PHP Web Host - Quality Web Hosting For All PHP Applications Just Great Software
  Login or Register
 • Home • Downloads • Your Account • Forums • 
  Forum FAQ  •  Search  •  Memberlist  •  Usergroups  •  Profile  •  Log in to check your private messages  •  Log in

how do I add tiny_mce to nuke platinum 7.6.0 patched?
 View next topic
View previous topic


Google
 
Web RavenPHPScripts (This Site)
Post new topic   Reply to topic  Ravens PHP Scripts And Web Hosting Forum Index » Nuke Platinum
Author Message
luv2sd
New Member
New Member


Joined: Jul 10, 2006
Posts: 4
PostPosted: Mon Jul 10, 2006 5:14 pm Reply with quote Back to top
Below is news admin interface from phpnuke 7.8

Image




Below is news admin interface from platinum 7.6.0 patched

Image



I realized that it's a tool called tiny_mce but I have no idea how to add this to platinum 7.6.0 patched. Cany someone help me? Thank you very much in advance.
View user's profile Send private message
kguske
Site Admin


Joined: Jun 04, 2004
Posts: 4620
PostPosted: Mon Jul 10, 2006 7:06 pm Reply with quote Back to top
I'd recommend using nukeWYSIWYG (although I'm biased). It uses a different editor called FCKeditor, but provide similar (better, I think) functionality.

You can download it from nukeSEO, and it has instructions for modifying your files to support the editor. After installing nukeWYSIWYG and making some simple modifications to your config.php and mainfile.php, you replace a textarea (e.g. in the modules/News/admin/index.php) with one line of PHP code.
View user's profile Send private message
luv2sd
New Member
New Member


Joined: Jul 10, 2006
Posts: 4
PostPosted: Mon Jul 10, 2006 7:36 pm Reply with quote Back to top
awesome!
I'll try it as soon as possible
View user's profile Send private message
Eck
Hangin' Around


Joined: Apr 09, 2005
Posts: 31
PostPosted: Wed Jul 12, 2006 4:57 pm Reply with quote Back to top
Sorry I am jumping in on this post, Since I know you guys are very knowledgeable with security and php. Plus it was recommended I come here.
For Platinum Nuke 764b2 I took the tiny_mce folder and added it to the includes directory. I then edited the Javascript.php file to add the two lines of code to activate tiny_mce to take over the text area for Admin news only. ( adminStory )
I tested this fuction and it worked out pretty well, Posted my news story no problem, Tiny_mce is not taking over any other text areas on the site or in the forums.
Question for you guys is how secure is this to run that way? I looked at nukeWYSIWYG its seems awesome but not what I was looking for.
I only want to use tiny_mce for admin news on my site. I did however remove all files and put the original javascript.php back until I could verify my site would not have a real security threat. Any ideas or help on this would be greatly appreciated.

Thank you very much for your time,
Ps luv2cd Sorry for jumping in here.

Eck


Last edited by Eck on Wed Jul 12, 2006 6:17 pm; edited 1 time in total
View user's profile Send private message
luv2sd
New Member
New Member


Joined: Jul 10, 2006
Posts: 4
PostPosted: Wed Jul 12, 2006 5:05 pm Reply with quote Back to top
Hey Eck, can I ask you for help as well?

How did you "edit the Javascript.php file to add the two lines of code to activate tiny_mce to take over the text area for Admin news only. ( adminStory )" ?

I eventually decided to just use tiny_mce, but nobody is helping me how to activate it. I put the tiny_mce in the right folder, which is under includes, but I have no idea how to activate it. Just like you, I only need it on the text area for admin news only.

I use 76b4.
View user's profile Send private message
Eck
Hangin' Around


Joined: Apr 09, 2005
Posts: 31
PostPosted: Wed Jul 12, 2006 5:29 pm Reply with quote Back to top
Luv2sd I have no problem helping you but I want to make sure there is no big security issue first. I would rather get a Stop don't do it before I say here it is and something happens to your site. I would really be upset over that especially if I did not ask first. Hope you understand.
View user's profile Send private message
luv2sd
New Member
New Member


Joined: Jul 10, 2006
Posts: 4
PostPosted: Wed Jul 12, 2006 6:06 pm Reply with quote Back to top
I understand.
So you will be helping me when you get an answer that it's safe to use tiny_mce on platinum right?

speedtype
View user's profile Send private message
Eck
Hangin' Around


Joined: Apr 09, 2005
Posts: 31
PostPosted: Wed Jul 12, 2006 6:18 pm Reply with quote Back to top
You got it Very Happy
View user's profile Send private message
Guardian2003
Site Admin


Joined: Aug 28, 2003
Posts: 4553
Location: Poland
PostPosted: Thu Jul 13, 2006 4:23 am Reply with quote Back to top
nukeWYSIWYG editor allows you to create/modify a number of different 'toolbars' depending on the users status (I do not think tiny_mce allows that?) - so if you were using nukeWYSIWYG all you have to do is remove/disable the 'user' toolbar and only admins will see it.
View user's profile Send private message Send e-mail Visit poster's website
kguske
Site Admin


Joined: Jun 04, 2004
Posts: 4620
PostPosted: Thu Jul 13, 2006 5:34 am Reply with quote Back to top
How did you handle checking for bad HTML tags? Using any WYSIWYG editor increases the likelihood of using HTML that gets blocked by Nuke's check_html function. In 7.7 and higher, they basically stopped using that function where the editor is used, opening a huge security hole.

Using different toolbars as Guardian suggests gives you the ability to prevent uploading files through the editor (like images) that can contain malicious scripts.
View user's profile Send private message
Eck
Hangin' Around


Joined: Apr 09, 2005
Posts: 31
PostPosted: Thu Jul 13, 2006 6:14 am Reply with quote Back to top
Thank you Guardian and Kguske. I appreciate your replies. I am going to try and use nukeWYSIWYG instead, you have made me see the light. Kguske brought up a good point, I never thought about the extra checks for html codes since I am the only admin of my site and was only going to use it for myself. Plus I was under the assumption the Site would block it all if not allowed. Points very well taken and thanks for waking me up on this. I tried something it worked and I got a little excited.

Thank you again for all you hard work you have put into the nuke community. I appreciate it as well do many others. Your time on this post was much appreciated.

Thank you
Eck
View user's profile Send private message
umiyz
New Member
New Member


Joined: Jun 10, 2006
Posts: 9
PostPosted: Fri Oct 12, 2007 10:11 am Reply with quote Back to top
Hi, But i cant fix the check_html fault.

How can i make it work ?
When i replace function check_html with the original one the page does no longer show the theme...
View user's profile Send private message
Loki
Regular
Regular


Joined: Oct 05, 2003
Posts: 60
PostPosted: Sun Oct 14, 2007 12:02 pm Reply with quote Back to top
Make sure you are replacing the entire function.

FIND:

Code:
function check_html ($str, $strip="") {
    /* The core of this code has been lifted from phpslash */
    /* which is licenced under the GPL. */
    include("config.php");
    if ($strip == "nohtml")
   global $AllowableHTML;
   if (!is_array($AllowableHTML)) $AllowableHTML =array('');
   $str = stripslashes($str);
   $str = eregi_replace("<[[:space:]]*([^>]*)[[:space:]]*>",'<\\1>', $str);
           // Delete all spaces from html tags .
   $str = eregi_replace("<a[^>]*href[[:space:]]*=[[:space:]]*\"?[[:space:]]*([^\" >]*)[[:space:]]*\"?[^>]*>",'<a href="\\1">', $str);
           // Delete all attribs from Anchor, except an href, double quoted.
   $str = eregi_replace("<[[:space:]]* img[[:space:]]*([^>]*)[[:space:]]*>", '', $str);
       // Delete all img tags
   $str = eregi_replace("<a[^>]*href[[:space:]]*=[[:space:]]*\"?javascript[[:punct:]]*\"?[^>]*>", '', $str);
       // Delete javascript code from a href tags -- Zhen-Xjell @ http://nukecops.com
   $tmp = "";
   while (ereg("<(/?[[:alpha:]]*)[[:space:]]*([^>]*)>",$str,$reg)) {
      $i = strpos($str,$reg[0]);
      $l = strlen($reg[0]);
      if ($reg[1][0] == "/") $tag = strtolower(substr($reg[1],1));
      else $tag = strtolower($reg[1]);
      if ($a = $AllowableHTML[$tag])
         if ($reg[1][0] == "/") $tag = "</$tag>";
         elseif (($a == 1) || (empty($reg[2]))) $tag = "<$tag>";
         else {
           # Place here the double quote fix function.
           $attrb_list=delQuotes($reg[2]);
           // A VER
           $attrb_list = str_replace("&","&amp;",$attrb_list);
           $tag = "<$tag" . $attrb_list . ">";
         } # Attribs in tag allowed
      else $tag = "";
      $tmp .= substr($str,0,$i) . $tag;
      $str = substr($str,$i+$l);
   }
   $str = $tmp . $str;
   return $str;
   exit;
   /* Squash PHP tags unconditionally */
   $str = str_replace("<?","",$str);
   return $str;
}




REPLACE WITH:

Code:
function check_html ($string, $allowed_html = "", $allowed_protocols = array('http', 'https', 'ftp', 'news', 'nntp', 'gopher', 'mailto'))

{

   $stop = FALSE;

   if(!function_exists(kses_no_null))

   {

      @include_once("includes/kses/kses.php");

   }

   if (get_magic_quotes_gpc() == 1 )

   {

      $string = stripslashes($string );

   }

   $hotHtml = "nohtml";

   $Zstrip = stripos_clone($allowed_html, $hotHtml);

   if ($Zstrip === false)

   {

      global $AllowableHTML;

      $allowed_html = $AllowableHTML;

   } else {

      $allowed_html = array('<null>');

   }

   $string = kses_no_null($string);

   $string = kses_js_entities($string);

   $string = kses_normalize_entities($string);

   $string = kses_hook($string);

   $allowed_html_fixed = kses_array_lc($allowed_html);

   return kses_split($string, $allowed_html_fixed, $allowed_protocols);

}



function wysiwyg_textarea($name, $value, $config = "NukeUser", $cols = 50, $rows = 10)

{

   global $advanced_editor;

   # Don't waste bandwidth by loading WYSIWYG editor for crawlers

   if ($advanced_editor == 0 or !isset($_COOKIE))

   {

       echo "<textarea name=\"$name\" cols=\"$cols\" rows=\"$rows\">$value</textarea>";

   } else {

   @include_once("includes/FCKeditor/fckeditor.php");

   $oFCKeditor = new FCKeditor($name) ;

   $oFCKheight = $rows * 20;

   $oFCKeditor->Height = "$oFCKheight";

   $oFCKeditor->ToolbarSet   = "$config" ;

   $oFCKeditor->InstanceName = "$name" ;

   $oFCKeditor->Value = "$value" ;

   $oFCKeditor->Create() ;   

   }

}



function wysiwyg_textarea_html($name, $value, $config = "NukeUser", $cols = 50, $rows = 10)

{

   global $advanced_editor;

   # Don't waste bandwidth by loading WYSIWYG editor for crawlers

   if ($advanced_editor == 0 or !isset($_COOKIE))

   {

       echo "<textarea name=\"$name\" cols=\"$cols\" rows=\"$rows\">$value</textarea>";

   } else {

   @include_once("includes/FCKeditor/fckeditor.php");

   $oFCKeditor = new FCKeditor($name) ;

   $oFCKheight = $rows * 20;

   $oFCKeditor->Height = "$oFCKheight";

   $oFCKeditor->ToolbarSet   = "$config" ;

   $oFCKeditor->InstanceName = "$name" ;

   $oFCKeditor->Value = "$value" ;

   $wysiwygHTML = $oFCKeditor->CreateHtml() ;

   return $wysiwygHTML;

   }

}


If you still have a blank page then you need to turn on $display_errors = 1; in your config.php file and report the errors here.
View user's profile Send private message Visit poster's website
Display posts from previous:       
Post new topic   Reply to topic  Ravens PHP Scripts And Web Hosting Forum Index » Nuke Platinum


 Jump to:   



View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Forums ©
 

All logos and trademarks in this site are property of their respective owner.
The comments are property of their posters, all the rest © 2002-2008 by Raven
Proud to be listed at Lobo Links Web Directory

You can syndicate our news using the file xml

CSE HTML Validator Helped Clean up This Page! [Valid RSS] valid RSS 2.0 Valid robots.txt Stop Spam Harvesters, Join Project Honey Pot

Website engines core code is © copyright by PHP-Nuke but has been heavily patched and modified by myself and others.
PHP-Nuke is a free software released under the GNU/GPL.

:: fisubice phpbb2 style by Daz :: PHP-Nuke theme by www.nukemods.com ::

:: fisubice Theme Recoded To 100% W3C CSS & HTML 4.01 Transitional Compliance by Raven and 64bitguy ::

:: W3C CSS Compliance Validation :: W3C HTML 4.01 Transitional Compliance Validation ::

zerosum