u give me conditional and where to place it?
2. this would be good to have in admin area for flexible use.
3. or is there a way to do it otherway already?

Thank you!

Was anone successful in getting it to appear in a specific forum either?

[TwTom]

I'm just getting 'loading' at the bottom of the board's main page. :-(

http://www.twolvescentral.com

[Sn!per101]

As an update to my other post about the WOL showing everyone on the forum index as "viewing the shoutbox" I believe it is not because of a newer apache but because of PHP 5 that I now have on my new hosting. My old hosting had PHP 3. So if you could please make this extention PHP 5 comptable to fix that bug I would appreciate it. Thank you.