Go Back   vb.org Archive > vBulletin Modifications > Archive > vB.org Archives > vBulletin 2.x > vBulletin 2.x Beta Releases
FAQ Community Calendar Today's Posts Search

Closed Thread
 
Thread Tools
Details »»

Version: 1.00, by Scott MacVicar Scott MacVicar is offline
Developer Last Online: Mar 2016 Show Printable Version Email this Page

Version: 2.2.x Rating:
Released: 01-20-2002 Last Update: Never Installs: 12
Is in Beta Stage  
No support by the author.

This is a hack which allows you to save the attachments as files and not within the database. The main problem with this was the fact that it posed certain security issues, these have been tackled by doing the following
  • Placing the folder below document root
  • Using random hashes to name the file
  • Changing the file extension to .file
  • Never divulging the path to the file

This is a beta hack, it has been tested on a development board. I have had insufficent time to fully complete the attachment importer, this removes the files from the database and creates them as physical files in the attachment folder. I will post this as soon as possible.

Looking forward to your feedback.

Scott

To install this hack upload this file to the admin directory and then view it in your browser.

All the changes that Jawelin suggested have been applied, thanks man

Show Your Support

  • This modification may not be copied, reproduced or published elsewhere without author's permission.

Comments
  #52  
Old 02-01-2002, 11:06 AM
Jawelin Jawelin is offline
 
Join Date: Nov 2001
Posts: 557
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

I have a LOT of problems with the importer. :cry: :cry:
First of all, in attachment_install.php there's the line:
PHP Code:
$DB_site->query("UPDATE attachment SET hash='$hash'"); 
which updates at once ALL THE table, not only the fetched row.
I think that query should be added of WHERE attachmentid='$files[attachmentid]' ...
Do you agree ?

Second, each file I get the error
Quote:
Warning: Supplied argument is not a valid File-Handle resource in /home/...... /admin/attachment_install.php on line 330
I have about 70 files. What should be the right per-number to insert ?

Last, I saw fortunately the importer doesn't delete the filedata from the table. Should I do manually after a successful export ?

Thanks a lot.
Hope in your quick answer.
Bye
  #53  
Old 02-01-2002, 12:42 PM
Jawelin Jawelin is offline
 
Join Date: Nov 2001
Posts: 557
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Besides, the directory couldn't be chmoded to 0666 as no file could be red or written.
I think should be better CHMOD 0777 attachments directory and replace in admin/functions.php:
PHP Code:
    move_uploaded_file($attachment"$path"); 
with:
PHP Code:
    move_uploaded_file($attachment"$path");
    
chmod ("$path"0666); 
Infact, otherwise any uploaded file should have 0755, i.e. executabe but not deletable.

What do you think ?
Thanks
  #54  
Old 02-01-2002, 01:44 PM
Jawelin Jawelin is offline
 
Join Date: Nov 2001
Posts: 557
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Another slight question.
editpost.php?action=deletepost :
if the post contains an attachment, the row into db is deleted, not the file as itsn't explicitly called your removeattachment() function.

Solution:
In admin/functions.php add :
PHP Code:
removeattachment($postinfo[attachmentid]); 
just before the line:
PHP Code:
$DB_site->query("DELETE FROM attachment WHERE attachmentid=$postinfo[attachmentid]"); 
Thanks.
Bye
  #55  
Old 02-01-2002, 03:32 PM
Scott MacVicar Scott MacVicar is offline
 
Join Date: Oct 2001
Location: Glasgow, Scotland
Posts: 1,199
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

i'll look into this tonight and go over the importer again.
  #56  
Old 02-01-2002, 06:07 PM
Scott MacVicar Scott MacVicar is offline
 
Join Date: Oct 2001
Location: Glasgow, Scotland
Posts: 1,199
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

At most the files should be 0666 never chmod a file to 777 or 755. As they should never require to be executed.

I've installed this on my boards without any problems with attachments. The importer has been updated to correct the has problem. Regarding your file problem I would try to ensure that your directory is chmod'd to 666 and that is set correctly within the admin panel.

Thanks for pointing out the missing delete from attachment part with the deletepost, I have updated the installer.

If I remember correctly though the file will automatically have permissions to read and thats all you need as it only reads the files and it deletes it using the unlink function.
  #57  
Old 02-01-2002, 08:49 PM
Jawelin Jawelin is offline
 
Join Date: Nov 2001
Posts: 557
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

I tried many and many times (Linux shared server....)

both /home/user/public_html/attachment & /home/user/attachment ...
The only way I don't get an error downloading or uploading attachment is that dir chmoded to 0777.
Because the user owns the files is 'nobody', who otherwise couldn't access the directory itself, if not executable.
This way, the uploaded file moved from /tmp to here is moded to 0755. So to make it not executable, i changed permissions within php code, right after the move_uploaded...., to 0666 (tried 0644 but the file couldn't deletable, as not writable...)

Now it works to me, only this way, on that linux server ...
Thnx
  #58  
Old 02-01-2002, 11:40 PM
Scott MacVicar Scott MacVicar is offline
 
Join Date: Oct 2001
Location: Glasgow, Scotland
Posts: 1,199
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

i suppose i can make those modifications to the files.

I tested the script without the permission modifications on a Win2k and a linux server though i was running it under root.

Will do the final modifications you suggested then ponder moving it into the full releases.
  #59  
Old 02-02-2002, 02:41 PM
Ninth Dimension's Avatar
Ninth Dimension Ninth Dimension is offline
 
Join Date: Oct 2001
Location: London, England.
Posts: 739
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Hi, I just wanted to check the latest on this hack, is the file on the front page of this thread the latest verson, and if not, would you be able to upload a more up to date verson please?

I'm desprate to use this hack because although i've got lots of HHD memory available, i've only got 20MB is MySQL space (and the forum is already taking up 10MB's of that space.

Please let me know, thank you
  #60  
Old 02-02-2002, 04:06 PM
Ninth Dimension's Avatar
Ninth Dimension Ninth Dimension is offline
 
Join Date: Oct 2001
Location: London, England.
Posts: 739
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

I have just installed this hack, however i'm getting some errors, first off I tried the importer and got a page full of errors, like this:
Quote:
Warning: Supplied argument is not a valid File-Handle resource in /hsphere/local/home/ofdan/bbs.ofdan.net/admin/attachment_install.php on line 332

Imported pool1.jpg


Warning: Supplied argument is not a valid File-Handle resource in /hsphere/local/home/ofdan/bbs.ofdan.net/admin/attachment_install.php on line 332

Imported diablo.gif


Warning: Supplied argument is not a valid File-Handle resource in /hsphere/local/home/ofdan/bbs.ofdan.net/admin/attachment_install.php on line 332

Imported cap_026.jpg
Ignoring this for a moment I then tested uploading a file, and got this error
Quote:
Warning: Unable to create '/hsphere/local/home/ofdan/bbs.ofdan.net.attachments/4b7be3dffed063f1b35f072d3f5dfecf.file': Permission denied in /hsphere/local/home/ofdan/bbs.ofdan.net/admin/functions.php on line 1681

Warning: Unable to move '/tmp/phpKqRzkG' to '/hsphere/local/home/ofdan/bbs.ofdan.net.attachments/4b7be3dffed063f1b35f072d3f5dfecf.file' in /hsphere/local/home/ofdan/bbs.ofdan.net/admin/functions.php on line 1681

Warning: stat failed for /hsphere/local/home/ofdan/bbs.ofdan.net.attachments/4b7be3dffed063f1b35f072d3f5dfecf.file (errno=13 - Permission denied) in /hsphere/local/home/ofdan/bbs.ofdan.net/admin/functions.php on line 1684
  #61  
Old 02-02-2002, 05:32 PM
Ninth Dimension's Avatar
Ninth Dimension Ninth Dimension is offline
 
Join Date: Oct 2001
Location: London, England.
Posts: 739
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Problem number 2, I think i've solved my first problem, i've chmod'd my attachments dir to 777 (when i done it to 666, it prevented me form accessing it), and this allowed me to upload the attachments without a problem.

Now i can't download them again, I get the following error:
Quote:
Warning: Unexpected character in input: '\' (ASCII=92) state=1 in /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php on line 30

Warning: Cannot add header information - headers already sent by (output started at /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php:30) in /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php on line 58

Warning: Cannot add header information - headers already sent by (output started at /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php:30) in /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php on line 59

Warning: Cannot add header information - headers already sent by (output started at /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php:30) in /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php on line 60

Warning: Cannot add header information - headers already sent by (output started at /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php:30) in /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php on line 61

Warning: Cannot add header information - headers already sent by (output started at /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php:30) in /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php on line 62

Warning: Cannot add header information - headers already sent by (output started at /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php:30) in /hsphere/local/home/ofdan/bbs.ofdan.net/attachment.php on line 66
GIF89a?JJcJJkRRkZZscc{kk?kk?kk?ss?{{?{{????????? ???ƥ????έ?ƭ?έ?ֵ????ֵ?޽?ֽ?????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ????????????????????????,?H? A?4d? ??†f?` Z܈????&X?$? J?4?r?H"??P0?̂&x0sÆ @????gМ ?,?S Q?M%T ?'JU?BX?V?(?VE?? ?D?? ??= @?ݹ(?68A??=??/???? 0`?ǎ#Cf?? ??;
Closed Thread


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 02:40 PM.


Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.04981 seconds
  • Memory Usage 2,322KB
  • Queries Executed 25 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (5)bbcode_php
  • (4)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)modsystem_post
  • (1)navbar
  • (6)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (4)pagenav_pagelink
  • (11)post_thanks_box
  • (11)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (11)post_thanks_postbit_info
  • (10)postbit
  • (11)postbit_onlinestatus
  • (11)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 

Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete