Poll mod 0.1.3

Minor bug fix for punBB poll mod.

Fixes issue with "double escaping".  Poll options containing characters <, >, &, ' or " will now display correctly.

Mod is still secure against XSS to the best of my knowledge.

https://dl.dropbox.com/u/1614464/robs_poll_mod/robs_poll_mod_0.1.3.tar.gz

Poll Mod v0.1.1

This is a minor update to the 0.1.0 version of my poll mod for punBB 1.2. It contains a single bugfix. Previously, if anyone had a user name containing the character "@", they were allowed to vote multiple times, but not allowed to see the poll results. This bug has now been closed.

robs_poll_mod_0.1.1

Poll Mod for PunBB 1.2.x - updated version

An update to the punBB poll mod I hacked together a year or so ago - frankly, something that should have been done a long time ago. This update is a major redesign, although it recycles much of the code from the 0.0.3 release. Looking back at the old code is a little embarrassing, to be honest, and it's clear that I hadn't spent any time thinking about its design. This release introduces many new features, but more importantly doesn't feel like it was programmed by a moron.

Changes include

• Code refactoring, more modular design, greater separation of mod code from punBB code
• Support for php4 removed - php5 is now a requirement
  
• Simplified installation procedure
• Ability to restore database if uninstalled
• Existing topics can be turned into polls
• Ability to edit, close and delete existing polls
• Poll permissions and colour scheme can be edited via the newly introduced admin console
• Ability to restrict which classes of user have permission to create polls
• n-1 polls now show approval ratings (ie percentages do not add up to 100, but results are more meaningful)
• multi-lingual support
• licence is now GPLv3, instead of LGPLv3
  
• Various performance improvements and bug fixes
  

The database schema in this release has changed from that of the 0.0.3 release. The current release, and all future releases will write the poll mod version into the database, so that the installation script will be able to update existing polls if the database schema is ever changed again. Sadly, I wasn't so foresighted when I released 0.0.3, so if upgrading from 0.0.3, the database schema will need to be updated by hand. This is not too difficult, though - just create a boolean column "closed" which defaults to 0, and a varchar(200) column named "creator" in the polls table. The following (conf_name, conf_value) pairs then need to be added to the punBB config table:

• ('rob_poll_version' , "0.1.0")
  
• ( 'rob_poll_permission_level' , '1')
• ( 'rob_poll_bg_colour' , '#FFFFFF')
• ('rob_poll_bar_colour' , "#190A8F")
• ( 'rob_poll_text_colour' , "#A0A0A0")
• ('rob_poll_text_size' , "14")

Optionally, the data type of the following columns in the polls table can be changed as follows

• question: change Text to varchar(200)
• options: change Text to varchar(2010)
• votes: change Text to varchar(110)
  

In future releases, I'll pay more attention to breaking the database schema. The version numbering convention will help in this regard - whenever I change the database schema in a backwards incompatible way, I'll update the minor version number (eg from 0.0.3 to 0.1.0)

The mod code and installation instructions are linked below. Thanks and acknowledgements go to Jan Odvarko, author of the jscolor script. This script is a javascript colour picker, which I have incorporated into the admin console - it is used to adjust the mod's colour scheme.

robs_poll_mod_0.1.0.tar.gz

Out, out damned bot!

Recently, our university club's website was used as a citation in a wikipedia article. On the plus side, this has increased our website's google pagerank quite substantially. On the downside, our small punBB based forum is now receiving much greater attention from the spambots.

So here I present two very simple modifications to punBB that have helped to stem the spambot tide. The first is integrating the captcha service provided by recaptcha into the punBB registration form. To use this service, you will need to register. You will also need to insert your recaptcha public and private keys into the mod code provided below.

The second method employs the spambot blacklist at http://www.stopforumspam.com/. It will check the email and ip address of any newly registered forum user, denying them registration if they are found to be on the blacklist.

Finally, I recommend turning on punBB's email validation feature.

While extremely simple, these measures seem to have reduced the number of spambot registrations on our forum quite substantially.

The mod code is below. As I have ranted about previously, the university's hosting server only has php4, so some parts of the code are a little kludgy (php4 lacks decent exception handling). Note also, that the code has only been tested on punBB 1.2.16, though it should work fine on any other version in the 1.2 series.

Instructions

1. Register an account with recaptcha, and then register your site's domain. Take note of your private and public keys
2. Download recaptchalib.php, and upload it to the root directory of your punBB forum.
3. Open the punBB file "register.php". Locate (around line 80) the lines
   

    else if (isset($_POST['form_sent']))
   {
   

   
   After, add the following code, remembering to insert your recaptcha private key where required:
   

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

   //Validate CAPTCHA entry require_once('recaptchalib.php'); $privatekey = "INSERT YOUR RECAPTCHA PRIVATE KEY HERE"; $resp = recaptcha_check_answer ($privatekey, $_SERVER["REMOTE_ADDR"], $_POST["recaptcha_challenge_field"], $_POST["recaptcha_response_field"]); if (!$resp->is_valid) { message ("You have failed the human test. Please re-enter the CAPTCHA. Unless you are a bot. If that is the case, then bugger off!" . "(reCAPTCHA said: " . $resp->error . ")"); } //end validate CAPTCHA entry //check the users ip and email against the www.stopforumspam.com database. This code is really awkward, since it has to run on php4. //check ip $xml_string = file_get_contents('http://www.stopforumspam.com/api?ip='.get_remote_address()); if ($xml_string){ //make sure we degrade gracefully if stopforumspam.com is offline if (strpos($xml_string, "<appears>yes</appears>")) //phps string handling is terrible, and normally we can't write code like this. This is ok, since if a match occurs, it will never be at the zeroeth character - the response from stopforumspam always begins with <response success="true"> message("You are trying to register from an ip address that has been used by a spambot. If you are a legitimate (human) user, please email us, so we can sort out your registration. If you are a spambot, then kindly die in a hole."); } //check email address $email = strtolower(trim($_POST['req_email1'])); $xml_string = file_get_contents('http://www.stopforumspam.com/api?email='.$email); if ($xml_string){ //make sure we degrade gracefully if stopforumspam.com is offline if (strpos($xml_string, "<appears>yes</appears>")) //phps string handling is terrible, and normally we can't write code like this. This is ok, since if a match occurs, it will never be at the zeroeth character - the response from stopforumspam always begins with <response success="true"> message("Your email address seems to belong to a spammer. Please die in a hole. Thank you for your co-operation."); }

   
   
4. Scroll down to about line 310, and find the following lines:
   

   1 2 3 4 5 6 7 8 9 10 11 12

   <div class="inform"> <fieldset> <legend><?php echo ($pun_config['o_regs_verify'] == '1') ? $lang_prof_reg['E-mail legend 2'] : $lang_prof_reg['E-mail legend'] ?></legend> <div class="infldset"> <?php if ($pun_config['o_regs_verify'] == '1'): ?> <p><?php echo $lang_register['E-mail info'] ?></p> <?php endif; ?> <label><strong><?php echo $lang_common['E-mail'] ?></strong><br /> <input type="text" name="req_email1" size="50" maxlength="50" /><br /></label> <?php if ($pun_config['o_regs_verify'] == '1'): ?> <label><strong><?php echo $lang_register['Confirm e-mail'] ?></strong><br /> <input type="text" name="req_email2" size="50" maxlength="50" /><br /></label> <?php endif; ?> </div> </fieldset> </div>.

   
   
   
   After, add the following code, remembering to substitute in your own recaptcha public key where required:
   

   1 2 3 4 5 6 7 8 9 10 11 12 13 14

   <div class="inform"> <fieldset> <legend>Human Test (CAPTCHA)</legend> <div class="infldset"> This is to ensure you are not a horrible spambot. Please complete the CAPTCHA below <?php //display reCAPTCHA require_once('recaptchalib.php'); $publickey = "INSERT YOUR RECAPTCHA PUBLIC KEY HERE"; echo recaptcha_get_html($publickey); ?> </div> </fieldset> </div>

   
   
5. Save the modified version of register.php, and upload it to your hosting server

If anyone has any feedback on the above modifications/wants to unleash the bile against spambots, feel free to leave a comment.

A poll mod for punBB 1.2.x

 First up, something I've been meaning to do for quite some time - create a poll mod for punBB.

The necessity for such a mod came from some website maintenance work I was doing for my University's pantomime society. We run a small punBB (version 1.2.16 - to be upgraded to 1.2.22 soon) based forum on the site, and it was apparent that a poll function might be useful. While several poll mods exist for punBB 1.2, none of them could be made to function harmoniously with our site, and all of them contained some rather horrible security flaws.

Hence, this mod. It is intended to be as simple and secure as possible. The goal is to keep as much of the code as possible in separate files so that minimal editing of the punBB code is required.

The attached code is functional, though it lacks several bells and whistles - the focus of this release is security and core functionality. Currently, the mod includes the following features

• prevention of multiple voting
• prevention of guest voting
• two types of poll: mutually exclusive polls, and multi-select (n-1) polls
• (Fairly) thorough input validation and security measures

The following features may be added at a later date

• multilingual support
• removing (or increasing) the restriction on the number of poll options
• configuration panel, to make it easier for user to modify poll colours, etc.
• fully annonymised voting

The attached code certainly can't be called elegant - all the error messages, plus the colour scheme, are hard coded into the program. I will probably change this at some point. But, at least it's functional.

Well, it's at least functional on punBB 1.2.16 with MySQL - I haven't tested it on any other punBB versions/database backends. If you have a crack at implementing this mod, please let me know of the (inevitable) bugs and problems!

An aside - , the reason that we still run the ancient punBB 1.2 is that the PantoSoc site is hosted on a rather archaic University server - running apache 1.3, php 4.3 and mysql 4.0 (yes, in 2009!). So really, any security implemented in this mod is likely negated by the poor security of our hosting environment.

robs_poll_mod_0.0.3.tar.gz