Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Nuke Platinum
Author Message
luv2sd
New Member
New Member



Joined: Jul 10, 2006
Posts: 4

PostPosted: Mon Jul 10, 2006 5:14 pm Reply with quote

Below is news admin interface from phpnuke 7.8

Image




Below is news admin interface from platinum 7.6.0 patched

Image



I realized that it's a tool called tiny_mce but I have no idea how to add this to platinum 7.6.0 patched. Cany someone help me? Thank you very much in advance.
 
View user's profile Send private message
kguske
Site Admin



Joined: Jun 04, 2004
Posts: 6437

PostPosted: Mon Jul 10, 2006 7:06 pm Reply with quote

I'd recommend using nukeWYSIWYG (although I'm biased). It uses a different editor called FCKeditor, but provide similar (better, I think) functionality.

You can download it from nukeSEO, and it has instructions for modifying your files to support the editor. After installing nukeWYSIWYG and making some simple modifications to your config.php and mainfile.php, you replace a textarea (e.g. in the modules/News/admin/index.php) with one line of PHP code.

_________________
I search, therefore I exist...
Only registered users can see links on this board! Get registered or login!
 
View user's profile Send private message
luv2sd







PostPosted: Mon Jul 10, 2006 7:36 pm Reply with quote

awesome!
I'll try it as soon as possible
 
Eck
Hangin' Around



Joined: Apr 09, 2005
Posts: 31

PostPosted: Wed Jul 12, 2006 4:57 pm Reply with quote

Sorry I am jumping in on this post, Since I know you guys are very knowledgeable with security and php. Plus it was recommended I come here.
For Platinum Nuke 764b2 I took the tiny_mce folder and added it to the includes directory. I then edited the Javascript.php file to add the two lines of code to activate tiny_mce to take over the text area for Admin news only. ( adminStory )
I tested this fuction and it worked out pretty well, Posted my news story no problem, Tiny_mce is not taking over any other text areas on the site or in the forums.
Question for you guys is how secure is this to run that way? I looked at nukeWYSIWYG its seems awesome but not what I was looking for.
I only want to use tiny_mce for admin news on my site. I did however remove all files and put the original javascript.php back until I could verify my site would not have a real security threat. Any ideas or help on this would be greatly appreciated.

Thank you very much for your time,
Ps luv2cd Sorry for jumping in here.

Eck


Last edited by Eck on Wed Jul 12, 2006 6:17 pm; edited 1 time in total 
View user's profile Send private message
luv2sd







PostPosted: Wed Jul 12, 2006 5:05 pm Reply with quote

Hey Eck, can I ask you for help as well?

How did you "edit the Javascript.php file to add the two lines of code to activate tiny_mce to take over the text area for Admin news only. ( adminStory )" ?

I eventually decided to just use tiny_mce, but nobody is helping me how to activate it. I put the tiny_mce in the right folder, which is under includes, but I have no idea how to activate it. Just like you, I only need it on the text area for admin news only.

I use 76b4.
 
Eck







PostPosted: Wed Jul 12, 2006 5:29 pm Reply with quote

Luv2sd I have no problem helping you but I want to make sure there is no big security issue first. I would rather get a Stop don't do it before I say here it is and something happens to your site. I would really be upset over that especially if I did not ask first. Hope you understand.
 
luv2sd







PostPosted: Wed Jul 12, 2006 6:06 pm Reply with quote

I understand.
So you will be helping me when you get an answer that it's safe to use tiny_mce on platinum right?

speedtype
 
Eck







PostPosted: Wed Jul 12, 2006 6:18 pm Reply with quote

You got it Very Happy
 
Guardian2003
Site Admin



Joined: Aug 28, 2003
Posts: 6799
Location: Ha Noi, Viet Nam

PostPosted: Thu Jul 13, 2006 4:23 am Reply with quote

nukeWYSIWYG editor allows you to create/modify a number of different 'toolbars' depending on the users status (I do not think tiny_mce allows that?) - so if you were using nukeWYSIWYG all you have to do is remove/disable the 'user' toolbar and only admins will see it.
 
View user's profile Send private message Send e-mail
kguske







PostPosted: Thu Jul 13, 2006 5:34 am Reply with quote

How did you handle checking for bad HTML tags? Using any WYSIWYG editor increases the likelihood of using HTML that gets blocked by Nuke's check_html function. In 7.7 and higher, they basically stopped using that function where the editor is used, opening a huge security hole.

Using different toolbars as Guardian suggests gives you the ability to prevent uploading files through the editor (like images) that can contain malicious scripts.
 
Eck







PostPosted: Thu Jul 13, 2006 6:14 am Reply with quote

Thank you Guardian and Kguske. I appreciate your replies. I am going to try and use nukeWYSIWYG instead, you have made me see the light. Kguske brought up a good point, I never thought about the extra checks for html codes since I am the only admin of my site and was only going to use it for myself. Plus I was under the assumption the Site would block it all if not allowed. Points very well taken and thanks for waking me up on this. I tried something it worked and I got a little excited.

Thank you again for all you hard work you have put into the nuke community. I appreciate it as well do many others. Your time on this post was much appreciated.

Thank you
Eck
 
umiyz
New Member
New Member



Joined: Jun 10, 2006
Posts: 9

PostPosted: Fri Oct 12, 2007 10:11 am Reply with quote

Hi, But i cant fix the check_html fault.

How can i make it work ?
When i replace function check_html with the original one the page does no longer show the theme...
 
View user's profile Send private message
Loki
Worker
Worker



Joined: Oct 05, 2003
Posts: 107
Location: Illinois

PostPosted: Sun Oct 14, 2007 12:02 pm Reply with quote

Make sure you are replacing the entire function.

FIND:

Code:
function check_html ($str, $strip="") {

    /* The core of this code has been lifted from phpslash */
    /* which is licenced under the GPL. */
    include("config.php");
    if ($strip == "nohtml")
   global $AllowableHTML;
   if (!is_array($AllowableHTML)) $AllowableHTML =array('');
   $str = stripslashes($str);
   $str = eregi_replace("<[[:space:]]*([^>]*)[[:space:]]*>",'<\\1>', $str);
           // Delete all spaces from html tags .
   $str = eregi_replace("<a[^>]*href[[:space:]]*=[[:space:]]*\"?[[:space:]]*([^\" >]*)[[:space:]]*\"?[^>]*>",'<a href="\\1">', $str);
           // Delete all attribs from Anchor, except an href, double quoted.
   $str = eregi_replace("<[[:space:]]* img[[:space:]]*([^>]*)[[:space:]]*>", '', $str);
       // Delete all img tags
   $str = eregi_replace("<a[^>]*href[[:space:]]*=[[:space:]]*\"?javascript[[:punct:]]*\"?[^>]*>", '', $str);
       // Delete javascript code from a href tags -- Zhen-Xjell @ http://nukecops.com
   $tmp = "";
   while (ereg("<(/?[[:alpha:]]*)[[:space:]]*([^>]*)>",$str,$reg)) {
      $i = strpos($str,$reg[0]);
      $l = strlen($reg[0]);
      if ($reg[1][0] == "/") $tag = strtolower(substr($reg[1],1));
      else $tag = strtolower($reg[1]);
      if ($a = $AllowableHTML[$tag])
         if ($reg[1][0] == "/") $tag = "</$tag>";
         elseif (($a == 1) || (empty($reg[2]))) $tag = "<$tag>";
         else {
           # Place here the double quote fix function.
           $attrb_list=delQuotes($reg[2]);
           // A VER
           $attrb_list = str_replace("&","&amp;",$attrb_list);
           $tag = "<$tag" . $attrb_list . ">";
         } # Attribs in tag allowed
      else $tag = "";
      $tmp .= substr($str,0,$i) . $tag;
      $str = substr($str,$i+$l);
   }
   $str = $tmp . $str;
   return $str;
   exit;
   /* Squash PHP tags unconditionally */
   $str = str_replace("<?","",$str);
   return $str;
}




REPLACE WITH:

Code:
function check_html ($string, $allowed_html = "", $allowed_protocols = array('http', 'https', 'ftp', 'news', 'nntp', 'gopher', 'mailto'))


{

   $stop = FALSE;

   if(!function_exists(kses_no_null))

   {

      @include_once("includes/kses/kses.php");

   }

   if (get_magic_quotes_gpc() == 1 )

   {

      $string = stripslashes($string );

   }

   $hotHtml = "nohtml";

   $Zstrip = stripos_clone($allowed_html, $hotHtml);

   if ($Zstrip === false)

   {

      global $AllowableHTML;

      $allowed_html = $AllowableHTML;

   } else {

      $allowed_html = array('<null>');

   }

   $string = kses_no_null($string);

   $string = kses_js_entities($string);

   $string = kses_normalize_entities($string);

   $string = kses_hook($string);

   $allowed_html_fixed = kses_array_lc($allowed_html);

   return kses_split($string, $allowed_html_fixed, $allowed_protocols);

}



function wysiwyg_textarea($name, $value, $config = "NukeUser", $cols = 50, $rows = 10)

{

   global $advanced_editor;

   # Don't waste bandwidth by loading WYSIWYG editor for crawlers

   if ($advanced_editor == 0 or !isset($_COOKIE))

   {

       echo "<textarea name=\"$name\" cols=\"$cols\" rows=\"$rows\">$value</textarea>";

   } else {

   @include_once("includes/FCKeditor/fckeditor.php");

   $oFCKeditor = new FCKeditor($name) ;

   $oFCKheight = $rows * 20;

   $oFCKeditor->Height = "$oFCKheight";

   $oFCKeditor->ToolbarSet   = "$config" ;

   $oFCKeditor->InstanceName = "$name" ;

   $oFCKeditor->Value = "$value" ;

   $oFCKeditor->Create() ;   

   }

}



function wysiwyg_textarea_html($name, $value, $config = "NukeUser", $cols = 50, $rows = 10)

{

   global $advanced_editor;

   # Don't waste bandwidth by loading WYSIWYG editor for crawlers

   if ($advanced_editor == 0 or !isset($_COOKIE))

   {

       echo "<textarea name=\"$name\" cols=\"$cols\" rows=\"$rows\">$value</textarea>";

   } else {

   @include_once("includes/FCKeditor/fckeditor.php");

   $oFCKeditor = new FCKeditor($name) ;

   $oFCKheight = $rows * 20;

   $oFCKeditor->Height = "$oFCKheight";

   $oFCKeditor->ToolbarSet   = "$config" ;

   $oFCKeditor->InstanceName = "$name" ;

   $oFCKeditor->Value = "$value" ;

   $wysiwygHTML = $oFCKeditor->CreateHtml() ;

   return $wysiwygHTML;

   }

}


If you still have a blank page then you need to turn on $display_errors = 1; in your config.php file and report the errors here.
 
View user's profile Send private message Visit poster's website
Display posts from previous:       
Post new topic   Reply to topic    Ravens PHP Scripts And Web Hosting Forum Index -> Nuke Platinum

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©