vB Journal for vBulletin 3.0.3(v1.0.1)

vB Journal v1.0.1
By Antonbomb22(Anthony Scudese)

vB Journal 1.5 Beta 1 is now available, click here.

Features:

• Full vBulletin 3.0.3 intergration
• Install file for SQL queries
• Comment System
• "GoToMyJournal"
• link from postbit to journal
• link from profile to journal
• link from memberlist to journal
• usergroup permissions
• journal buddy system(by Wonko)
• Journal Search Engine
• journal highlight
• bbcode parsing
• smilie parsing
• Admin Cp Support Section
• Journal Status Icons
• Who is viewing
• most recent journal entries and journals
• Who Can View for journals and entries
• Complete journal and entry privacy
• Comment on entries or journals
• Journal Moderation(Like Post and Thread Moderation)
• Entry Moderation(Like Post and Thread Moderation)
• Pagination
• Rating System
• Lock System
• Moods
• "Can Have Journal" on a per user basis
• Ip Logging
• Journalists can name their journals
• Export entries in TXT or XML format
• Flood System
• Administrators have absolute permissions
• Search in Journal
• Last Entry on Journal Index
• Numerous AdminCp Settings
• Unique Standard vB Images for vB Journal
• View Single Entry
• and so much more...

Version 1.0.1:

• Many parts of vB Journal 1.0.0 were rewritten to cap security holes lurking within the code.

Features for later versions:

• journalists can specify colors for their journal
• attachments
• subscriptions
• journal moderators
• report system
• more administration options
• complete phrasing

Demos:

• http://www.animationation.net/community/journal.php
• http://www.wellage.net/journal.php

Add-Ons(I Will not give support for these because i did not create them):

• vBadvanced CMPS Latest Journal Entries Block
• vBindex Latest Journal Entries Block
• RSS 1.0 for vB Journal 1.0.0

Side Credits:

• Journal Buddy System ~ WonkotheSane
• Closed Beta Tester ~ Pitman
• Closed Beta Tester ~ DantX
• Helpful Person ~ Oblivion Knight

And to all those who helped me find my mistakes and encourage me

Notes:

• The WOL(Who's Online) is not yet finished but will be released shortly due to some bugs and flaws
• You may not remove the copyright notice!
• An import script for Ryangle's ported Journal will be made so dont install this hack for now if you have the vb3 port of Ryangle's

Support:
~READ FIRST POST COMPLETELY BEFORE POSTING PROBLEMS AND MAKE SURE YOU DID ALL EDITS AND REQUIREMENTS!~

Support may be denied if provided files are edited/modified and support may be stopped at any time due to any circumstances.

If you should run into any errors, problems, confusion, or maybe even a suggestion please
foward them to one of the following places:

• Official vB Journal Support&Suggestion Forum
• AIM: Antonbomb22
• Email: antonbomb22@animationation.net
• Or this thread

Contents of Zip:

• install.txt
• journal.php
• journaladmin.php
• journalinstall.php
• images

I have also provided several screenshots

Please click install

If you are missing phrases or blank spaces in the usergroup manager click here.

Updates/Fixes:

• Updated zip and journalinstall.php due to a typo(click here for fix:https://vborg.vbsupport.ru/showpost....9&postcount=11)
• fixed a missing " in install.txt, it doesnt cause an error but its a fix (Click here for fix: https://vborg.vbsupport.ru/showpost....8&postcount=16)
• updated zip and journal.php, fixed sql queries that caused problems(Click here for fix: https://vborg.vbsupport.ru/showpost....4&postcount=25)
• fixed a type in journal.php, zip and file updated(Click here for fix:https://vborg.vbsupport.ru/showpost....4&postcount=31)
• updated zip,updated journalinstall.php, and uploaded phrasefix.php to fix the usergroup phrase problem(click here for fix: https://vborg.vbsupport.ru/showpost....9&postcount=36)(09/16/04)
• for those who may be experiencing problems due to conflicts with the articles hack follow these following changes: https://vborg.vbsupport.ru/showpost....&postcount=114(09/18/04)
• for those experiencing blanks or missing descriptions for usergroup permissions use this fix until further notice(for /admincp/usergroup.php): https://vborg.vbsupport.ru/showpost....8&postcount=56(09/18/04)
• updated zip and journal.php for more compatiability with vb and more likeness with vb (use the following fix: https://vborg.vbsupport.ru/showpost....&postcount=120)(09/18/04)
• updated zip and install.txt due to a mistake in functions.php file edit(use the following fix: https://vborg.vbsupport.ru/showpost....&postcount=122)(09/18/04)
• updated zip and journaladmin.php for moderate entries due to an sql error(use this fix: https://vborg.vbsupport.ru/showpost....&postcount=130)(09/19/04)
• updated zip and journal.php for beefed up privacy in journals and their entries(use this fix: https://vborg.vbsupport.ru/showpost....&postcount=292)(10/04/04)
• update zip and journal.php, this fix fixes the permission troubles and mood problems occuring( https://vborg.vbsupport.ru/showpost....&postcount=391)(10/23/04)
• updated zip and journal.php, this fix will provide a new update system which hopefully weeds out any potential problems!(https://vborg.vbsupport.ru/showpost....&postcount=574)(11/17/04)
• updated zip and journal.php, fixing some guest loop holes(https://vborg.vbsupport.ru/showpost....&postcount=645)(12/13/04)
• updated zip and journal.php, fixes possible sql injection problem(https://vborg.vbsupport.ru/showpost....&postcount=902)(3/12/05)
• updated zip and journal.php, fixes LEFT JOIN typo(https://vborg.vbsupport.ru/showpost....&postcount=948)(3/23/05)
• vB Journal Upgraded to v.1.0.1 with many security holes patched.(7/1/05)
• Security Update: a XSS vulnerability was found within journal.php, to patch this see this post, the zip has been updated as well.(9/23/05)

[AN-net]

Originally Posted by fechten

Any way to allow for a user to create multiple journals?

For my site some users want to have 2 journals: one for general thoughts and one to act as a training log.

Thanks,
Craig

you have to change journalist_id from unique to not unique and edit a place in the code

[AN-net]

Originally Posted by Widebertha

Someone installed the vbulletin journal hack for me this past week. Is there an editor associated with the Journal that would allow members to change fonts and font colours, to post pictures, avatars and smilies into their entries? How does one go about posting links into your vbulletin Journal?

Thank you
Widebertha

these are done through bbcode there is no editor like the post at this time but bbcode can be used except html code.

[Widebertha]

Hi,

Thank you for your reply. Just wondering if there are any add-ons for vbulletin journal? Also wondering if I can do something in the administrative control panel so that all the journals on my website are public journals? How does one get moods and smilies for vb Journal?

Thank you,
Widebertha

[Andreas]

Urgent Security-Warning

This Hack has several severe XSS and SQL-Injection-Vulnerbilities.

The author has been informed since 2 weeks, but still hasn't fixed the remaining issues.
Therefore I strongly recommend to uninstall this hack in order to keep your Board secure.

[Paul M]

Originally Posted by KirbyDE

Urgent Security-Warning

This Hack has several severe XSS and SQL-Injection-Vulnerbilities.

The author has been informed since 2 weeks, but still hasn't fixed the remaining issues.
Therefore I strongly recommend to uninstall this hack in order to keep your Board secure.

Well thanks for broardcasting it to the whole world - TBH, you are not exactly being very helpful here are you ? - now every unsavory person who reads this bloody great message will be looking for exploits. Uninstalling it is not exactly an option so why don't you be a little more helpful and tell us how to fix it, I don't even know what an XSS vulnerability is.

[MajorFm.com]

Originally Posted by Paul M

Well thanks for broardcasting it to the whole world - TBH, you are not exactly being very helpful here are you ? - now every unsavory person who reads this bloody great message will be looking for exploits. Uninstalling it is not exactly an option so why don't you be a little more helpful and tell us how to fix it, I don't even know what an XSS vulnerability is.

I have to say the same, there are too many people using it to uninstall it... we appreciate the info but a pm might have been more of a option to the people who have clicked install... we need a fix asap...

[Pseudomizer]

Hey guys,

sorry but I do NOT agree with the last 2 postings. VB.org moderators have to warn their members about any possible impact. If this hack has serious problems then I would deinstall it by removing the journal.php file in the first instance.

I have the hack installed as well and the first thing I did was to remove the file.

In addition Kirby is not responsible to provide any fix for this hack. He is just informing you guys. So do not blame him for informing you because next time he will just sit back and relax to see you struggling with your hacked board. I agree with Kirby that if the author does not react on any message he should inform the people by posting into the appropriate thread and not send a PM. Because a PM will not have the same effect like his posting.

If I would be the hack author I would react on the posting rather then on a PM to all users.

Summary: Contact the author to create the pressure to fix the security issue(s) and THANK Kirby for informing us.

Cheers,

[Marco van Herwaarden]

As Kirby already mentioned, the author have been privatly informed about the vulnerabilities in more detail then this public post. He was given time to create a fix without mentioning the risks to public.

Since the risks still exist, it is our duty to inform the users of this hack of the risks. The choice to do this in the public thread was being made since not all that use the hack would have clicked install, and contacting in private would therefor be impossible.

[Paul M]

Originally Posted by MarcoH64

Since the risks still exist, it is our duty to inform the users of this hack of the risks. The choice to do this in the public thread was being made since not all that use the hack would have clicked install, and contacting in private would therefor be impossible.

Inform the users yes - but broadcasting it to every man and his dog when no sort of fix is available is irresposible as far as I am concerned.

One of the reasons we click on install is to allow updates to be sent, users should have been informed in this manner. If the author is unable / unwilling to fix the issues then another user may have been able, before it was made public. BTW - if people install it and don't click install as requested then that is really their fault, as a hack writer, I have little sympathy for them.

FYI - this is the second time this has been publically posted in this thread, not the first - and as I said last time - I need to know what the actual problems are since we run a "hacked" version of the hack - so just replacing it with whatever the author provides is not feasible anyway.

[Andreas]

@Paul M
Well, if only the users were informed then others (who might not have clicked Install or have not yet installed this) would not know.
And I think it's better to know that there are problems, instead of keeping them secret.
It's the same with for example Browser security issues: Once they are discovered, the developers are being informed.
After a while the information gets made public on Full Disclosure or smth. like this, so users are aware of the problem and can take apropriate action before a patch is available.
If they don't do - it'sd their fault
But leaving them uninformed increases the risk, as users wouldn't even know that there are problems.