Attachments as files

Well after alot of time leaving it in the beta hacks forums without any problems, I'm now moving it to the Full Releases, I'm satisfied that there isn't any bugs that need to be addressed. Thanks to Jawelin he pointed out most of the mistakes through alot of his testing.
I've attached it as an installer file here, as it needs to make changes to the database. Two new rows to settings and a new column in the attachment table.

Scott

Updated some more

Note the > is missing off the bottom of the file after the ?, add it before trying to install

[Darren Evans]

PPN, this never got answered:

I manually deleted some files out of the attachments folder (per somone's suggestion) and now I have errors on thread pages. The links to the attachments still show up.

I take it I shouldn't have listened to the person who told me to delete the files. aranoid:

Can someone help me fix this?

[Scott MacVicar]

you have to delete the attachment like your normall would, clicking the edit button on that post then in the attachment area and select Delete Attachment.

[Areku]

Originally posted by PPN
I'll probably be changing it to just the attachmentid number soon it will allow for much easier vB3 upgrades. I'll actually try to do it tonight.

Does this replies to my first question? Shall I asume there's no option to have real names in it?

What about the other 2 questions? Pleeeeez!

[Scott MacVicar]

Will definately not having the attachment name, that would be a large security issue if you have the filename script.php which has

PHP Code:

<?

while (1=1) {
  require('http://url.com/attachment/script.php');
}?>

which would cause a loop to keep including itself and hence crash the server or other various things.

vBulletin 3 uses the attachment id as the filename, so that seems the most sensible thing to do.

Also the visible thing was actually a bug that was corrected so you should just leave it in.

[Freddie Bingham]

Actually, it uses the postid since attachmentid has been dropped from the attachment table.

[Areku]

OK i'm getting lost now...

I applied the hack to vb 2.2.0 and after the whole process I get a bunch of unreadable .file files...

My idea was, that in the event of a db crash, I could still have a copy of the tools itself, with its own name. I don't know why the security issue... Why so? BEcause any1 could download stuff directly maybe? Or anything else I'm missing?

[Scott MacVicar]

they could execute scripts on your server is the main problem.

[Areku]

Ok my initial request was to have some sort of way to have the original files extracted from the vB DB so I can back them up with their original names. Is there any workaround to this?

[linesider]

Originally posted by sdenvers
Two problems encountered on 2.2.6 trying to install this hack:

1. It said I'd already installed it, but I haven't.
2. During import it gives this error for each file, and the attachments directory is left empty:

"Warning: fwrite(): supplied argument is not a valid File-Handle resource in /home/xxx.com/html/forums/admin/attachment_install.php on line 333

Imported car_wash.jpg"


Help!

I've had a simlar promlem with (on vB 2.2.8) #2 as sdenvers:

Warning fwrite(): supplied argument is not a valid File-Handle resource in /home/yadayada/www/public_html/vbulletin/admin/attachment_install.php on line 333 /

Imported this old.jpg

On the top of the attachment_install.php pages I see this after the edited files are uploaded. I've redone all the files several times and tripple checked the functions.php at 1806
Parse error: parse error in /home/lineside/public_html/vbulletin/admin/functions.php on line 1806

Thanks :btu: ...

[Areku]

Weird error I get at random doing different things on vB2.2.0.

Last time I was able to catch it:

I was deleting a thread on a forum that requires prevalidation from the admin control panel. I noticed the error right after pressing the submit button:

Warning: Unlink failed (No such file or directory) in /usr/local/etc/httpd/...path.../forums/admin/functions.php on line 1781

Deleted thread: 3733

Then, surfing functions.php, line with the problem is:

unlink($path);

of the following routine:

PHP Code:

// ###################### Start removeattachment #######################
function removeattachment ($attachmentid) {
  global $DB_site,$attachpath;
  $fileinfo = $DB_site->query_first("SELECT attachmentid, hash FROM attachment WHERE attachmentid='$attachmentid'");
  $path = "$attachpath/$fileinfo[hash].file";
  unlink($path);
} 


What's going on? I've seen the error appearing at random while using the forums, but haven't been able to capture it until today.

Thanks!