Administrative and Maintenance Tools - Private Messages & Email Log

Port of vb.3.8 version

Features:

1. Log all PM and Emails, sent via forum forms.
2. Keep logs in separate table with automatic rotation of old records.
3. Add new menu items in topics and profiles for fast access.
4. Have nice dynamic menus in search results for cross-searches
5. Managed access for administrators (except superadmins)

How to install

1. Upload files to your server
2. Import product xml
3. Go to ACP
4. Select required settings in ?Vbulletin options → Private Message Log?
5. Set access ?Can view PM logs? to necessary members in ?Usergroups → Administator Permissions?. Super administrators can be skipped.

Notes:

This mod uses full scan for text searches, that can affect SQL-server load at really big boards. Fulltext indexes are not used intentionally, because whose can't produce sharp results and not compatible with innodb. I suppose, that if you really need this mod, you know exactly, what are you doing and what are you going to search. In my practice, ONLY exact matches were useful.

One of tradeoff to reduce SQL-server load ? make log size shorter (1-2 months instead of 6). When vB 4.0 provides refactored search framework, search method can be rewritten.

If you install this mod on your server, i recommend to clarify forum rules, and add text, that your project doesn't provide the ways of confidential communication ? only public and non public.

This mod is developped here http://github.com/rcdesign/vb-pm_log . Patches are welcome.

history

3.1
- fixed specialchars in SQL search request. Thanks to mplode

3.0
- refactoring + some fixes
- separate fields for nick & text in search form

2.5
- ported to vb4
...

2.2
- Redesigned database to improve search/paging in some cases
- Should fix conflicts with other mods, that where reported in this threads
- Sources repo is now @ github

... (not public)

1.9
- Ups... another broken link (from message list to user profiles)
- Fixed access for non superadmins, who had "Read PM Log" privilegies.

1.8
- fixed broken link in ACP popup menu
- workaround to show smiles and bbcodes

1.7
- fixed some sql-error

1.6
- first public release

[Vitaly]

TimesOut, Britmovies,

Checks, that you have uploaded source files to server, and set ptoper permission. That file exists in archive.

[Paul.]

Since it has been updated after I installed it, is it necessary to download and replace all the files again? Is that how you do it? Download it again as if you never had it and let it replace what is there already?

[Vitaly]

Yes, all files have been changed. You have to reupload all (override old ones, if any).

[mplode]

Invalid SQL:

SELECT DISTINCT  COUNT(cr.logid) AS count
               FROM((SELECT
                       pm.logid AS logid
                   FROM
                       rcd_log_pm AS pm
                   WHERE
                fromusername = 'Qui's World' ) UNION (SELECT
                       pm.logid AS logid
                   FROM
                       rcd_log_pm AS pm
                   WHERE
                tousername = 'Qui's World' )) AS cr;

Got a bit of an SQL injection going there. Might want to fix that.

edit: two actually. You need to sanitize $user_name

Additionally, there's XSS on the search fields. You need to sanitize those for HTML usage as well. And everywhere where it lists usernames.

[Vitaly]

Try the latest version frim github

https://github.com/shkuropat/vb-pm_log

Updated nick escapeing.

[mplode]

Thanks for the quick response! I have some remarks, however.

Why are you applying htmlspecialchars_uni() to the usernames before using them in the query? That should be unnecessary and in fact will probably cause problems with users who have <>& or similar signs in their usernames. $db->escape_string() should be enough there.

    print_input_row($vbphrase['username'], 'username', $user_name, false);
    print_input_row($vbphrase['keywords'], 'keywords', $search_keywords, false);

in these lines, you have not yet sanitized the HTML on the other hand;

    print_input_row($vbphrase['username'], 'username', htmlspecialchars_uni($user_name), false);
    print_input_row($vbphrase['keywords'], 'keywords', htmlspecialchars_uni($search_keywords), false);

And I think you need to sanitize the username in the search results etc. as well. In case someone has a username like "<script>alert(1)</script>" or "<!--" or something.

[Vitaly]

You could check on real data fist. Nicks in db are html-escaped.

[mplode]

Ah. Yeah, I wasn't too sure about that one.

[RedHacker]

Fatal error: Call to undefined function rcd_pm_log_CacheTemplates() in /home/xxxxxxx/public_html/includes/class_bootstrap.php(1312) : eval()'d code on line 363

I cant use anything with update

[Vitaly]

Updated version to fix bug with SQL, reported by mplode.