[blissend]

I have updated our website in order to keep things well maintained/secure. There were a bunch of things that have been updated by me. The new features and changes are too big to list so I encased in spoiler tags. Please note that the new features listed doesn't mean I have enabled all of them. The list...

Board

Spoiler

Among many dozens of smaller bugs fixed and performance improvements, the following security enhancements were made:

• SQL and local file include issue fixed. Note: Due to protection within the SQL driver classes, it is very difficult to effectively exploit IP.Board using this attack. Also you need moderator permissions to perform any exploit. We've hardened this code regardless. Also, due to the input cleaning functions IP.Board uses, the local file include is limited to PHP files on the file system as the usual 'null byte' trick is ineffective.
• Internet Explorer XSS Issue due to incorrect attachment handling fixed.

Gallery

Spoiler

Friendly URLs
We've integrated gallery into the global FURL system used by IP.Board 3, this will allow gallery to create friendly URLs for categories, albums, and images.

Category/Album Covers
When viewing an image, you will have a new option to set that image as the 'cover' for the category or album that contains the image. When a cover image is specified for a category or album, that image will always be displayed, in place of the last uploaded image thumbnail.

Sub Albums
Albums now support unlimited sub albums, which work exactly like gallery sub categories.

Profile Picture Album
You can now create a new kind of album, a 'Profile Picture' Album. After this album has been created, any images that you upload to it will be displayed on the change picture page in your User CP, making them easy to select as your profile image.

Image notes
Image owners are now able to add notes to sections of their images, positioning and resizing them to suit. Other members will be able to see the notes when hovering over the image. (An example)

Image rotation
Images can now be rotated in 90° increments, to compensate for those photos taken in landscape or portrait, but saved in the wrong orientation.

New slideshow
We have completely rewritten the slideshow feature! It is now a unified interface, loading images on demand as necessary. Users can play or pause the slideshow at will, or jump to specific photos using the thumbnail bar.

Friends-only albums
When creating an album, users can now choose to restrict viewing to only those users who are on their friends list.

Reputation support in comments
We have added support for IP.Board's reputation feature in comments posted within IP.Gallery.

Interface tweaks
We have updated the style of categories so that larger versions of the image are used, to give more impact. The image listing has also been updated, and will now show as many images on a row as the users browser can fit. This should improve the display of IP.Gallery for users who have higher screen resolutions. The image view screen has also been improved, including support for those features mentioned above.

Downloads

Spoiler

Friendly URLs

Friendly URLs have been implemented into IP.Downloads starting with version 2.1.

Ability to shut off "Resume breakpoints"

Most download accelerator clients support downloading multiple pieces of a file simultaneously. While this means that the file can download faster for the user, it also means that you can have multiple connections open from one user downloading a single file. Beginning with IP.Downloads 2.1 you can disallow requests for individual file parts to help control the number of open connections to your server.

Download sessions

Beginning with IP.Downloads 2.1, you can enable functionality that will cause IP.Downloads to create a unique URL for each file download request. The URL will expire once used (or after 24 hours, whichever comes first), helping to prevent users from sharing direct download links to the files.

Global settings

IP.Downloads 2.1 will allow you to configure maximum file size and screenshot dimension settings globally, while still allowing you to override those settings on a per-category level should you need to. This can help simplify updates to your download manager configuration for these particular settings which are commonly configured the same across all categories.

Support for link "types"

When submitting screenshot and file links, you will now be able to select what type of link you are submitting. The link types are configurable in the ACP so administrators can add and alter link types to better suit their site.

Upload progress meter

Through integration with the flash uploader used for uploading attachments to IP.Board posts, the download manager now supports a true progress bar for all uploads (if the user is using the Flash uploader as specified in their user control panel).

One record, many files

To date, IP.Downloads was designed to allow you to submit one file at a time (and one screenshot, depending on the configuration). IP.Downloads 2.1 takes the next step and allows you to submit multiple files and multiple screenshots per record.

Interface updates

The interface for the download manager has been tweaked and updated to provide a more polished feel, while distinguishing the user interface from the rest of the board.

Blog

Spoiler

User Interface
The user interface has had a complete facelift to bring it up to standard. The new look feels more 'bloggish' and enhances the experience. We have added drop down menus at the top so that you can quickly access common areas and start new entries where you have permission to. The post screen has been overhauled to add functionality. You should find the new version much easier to navigate and easier to use.

Group Blogs
This is a new feature that allows you, the admin, to set up a group-wide blog. This blog is a normal blog in every other way. For example, you could set up a blog for your staff and everyone in the staff group will instantly be able to start writing new blog entries and managing comments, etc.

Blog This!
This is a brand new feature that adds a "Blog This" button to every post. This allows you to use post content in your blog entry. Furthermore, the relationship is remembered and all linked blog entries appear at the bottom of the topic when viewed.

Per-Entry Rating
You can now rate each blog entry rather than just the entire blog itself. The blog rating is still shown on the homepage as an aggregate of all rated entries.

Report Item and Reputation
You can now report an entire blog entry, or just a single comment. You can now also give someone a reputation increase/decrease in comments.

List View
A common request was the return of a fully sortable and filterable list view for blogs that emulated a forum view. We have added this in. You'll notice you can click the table headers to sort on that column and click again to reverse the sort. There is also a "List Blogs" sidebar block to quickly filter and list the blogs. There's even a little 'preview the latest entry' icon that shows the entry excerpt in a pop-up so you don't have to leave the page to preview it.

Dynamic Sidebar
We have moved some the footer links (Top 10 bloggers, etc) into a dynamic sidebar along with Recent Entries. This makes it easier to locate and saves a bit of space.

RSS Imports
Another long requested feature was to be able to create entries from an RSS feed. This is now a feature. You can control which member groups have access to this as well as limit the number of items imported on each cycle.

Banish Entries
You can now banish entries from the front page to remove any 'clutter' such as 'testing' blogs or other unsuitable content.

ACP Clean-up
We have gone through and cleaned up some of the Admin CP pages to make them a little easier to understand and navigate. We have added explanations to the 'Headers' / 'Dynamic Headers' pages so it's clear what they do.

Efficiency
We have removed several slow queries and introduced several more caching layers to substantially reduce SQL overhead when dealing with large numbers of blogs.

Shoutbox

Spoiler

Bug Fixes

* Can't Load Website - Fatal Error
* Missing Header, Footer and Statistics
* Bottom offset of sidebar too high
* More strings for "Shout"
* session id breaks the furl link
* "quick edit shout" not working for moderators
* Shouts made by guests contains an empty profile link
* Suspended Member
* Archive doesn't work
* emoticons are shown way up
* Blank screen on shoutbox refresh?

Tracker

Spoiler

Bug fixes (37 in total)

* Not all members recognized as members
* Daily Project Digest Empty
* Cannot search for special words?
* no template assigned
* Entity conversion in preview
* Uninstalled Tracker, Profil...
* Some reports not associatin...
* IP.T Version Display
* View More Logs by % member
* Remove Logs by % member
* JS error when deleting post.
* Setup: Field 'cat_reply...
* SQL error for project creation
* SQL: Add new moderator
* PHP Fatal error: Call to a...
* SQL: Incorrect integer val...
* missing image in ACP
* Error during install
* Missing </div> in t...
* Where have all the icons gone?
* Strict Standards in sql file
* var should be private,public, or ect.
* "Where can the BBCode be used?" and issue preview
* Public title in navigation
* Hard-coded language strings (part2)
* [Attachment] Max. single file
* [Attachment] Post Preview
* [Attachment] Space after help
* Fresh install fails
* DB error when moving issue or resync'ing project.
* DB error when changing status and posting quick reply.
* Fatal Error when editing an issue
* No FURL for Tracker in Online Users
* No FURL's in Navigation Trail
* No FURL's in RSS Feed
* IP Tracker Portal Plugin Problems
* Weekly Digest Not Working As Intended

Our awards system is unknown to me as I couldn't find a change log anywhere but its updated.

An official logo is looking like its finally coming to fruition. So a site theme will follow in its wake 8)

UPDATE: In order for the shoutbox to work for you, you will have to clear your browser cache unfortunately 8( Just google how to do so and you'll be good (temp link on how http://kb.iu.edu/data/ahic.html )

UPDATE2: I've finally figured out how to disable the need for moderators to approve every gallery comment. Geez this was a bitch to find. So if any admin sees an unapproved comment please approve it.

[evilwaffles]

Good job and thanks.

[ロリコン]

Very nice updates but looks like they broke one of the features of the blog extract (the limit of 2009 is fixed atleast too)

It allowed one to post like a summary or snippet that cuts off on the front page so that users had to click on the entry to see the rest. I'll also have to fix my css a little and clean it up too.


edit1: Looks like forums still aren't remembered properly as unread or read
edit2: Looks like you also can't edit a text box with the global-shoutbox active as the page refreshes. Who do they have to test this stuff

[Tails]

エッチ, on 26 January 2010 - 08:24 PM, said:

Very nice updates but looks like they broke one of the features of the blog extract (the limit of 2009 is fixed atleast too)

It allowed one to post like a summary or snippet that cuts off on the front page so that users had to click on the entry to see the rest. I'll also have to fix my css a little and clean it up too.


edit1: Looks like forums still aren't remembered properly as unread or read
edit2: Looks like you also can't edit a text box with the global-shoutbox active as the page refreshes. Who do they have to test this stuff

I heard you're good at finding holes.
rimshot.wav

[ロリコン]

Can't edit the blog header either since this code shows up after the custom inline-css

#blog_title {
 display: block;
 width: 465px;
 height: 100px;
 background: url(http://community.ihavecnb.com/public/style_images/master/blog/blank_logo.png) no-repeat;
 position: relative;
 text-decoration: none;
}

Understandable though but sucks

Quote

/* This has to go here as the css won't be loaded on std error page and header rules are thus ignored */

edit: Fixed it a little bit, just need it approved by teh Poobah.

[SA-X]

huhrah

[blissend]

Vathral, on 26 January 2010 - 08:24 PM, said:

Very nice updates but looks like they broke one of the features of the blog extract (the limit of 2009 is fixed atleast too)

It allowed one to post like a summary or snippet that cuts off on the front page so that users had to click on the entry to see the rest. I'll also have to fix my css a little and clean it up too.


edit1: Looks like forums still aren't remembered properly as unread or read
edit2: Looks like you also can't edit a text box with the global-shoutbox active as the page refreshes. Who do they have to test this stuff

• Where is this extract feature and what does it do?
• I clicked marked this forum as read and it properly grayed out the icon. I then logged into a different browser and it remembered it was read. Can you be more specific on what you're seeing?
• I was able to edit in a text box while the shoutbox is active. I tried in both Firefox 3.5 and IE 7. I can test later on IE 8 and Firefox 3.6. Also did you read my instructions in first post on clearing your browser cache so that you're using the updated shoutbox junk? If yes to all, can you somehow explain a bit more?

[blissend]

Vathral, on 26 January 2010 - 09:35 PM, said:

Can't edit the blog header either since this code shows up after the custom inline-css

#blog_title {
 display: block;
 width: 465px;
 height: 100px;
 background: url(http://community.ihavecnb.com/public/style_images/master/blog/blank_logo.png) no-repeat;
 position: relative;
 text-decoration: none;
}

Understandable though but sucks




edit: Fixed it a little bit, just need it approved by teh Poobah.

I approved it. You as a site admin can approve yourself in Admin CP -> My Apps -> Blog amongst other things and blog settings are found in: Tools & Settings -> System Settings -> Blog -> IP.Blog Settings

[ロリコン]

The extract feaure is located where it says "other styles" LIke I mentoned above it allows you to cut a snipet of a post so the full blog entry doesn't display. I will explain better later.

I said it improperly by saying forum. You can read every post and thread in a forum and the forum icon won't automatically grey out as read. BEen doing it manually after reading every post but it's weird it does that when other forum software does it right.

I was trying to create an album and It wasn't letting fill In any value. I was using fx3.5.6 and the browser automatically clears cache and cookies. TRied CHrome as well and it gave me problems as well. I had the miniature shoutbox disabled due to the reshuffle thing. Turning it on and off fixed it for me

this hospital smells D:


-------
p.s I saw I could approve it myself but I'd imagine anything related to security you'd like to check first even if it is us

[blissend]

Vathral, on 27 January 2010 - 11:15 AM, said:

The extract feaure is located where it says "other styles" LIke I mentoned above it allows you to cut a snipet of a post so the full blog entry doesn't display. I will explain better later.

I said it improperly by saying forum. You can read every post and thread in a forum and the forum icon won't automatically grey out as read. BEen doing it manually after reading every post but it's weird it does that when other forum software does it right.

I was trying to create an album and It wasn't letting fill In any value. I was using fx3.5.6 and the browser automatically clears cache and cookies. TRied CHrome as well and it gave me problems as well. I had the miniature shoutbox disabled due to the reshuffle thing. Turning it on and off fixed it for me

this hospital smells D:


-------
p.s I saw I could approve it myself but I'd imagine anything related to security you'd like to check first even if it is us

The board still properly marks things as read and unread for me. Perhaps you need to mark the entire board as read (bottom of page on every page I think). Then try again and see if it works. By the way don't be afraid to adjust blog settings to what you think works best for everyone.

Can't reproduce your gallery shotbox issue but it seems you fixed it. Also I think firefox can clear cache for just an hour or in its entirety. Did you make sure it wasn't just clearing the last hours worth or is that just a new feature in firefox 3.5?

I know almost nothing about css security. Didn't even realize there was such a thing! At any rate I took a quick gander and didn't see anything that caught my eye... though I had to disable uploaded images while at work so without uploaded images it looks fine.

[Yiazmat]

Efficient forum is efficient.

Sweet

[ロリコン]

Sweet! The forum reading thing is fine. Went ahead and updated to FX 3.6 too since addons I needed were updated.

The extract thing worked fine before but not anymore. This is how it works now.


Currently #1


Currently #2 (Entry text)



How it should look like with the extract code as it did before. Compare this with the 1st picture



Safety note:
Don't browse my blog home on an ipod of any sort, 3-4mb of images + javascript resizing = bad. I'd use the spoiler code to prevent such a sudden load but then it doesn't take into effect by the javascript so it blows the margins.

[blissend]

Vathral, on 27 January 2010 - 02:52 PM, said:

Sweet! The forum reading thing is fine. Went ahead and updated to FX 3.6 too since addons I needed were updated.

The extract thing worked fine before but not anymore. This is how it works now.


Currently #1


Currently #2 (Entry text)



How it should look like with the extract code as it did before. Compare this with the 1st picture



Safety note:
Don't browse my blog home on an ipod of any sort, 3-4mb of images + javascript resizing = bad. I'd use the spoiler code to prevent such a sudden load but then it doesn't take into effect by the javascript so it blows the margins.

I must be a moron because the only difference I see is one shows a picture and the other doesn't. I don't however see the picture wrapped around any special tags so I'm doubly confused. The middle one is the editor so I'm not sure what I should be seeing there either.

EDIT: I messaged crazy vathral and he explained what the tag does. God you suck at explaining things!

EDIT2: I for a moment proved vathral was crazy. Then I proved it works when it goes over a limit that is unknown to us. I rock. I'm here to make you feel bad about yourself.

This post has been edited by blissend: 27 January 2010 - 03:58 PM

[ロリコン]

Vathral, certified loony.