Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Messages - Nao
181
Features / Re: New revs
« on February 7th, 2017, 09:50 AM »
[Commit revision 58af872]
Author: Nao
Date: Tue, 07 Feb 2017 01:06:39 +0100
Stats: 1 file changed; +3 (insertions), -2 (deletions)

  • Saving a few bytes of code. Okay, really I'm fixing a crash. Never commit at bedtime. (index.php)
182
Bug reports / [Security] Re: BBCode in SQL Database
« on February 7th, 2017, 12:58 AM »
I'll be honest with you, this is one of those features that I *saw* Pete adding, and I thought "oh my God this is horrible..."
Because really, what happens is that it just makes everything harder if you want to add smileys & such, and modify code 'easily'. You now have to go through phpMyAdmin to do your thing. I tried it, I wasted hours over those things. The only 'good' thing is that you can quietly change your smiley code without having to care about not overwriting them by uploading a source file. Well, the thing is, I don't see anyone but the *developer* changing those. And I'm the dev. So it's just a bit odd overall.

If anything, I like the idea of reverting this. The reason Pete did that was for plugins to be able to easily add smileys. Err, really? I've never seen a plugin do that. At least not with Wedge's level of public awareness. And SMF does well without that. Considering that I added SMF-like mod support back into Wedge a couple years ago (and in a more elegant way!), it should be trivial to add smileys just using the regular old SMF way.

PS: I just have no time to look into this right now. I'm pretty busy with the new site. Plus I may be moving servers again in the future-- this one is so blazing fast, I love it, but there are so many configuration issues, it gives me nightmares... -_-
183
Features / Re: New revs
« on February 7th, 2017, 12:52 AM »
[Commit revision d47934c]
Author: Nao
Date: Tue, 07 Feb 2017 00:52:01 +0100
Stats: 2 files changed; +4 (insertions), -10 (deletions)

  • Spacinazi + I think we should allow for bigger random numbers, even if it's unlikely we'll get a collision. But hey it's free. (Subs-CachePHP.php)
  • I guess we don't need that ugly debug code anymore then. I was considering keeping the index fallback, but then I figured webmasters wouldn't even be able to determine one of their files is screwed up. (index.php)
184
Features / Re: New revs
« on February 7th, 2017, 12:33 AM »
[Commit revision de8a0d3]
Author: C3realGuy
Date: Mon, 06 Feb 2017 22:47:59 +0100
Stats: 1 file changed; +4 (insertions), -2 (deletions)

  • Prevent race condition in loadSource by writing to a temporary file

[Commit revision 57f28d6]
Author: Nao
Date: Tue, 07 Feb 2017 00:33:45 +0100
Stats: 1 file changed; +4 (insertions), -2 (deletions)

  • Merge pull request #53 from C3realGuy/fix_rc_loadsource
  • Prevent race conditions by flocking files on loadSource(). A likely fix to one of the oldest unimportant Wedge bugs ;)
185
Features / Re: New revs
« on February 6th, 2017, 10:45 AM »
[Commit revision 9bc6cba]
Author: Nao
Date: Mon, 06 Feb 2017 10:45:41 +0100
Stats: 2 files changed; +10 (insertions), -6 (deletions)

  • Wow, what a mess... Nginx proxy handling was broken from the start. In revision 1b8aa5d, Pete added support for non-CloudFlare proxies, but documented it improperly, by suggesting the use of 'X-Real-Ip', but not bother to convert dashes to underscores internally. As a result, Wedge.org itself just spent the last few weeks rejecting every single Googlebot request. Isn't that nice? (QueryString.php)
  • Additionally, I'm committing a temporary fix to use BAN_CHECK_IP for BadBehavior purposes (that is, the 'real' client IP beyond server proxies), as opposed to REMOTE_ADDR. I'm not sure it's really going to be temporary, but I first need to check whether it makes sense to 'trust' those headers. Suggestions welcome. (Security.php)
186
Features / Re: New revs
« on February 5th, 2017, 08:33 PM »
[Commit revision 435c54a]
Author: Nao
Date: Sun, 05 Feb 2017 20:20:36 +0100
Stats: 1 file changed; +1 (insertion), -1 (deletion)

  • Intrusion logger wouldn't check for request URI size before trying to insert it into a 255-char field... Usually this wouldn't be a problem, but MySQL exploits can hold entire scripts into the URL. Should probably increase size to 1024 chars or something, but it's already a huge table that never gets trimmed, so... No thanks. (Security.php)

[Commit revision 0e3578e]
Author: Nao
Date: Sun, 05 Feb 2017 20:22:13 +0100
Stats: 1 file changed; +3 (insertions), -5 (deletions)

  • Slightly shorter default htaccess files, and a small fix for the expiry date. I don't remember why it was hardcoded. 20 years from install date should be enough... Although maybe it won't work. I don't really see any differences anyway. (OriginalFiles.php)

[Commit revision b1dd9cc]
Author: Nao
Date: Sun, 05 Feb 2017 20:23:36 +0100
Stats: 1 file changed; +2 (insertions), -4 (deletions)

  • Logic error in a scheduled task query. I think I saw that in an older SMF fix that Pete didn't backport or maybe he had already left. I need some sleep. (ScheduledTasks.php)

[Commit revision e7c5413]
Author: Nao
Date: Sun, 05 Feb 2017 20:25:38 +0100
Stats: 3 files changed; +3 (insertions), -3 (deletions)

  • Other minor fixes. I think they're also inspired by SMF fixes. Sorry, I didn't even notice I'd made these changes weeks ago. (Search2.php, Subs-Auth.php, Subs-Graphics.php)

[Commit revision 73538f9]
Author: Nao
Date: Sun, 05 Feb 2017 20:27:04 +0100
Stats: 2 files changed; +2 (insertions), -2 (deletions)

  • Oh, and that SMF fix too... (Subs-Post.php)
  • And while I'm at it, a small improvement to an array length calculation. I know, it's petty, but it was hurting my eyes. (Aeva-Subs-Vital.php)

[Commit revision 143e827]
Author: Nao
Date: Sun, 05 Feb 2017 20:33:23 +0100
Stats: 3 files changed; +40 (insertions), -37 (deletions)

  • Merged two functions related to PHP caching into cache_source_file(), which should be easier to understand. The fact that the function applies plugin mods and minifies the file is implied in its contents. Dunno about you, I find it cleaner. (Subs-CachePHP.php, Subs-Template.php, index.php)
  • Also added some debug code to help catch the problem with the latest-news.js error. It's a very minor thing, but it's always better to redirect people to the homepage rather than just show them the page crash, anyway. Maybe remove the code later if I end up fixing the bug. (index.php)
  • Note: don't forget to update your root folder's index.php file!
187
Features / Re: New revs
« on February 5th, 2017, 03:45 AM »
[Commit revision 4ccaed6]
Author: Nao
Date: Sun, 05 Feb 2017 03:45:06 +0100
Stats: 3 files changed; +5 (insertions), -5 (deletions)

  • Not that it matters, but I updated jQuery to v3.1.1, since it's been out for a few months now. (I try not to jump on the latest version immediately, in case it's buggy.) (Load.php, jquery-*.min.js)
  • (What am I doing awake at nearly 4am. Help.)
188
Archived fixes / Re: 'ViewRemote' not found or invalid function name
« on January 30th, 2017, 02:27 PM »
Hmmmmm... That might actually explain it! I was thinking of exclusive locks but couldn't figure out why this would only happen with ViewRemote.
I'll give it a look.

:edit: I don't know... The first thing that gets called is copy(). Meaning the file SHOULD exist, in its entirety, by the time a second AJAX request is triggered. Of course it could still be unsuccessfully copied or something.
189
Features / Re: New revs
« on January 27th, 2017, 11:55 PM »
[Commit revision db87766]
Author: Nao
Date: Thu, 26 Jan 2017 11:07:31 +0100
Stats: 1 file changed; +1 (insertion), -1 (deletion)

  • Commenazi. Just wanted to make it clear that ini_set() only works on a subset of php.ini settings, and the previous comment implied that it could override a PHP_INI_PERDIR setting. (OriginalFiles.php)

[Commit revision c988813]
Author: Nao
Date: Thu, 26 Jan 2017 23:48:50 +0100
Stats: 1 file changed; +3 (insertions), -3 (deletions)


[Commit revision 14f9311]
Author: Nao
Date: Fri, 27 Jan 2017 23:17:11 +0100
Stats: 1 file changed; +1 (insertion), -1 (deletion)

  • Commenazi. Sorry, had to fix that typo... (OriginalFiles.php)

[Commit revision 8e86565]
Author: Nao
Date: Fri, 27 Jan 2017 23:55:13 +0100
Stats: 2 files changed; +47 (insertions), -44 (deletions)

  • In my continuing quest to make Wedge work better behind a proxy, I've fixed an error triggered by a misunderstanding around the concept of HTTP headers. The latest official documentation indicates that they should be case-insensitive. Bad Behavior treats them as case-sensitive, even though it only differentiates case in a single case (which may not even be valid anymore). So...
  • Modified get_http_headers() to return lowercase-only header names. Updated all code using get_http_headers() to match that. Basically, it's really only about Bad Behavior here. (QueryString.php, Security.php)
  • Removed that single instance of Bad Behavior checking for a specific header ('Via'), because with the new system it just wouldn't work. (Security.php)
  • Updated Bad Behavior-inspired code to v2.2.19. It's only about syncing with its exploit/spam/bot user agent list, because there are other additions that don't seem to be related to existing code in Wedge. (Security.php)
  • Note: this WILL break any plugins that use get_http_headers(). But I don't think any do. At least, none of those hosted on Wedge.org.
190
Archived fixes / Re: 'ViewRemote' not found or invalid function name
« on January 27th, 2017, 01:12 PM »
From what I could gather, the error is partly reproduceable by just deleting the /gz/app/ViewRemote.php file. Wedge will then re-create it, and in the same second (but is that BEFORE or AFTER it was created..?!), you'll get the error.
I did that about half an hour ago...
And then tried again, and it worked just fine, lol.

Still a mystery.
191
Archived fixes / Re: 'ViewRemote' not found or invalid function name
« on January 27th, 2017, 01:57 AM »
Still unable to get 'why'.
And I'm not really ready to put an extra safeguard in index.php just to catch that specific error-- meaning it'd slow down EVERY single page by a few cycles. Meh!

Still, maybe if it's just during the debugging period...
Or, who cares.
192
The Pub / Re: Wedge&PHP 7
« on January 27th, 2017, 12:06 AM »
Quote from Nao on January 20th, 2017, 04:26 PM
wesql::get('SELECT @@sql_mode') ==> returns NOTHING in Wedge... returns an actual string in phpMyAdmin. WUT?!
wesql::query('SET session sql_mode = "TRADITIONAL"', array('security_override' => true)); ==> does nothing. Strict mode still at work.

Anyone inspired by this..? Maybe it's a server problem.
I forgot about that. Just wanted to reply, 'nope'.
It only works if calling mysqli_query directly. Obviously when you JUST got the database connection, it's unlikely that query() actually has everything it needs to do a proper request. ;)
193
Features / Re: New revs
« on January 26th, 2017, 11:48 PM »
[Commit revision 34c8223]
Author: C3realGuy
Date: Sun, 15 Jan 2017 13:10:09 +0100
Stats: 1 file changed; +3 (insertions), -3 (deletions)

  • now displaying more clear why we failed to apply the plugin modifications

[Commit revision dca5de1]
Author: Nao
Date: Thu, 26 Jan 2017 23:48:39 +0100
Stats: 1 file changed; +3 (insertions), -3 (deletions)

  • Merge pull request #50 from C3realGuy/dev_more_detailed_errors_on_plugin_mods
  • Plugin Attempt should show why it failed on mods.xml
194
The Pub / Re: Wedge&PHP 7
« on January 26th, 2017, 05:14 PM »
Good to know, I suppose!
Personally never got any problems. I don't even remember that Wedge uses SimpleXML... (??)
Not there any many plugins anyway, so I don't exactly spend my time in that section..!
195
Features / Re: New revs
« on January 25th, 2017, 11:26 PM »
[Commit revision e108c9a]
Author: Nao
Date: Wed, 25 Jan 2017 23:25:56 +0100
Stats: 1 file changed; +1 (insertion), -1 (deletion)

  • Another GROUP BY fix I forgot to commit. (Aeva-Foxy.php)