Author |
Message |
luv2sd
New Member


Joined: Jul 10, 2006
Posts: 4
|
Posted:
Mon Jul 10, 2006 5:14 pm |
|
Below is news admin interface from phpnuke 7.8
Below is news admin interface from platinum 7.6.0 patched
I realized that it's a tool called tiny_mce but I have no idea how to add this to platinum 7.6.0 patched. Cany someone help me? Thank you very much in advance. |
|
|
|
 |
kguske
Site Admin

Joined: Jun 04, 2004
Posts: 6437
|
Posted:
Mon Jul 10, 2006 7:06 pm |
|
I'd recommend using nukeWYSIWYG (although I'm biased). It uses a different editor called FCKeditor, but provide similar (better, I think) functionality.
You can download it from nukeSEO, and it has instructions for modifying your files to support the editor. After installing nukeWYSIWYG and making some simple modifications to your config.php and mainfile.php, you replace a textarea (e.g. in the modules/News/admin/index.php) with one line of PHP code. |
_________________ I search, therefore I exist...
Only registered users can see links on this board! Get registered or login! |
|
|
 |
luv2sd

|
Posted:
Mon Jul 10, 2006 7:36 pm |
|
awesome!
I'll try it as soon as possible |
|
|
|
 |
Eck
Hangin' Around

Joined: Apr 09, 2005
Posts: 31
|
Posted:
Wed Jul 12, 2006 4:57 pm |
|
Sorry I am jumping in on this post, Since I know you guys are very knowledgeable with security and php. Plus it was recommended I come here.
For Platinum Nuke 764b2 I took the tiny_mce folder and added it to the includes directory. I then edited the Javascript.php file to add the two lines of code to activate tiny_mce to take over the text area for Admin news only. ( adminStory )
I tested this fuction and it worked out pretty well, Posted my news story no problem, Tiny_mce is not taking over any other text areas on the site or in the forums.
Question for you guys is how secure is this to run that way? I looked at nukeWYSIWYG its seems awesome but not what I was looking for.
I only want to use tiny_mce for admin news on my site. I did however remove all files and put the original javascript.php back until I could verify my site would not have a real security threat. Any ideas or help on this would be greatly appreciated.
Thank you very much for your time,
Ps luv2cd Sorry for jumping in here.
Eck |
Last edited by Eck on Wed Jul 12, 2006 6:17 pm; edited 1 time in total |
|
|
 |
luv2sd

|
Posted:
Wed Jul 12, 2006 5:05 pm |
|
Hey Eck, can I ask you for help as well?
How did you "edit the Javascript.php file to add the two lines of code to activate tiny_mce to take over the text area for Admin news only. ( adminStory )" ?
I eventually decided to just use tiny_mce, but nobody is helping me how to activate it. I put the tiny_mce in the right folder, which is under includes, but I have no idea how to activate it. Just like you, I only need it on the text area for admin news only.
I use 76b4. |
|
|
|
 |
Eck

|
Posted:
Wed Jul 12, 2006 5:29 pm |
|
Luv2sd I have no problem helping you but I want to make sure there is no big security issue first. I would rather get a Stop don't do it before I say here it is and something happens to your site. I would really be upset over that especially if I did not ask first. Hope you understand. |
|
|
|
 |
luv2sd

|
Posted:
Wed Jul 12, 2006 6:06 pm |
|
I understand.
So you will be helping me when you get an answer that it's safe to use tiny_mce on platinum right?
 |
|
|
|
 |
Eck

|
Posted:
Wed Jul 12, 2006 6:18 pm |
|
You got it  |
|
|
|
 |
Guardian2003
Site Admin

Joined: Aug 28, 2003
Posts: 6799
Location: Ha Noi, Viet Nam
|
Posted:
Thu Jul 13, 2006 4:23 am |
|
nukeWYSIWYG editor allows you to create/modify a number of different 'toolbars' depending on the users status (I do not think tiny_mce allows that?) - so if you were using nukeWYSIWYG all you have to do is remove/disable the 'user' toolbar and only admins will see it. |
|
|
|
 |
kguske

|
Posted:
Thu Jul 13, 2006 5:34 am |
|
How did you handle checking for bad HTML tags? Using any WYSIWYG editor increases the likelihood of using HTML that gets blocked by Nuke's check_html function. In 7.7 and higher, they basically stopped using that function where the editor is used, opening a huge security hole.
Using different toolbars as Guardian suggests gives you the ability to prevent uploading files through the editor (like images) that can contain malicious scripts. |
|
|
|
 |
Eck

|
Posted:
Thu Jul 13, 2006 6:14 am |
|
Thank you Guardian and Kguske. I appreciate your replies. I am going to try and use nukeWYSIWYG instead, you have made me see the light. Kguske brought up a good point, I never thought about the extra checks for html codes since I am the only admin of my site and was only going to use it for myself. Plus I was under the assumption the Site would block it all if not allowed. Points very well taken and thanks for waking me up on this. I tried something it worked and I got a little excited.
Thank you again for all you hard work you have put into the nuke community. I appreciate it as well do many others. Your time on this post was much appreciated.
Thank you
Eck |
|
|
|
 |
umiyz
New Member


Joined: Jun 10, 2006
Posts: 9
|
Posted:
Fri Oct 12, 2007 10:11 am |
|
Hi, But i cant fix the check_html fault.
How can i make it work ?
When i replace function check_html with the original one the page does no longer show the theme... |
|
|
|
 |
Loki
Worker


Joined: Oct 05, 2003
Posts: 107
Location: Illinois
|
Posted:
Sun Oct 14, 2007 12:02 pm |
|
Make sure you are replacing the entire function.
FIND:
Code:function check_html ($str, $strip="") {
/* The core of this code has been lifted from phpslash */
/* which is licenced under the GPL. */
include("config.php");
if ($strip == "nohtml")
global $AllowableHTML;
if (!is_array($AllowableHTML)) $AllowableHTML =array('');
$str = stripslashes($str);
$str = eregi_replace("<[[:space:]]*([^>]*)[[:space:]]*>",'<\\1>', $str);
// Delete all spaces from html tags .
$str = eregi_replace("<a[^>]*href[[:space:]]*=[[:space:]]*\"?[[:space:]]*([^\" >]*)[[:space:]]*\"?[^>]*>",'<a href="\\1">', $str);
// Delete all attribs from Anchor, except an href, double quoted.
$str = eregi_replace("<[[:space:]]* img[[:space:]]*([^>]*)[[:space:]]*>", '', $str);
// Delete all img tags
$str = eregi_replace("<a[^>]*href[[:space:]]*=[[:space:]]*\"?javascript[[:punct:]]*\"?[^>]*>", '', $str);
// Delete javascript code from a href tags -- Zhen-Xjell @ http://nukecops.com
$tmp = "";
while (ereg("<(/?[[:alpha:]]*)[[:space:]]*([^>]*)>",$str,$reg)) {
$i = strpos($str,$reg[0]);
$l = strlen($reg[0]);
if ($reg[1][0] == "/") $tag = strtolower(substr($reg[1],1));
else $tag = strtolower($reg[1]);
if ($a = $AllowableHTML[$tag])
if ($reg[1][0] == "/") $tag = "</$tag>";
elseif (($a == 1) || (empty($reg[2]))) $tag = "<$tag>";
else {
# Place here the double quote fix function.
$attrb_list=delQuotes($reg[2]);
// A VER
$attrb_list = str_replace("&","&",$attrb_list);
$tag = "<$tag" . $attrb_list . ">";
} # Attribs in tag allowed
else $tag = "";
$tmp .= substr($str,0,$i) . $tag;
$str = substr($str,$i+$l);
}
$str = $tmp . $str;
return $str;
exit;
/* Squash PHP tags unconditionally */
$str = str_replace("<?","",$str);
return $str;
}
|
REPLACE WITH:
Code:function check_html ($string, $allowed_html = "", $allowed_protocols = array('http', 'https', 'ftp', 'news', 'nntp', 'gopher', 'mailto'))
{
$stop = FALSE;
if(!function_exists(kses_no_null))
{
@include_once("includes/kses/kses.php");
}
if (get_magic_quotes_gpc() == 1 )
{
$string = stripslashes($string );
}
$hotHtml = "nohtml";
$Zstrip = stripos_clone($allowed_html, $hotHtml);
if ($Zstrip === false)
{
global $AllowableHTML;
$allowed_html = $AllowableHTML;
} else {
$allowed_html = array('<null>');
}
$string = kses_no_null($string);
$string = kses_js_entities($string);
$string = kses_normalize_entities($string);
$string = kses_hook($string);
$allowed_html_fixed = kses_array_lc($allowed_html);
return kses_split($string, $allowed_html_fixed, $allowed_protocols);
}
function wysiwyg_textarea($name, $value, $config = "NukeUser", $cols = 50, $rows = 10)
{
global $advanced_editor;
# Don't waste bandwidth by loading WYSIWYG editor for crawlers
if ($advanced_editor == 0 or !isset($_COOKIE))
{
echo "<textarea name=\"$name\" cols=\"$cols\" rows=\"$rows\">$value</textarea>";
} else {
@include_once("includes/FCKeditor/fckeditor.php");
$oFCKeditor = new FCKeditor($name) ;
$oFCKheight = $rows * 20;
$oFCKeditor->Height = "$oFCKheight";
$oFCKeditor->ToolbarSet = "$config" ;
$oFCKeditor->InstanceName = "$name" ;
$oFCKeditor->Value = "$value" ;
$oFCKeditor->Create() ;
}
}
function wysiwyg_textarea_html($name, $value, $config = "NukeUser", $cols = 50, $rows = 10)
{
global $advanced_editor;
# Don't waste bandwidth by loading WYSIWYG editor for crawlers
if ($advanced_editor == 0 or !isset($_COOKIE))
{
echo "<textarea name=\"$name\" cols=\"$cols\" rows=\"$rows\">$value</textarea>";
} else {
@include_once("includes/FCKeditor/fckeditor.php");
$oFCKeditor = new FCKeditor($name) ;
$oFCKheight = $rows * 20;
$oFCKeditor->Height = "$oFCKheight";
$oFCKeditor->ToolbarSet = "$config" ;
$oFCKeditor->InstanceName = "$name" ;
$oFCKeditor->Value = "$value" ;
$wysiwygHTML = $oFCKeditor->CreateHtml() ;
return $wysiwygHTML;
}
}
|
If you still have a blank page then you need to turn on $display_errors = 1; in your config.php file and report the errors here. |
|
|
|
 |
|