Top 'X' Stats

[high]Security Fix: The uploaded version fixes all issues concerned with the recent security vulnerabilities. Sorry I haven't been around I don't really do anything plugin wise anymore.[/high]

Oh this version also works with all current version of vB 3.6. So feel free to use it on that version.

- InfiniteWebby

The low down

Well this is the vB 3.5.0 version of my hack. It is much the same as the original except that for some added stuff that I never released

Basically what it does is show the Top 'X' (edited via the vBulletin options in the admincp) newest members, top posters and newest replies on the Forumhome.

So what's new in this version?

Well for one all settings, which include amount of stats to show on forumhome and the extended page, thread title and username truncation, excluded forums and 'new' and 'old' thread prefixes.

Secondly there is now an extra page where you are able to choose exactly how many stats to show.

And lastly and most importantly it only takes 3 simple steps to install =)

What's on the horizon?

- More "stat blocks" including top reputation and top thread based on views or replies. If you have a suggestion please let me know, prefferably via pm.
- Proper can view other users threads permissions. At the moment I cannot think of how to block other people threads while still showing your own without totally re-writing the hack =(.

Version 1.2.1 is a re-release with who's online additions as well as some template changes. So you are best to reinstall the whole thing all over again.

So anyway enjoy and click install.

[redlabour]

And will it work in the Future with vBulletin 3.6 ?

[RFViet]

My forum has adult section, I'd like to display forum name too, how do i do that ???

[peterska2]

works on 3.6 but requires one additional phrase

Phrasetype: GLOBAL
Product: TopXStats
varname: member
Text: Member

[shoupz]

just installed it, loving it!

[murph5]

Loving this, but just one problem i have noticed... if a forum is set to moderate threads before allowing them to go live, these pre-moderated threads still show up in the list to guests/members etc. When they click on the link they get "invalid thread". Is there a way to restrict pre-moderated threads from shoing in the list?

[DementedMindz]

what i think is funny is georgedd posted a fix for this so you cant execute arbitrary JavaScript code and the staff never shut this down cause of the exploit or even fixed it... for new users using this i would do these changes or you run the some serious risks

https://vborg.vbsupport.ru/showpost....&postcount=250

[Paul M]

Originally Posted by DementedMindz

what i think is funny is georgedd posted a fix for this so you cant execute arbitrary JavaScript code and the staff never shut this down cause of the exploit or even fixed it... for new users using this i would do these changes or you run the some serious risks

https://vborg.vbsupport.ru/showpost....&postcount=250

What I find funny is that people think we could possibly be aware of every single post, in every single hack.

If no one reports a problem then the chances are we will never know about it.

I will take a look at the posted fix and see if I can add it to the zip.

[Draygonia]

Paul M! Why did you remove it! I was just about to install

Exploit was found, I fixed mine, you all better do what demented says or reinstall the mod when the fix comes.

[Paul M]

Because I was applying the fix You can d/l it now.

[popowich]

A special e-mail should have gone out for this issue a long time ago!

Is there a similar feature that is more regularly maintained?

Are there any other known issues besides this post?

-Raymond

Originally Posted by georgedd

BTW, I've gone ahead and fixed the "non entity" bug I reported above. For those interested, inside topxstats.php (or edit directly in vbulletin control panel), find the lines:

		else
		{
			$getstats_thread[titletrimmed] = $getstats_thread[title];
		}
	}

and add beneath it one extra line:

		else
		{
			$getstats_thread[titletrimmed] = $getstats_thread[title];
		}
	}
	$getstats_thread[titletrimmed]=htmlspecialchars($getstats_thread[titletrimmed]);

Also, inside the template "topXstats_thread_bit", find:

title="<phrase 1="$getstats_thread[title]"

and change that to:

title="<phrase 1="$getstats_thread[titletrimmed]">

I highly recommend you implement the above changes or changes of your own. Otherwise, someone can execute arbitrary JavaScript code on your site just by entering as the title of a thread the script, such as:

<script>alert("hi")</script>