| View previous topic :: View next topic |
| Author |
Message |
panthermodern
Joined: 08 Feb 2003
Location: Taxronto
|
 Posted: Wed Feb 11, 2004 9:31 pm Post subject: Forum questions (software related) |
 |
|
I want to first state that this thread is not about the moderators but rather the software of this forum.
I have noticed that the basic software of this forum can be modified, for example, the member's list has been removed.
Is it possible to create a thread but limit who can respond to it with out outright locking it?
What exactly are Usergroups and how do they work?
I know there is a Moderators forum, which is not publically accessable, but, could one create another such forum using this program.
And finally; What is the name of the software used and/or could someone suggest another site software.
Thank you. |
|
| Back to top |
|
 |
the_beaver
Joined: 15 Jan 2003
|
| Posted: Thu Feb 12, 2004 12:32 am Post subject: Re: Forum questions (software related) |
|
|
| panthermodern wrote: |
Is it possible to create a thread but limit who can respond to it with out outright locking it?
I know there is a Moderators forum, which is not publically accessable, but, could one create another such forum using this program. |
yes
| panthermodern wrote: |
And finally; What is the name of the software used and/or could someone suggest another site software.
|
phpBB
http://www.phpbb.com/ |
|
| Back to top |
|
|
Stunted Wookie
Joined: 06 Feb 2003
Location: Sound Studio
|
| Posted: Thu Feb 12, 2004 3:35 am Post subject: |
|
|
phpbb is not an overly secure program...very easy to hack/ remote access etc.
If you are using a forum as a main element of your site I would recomend looking into another program. (security wise)
Do a search on Invision as well; I know that name but am not sure if it is as accessable as phpbb is. |
|
| Back to top |
|
|
panthermodern
Joined: 08 Feb 2003
Location: Taxronto
|
| Posted: Thu Feb 12, 2004 3:51 am Post subject: |
|
|
| Thanks for the info... |
|
| Back to top |
|
|
The Lemon
Joined: 11 Jan 2003
|
| Posted: Thu Feb 12, 2004 5:16 am Post subject: |
|
|
Wookie may be right about phpbb2's lack of security, but it's very easy to customize and to set up. And it's secure enough for me - anyone who might have wanted to bring down my phpbb2 board hasn't been able to, yet. They're welcome to try.
Panther asked about usergroups - I've got a phpbb2 board running on my own server and I still don't see what the use of the "usergroups" is (though I haven't bothered to find out, either). Anyone know offhand?
One problem with phpbb2 is that if you decide to use a non-standard theme (basically, skin - different colors, layouts, buttons) then it's very difficult to make modifications to the program. You have to edit scripts written in PHP language to do things like removing the "the newest member is trollsock" message from the front screen. Possible but not easy.
| Quote: |
| Is it possible to create a thread but limit who can respond to it with out outright locking it? |
One arbitrary thread within a general forum? Not as far as I know. But that's not the present version's biggest limitation. Its biggest problem is that after a moderator moves a particular post from a thread to another forum (say, the moderator forum), he/she can't move it back. Mods can only remove posts from threads, not add them. That's why you see on rare occasions mods re-posting posts "on behalf of" a particular user. |
|
| Back to top |
|
|
uber1024
Joined: 28 Jul 2003
Location: New York City
|
| Posted: Thu Feb 12, 2004 6:34 am Post subject: |
|
|
| The Lemon wrote: |
| Wookie may be right about phpbb2's lack of security, but it's very easy to customize and to set up. And it's secure enough for me - anyone who might have wanted to bring down my phpbb2 board hasn't been able to, yet. They're welcome to try. |
I'm going to be a computer geek for a second here, so bear with me.
I checked out the website of the phpbb, and it looks like it works with a multitude of databases, which means that the SQL is embedded within the code of the website and not stored safely away within the database. Anytime you have that, you wind up with potential SQL injection vulnerabilities. I run a messageboard website and I got hit with this with the original version of the code (which I did not write) and had to rewrite the whole messageboard (I was in the process of doing this anyway).
I'm SURE that phpbb checks for this, but each database has it's own "special characters", so I imagine that there may still be a hole somewhere in it. They say on their site that it was designed with security as a priority, but all it takes is one place where you forget to check and your database is compromised.
Okay, the geek moment has passed. |
|
| Back to top |
|
|
uber1024
Joined: 28 Jul 2003
Location: New York City
|
| Posted: Thu Feb 12, 2004 6:35 am Post subject: |
|
|
| Hah. And I screwed up the simple task of quoting while talking about database/website vulnerablilities caused by carelessness. The irony. |
|
| Back to top |
|
|
Stunted Wookie
Joined: 06 Feb 2003
Location: Sound Studio
|
| Posted: Thu Feb 12, 2004 7:31 am Post subject: |
|
|
Uber you are on the right track with that.
I am a php/mySQL geek...
Its not the board that has the major flaws (well one BIG one but I'll ignore that for now)
The major problem is the database, anyone can connect with three pieces of info.
The phpbb gives this info away, and no I am not going deeper into what this is..
But the point is that if you are looking for something 'secure' there are newer products available (open source) for a board. |
|
| Back to top |
|
|
Bulsajo
Joined: 16 Jan 2003
|
| Posted: Thu Feb 12, 2004 7:42 am Post subject: |
|
|
Panther, I know you love talking about the rules and guidelines- take a look at the phpBB.com message forum rules:
www.phpbb.com rules and regulations |
|
| Back to top |
|
|
The Lemon
Joined: 11 Jan 2003
|
| Posted: Thu Feb 12, 2004 8:47 am Post subject: |
|
|
Wookie: I'm interested in finding out more about this "big BIG" security hole, and the database issue - I'm not doubting you at all, in fact I totally believe you.
If you have some spare time, could you exploit this hole and post something in the hidden forum of my phpbb2 board? It'd be interesting to see happen. If phpbb2 gives away those three pieces of information necessary, it shouldn't take you too long...
Apart from the usual virus and firewall stuff, it's the standard installation of php and mysql, if that's a help. |
|
| Back to top |
|
|
camel96
Guest
|
| Posted: Thu Feb 12, 2004 8:50 am Post subject: |
|
|
| The Lemon wrote: |
Wookie: I'm interested in finding out more about this "big BIG" security hole - I'm not doubting you at all, in fact I totally believe you.
If you have some spare time, could you exploit this hole and post something in the hidden forum of my phpbb2 board? It'd be interesting to see happen. If phpbb2 gives away those three pieces of information necessary, it shouldn't take you too long...
Apart from the usual virus and firewall stuff, it's the standard installation of php and mysql, if that's a help. |
What's your website....?
PHPBB's are easy to bust into. |
|
| Back to top |
|
|
camel96
Guest
|
| Posted: Thu Feb 12, 2004 8:51 am Post subject: |
|
|
| Oh....the CIM board....? |
|
| Back to top |
|
|
camel96
Guest
|
| Posted: Thu Feb 12, 2004 9:04 am Post subject: |
|
|
| Quote: |
You have been banned from this forum.
Please contact the webmaster or board administrator for more information. |
Hey Lemon is this an IP related banning or is it one of your "security" features....?
It came up while I was "working".... 
Last edited by camel96 on Thu Feb 12, 2004 10:09 am; edited 1 time in total |
|
| Back to top |
|
|
panthermodern
Joined: 08 Feb 2003
Location: Taxronto
|
| Posted: Thu Feb 12, 2004 9:30 am Post subject: |
|
|
Thanks for all the usefull information ...
Been doing my own research and I wanted a second opinion.
Thanks again. |
|
| Back to top |
|
|
uber1024
Joined: 28 Jul 2003
Location: New York City
|
| Posted: Thu Feb 12, 2004 12:26 pm Post subject: |
|
|
Wookie / Camel --
Are SQL injection the techniques you feel would have the best chance of success against a phpbb?
My perspective on site security is that of a developer/administrator. I've never actually tried to get a site to spit back its password list, although my coworker and I, when we started looking into SQL injection vulnerabilities, did get our SQL Server to give us lists of tables. I suppose we probably could have started getting CONTENTS of tables, but I think 5pm rolled around and we went out for beers.
panthermodern --
are you looking to add a messageboard to a site? |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
