Out of the box phpBB 3 is awful for SEO

Do not post support requests, bug reports or feature requests. Discuss phpBB here. Non-phpBB related discussion goes in General Discussion!
Scam Warning
Locked
User avatar
thecoalman
Community Team Member
Community Team Member
Posts: 3480
Joined: Wed Dec 22, 2004 3:52 am
Location: Pennsylvania, U.S.A.
Contact:

Re: Out of the box phpBB 3 is awful for SEO

Post by thecoalman »

Frodosringfinger wrote: I had thousands of pages indexed on google.
Perhaps you should have read some of the posts because you would have learned volume doesn't equal good SEO. If you have 15,000 pages indexed and 13,000 of them are duplicate content this isn't a good thing. This BTW is real world example from one of my phpbb2 forums 2 years ago before applying SEO mods .
“Results! Why, man, I have gotten a lot of results! I have found several thousand things that won’t work.”

Attributed - Thomas Edison

User avatar
Eelke
QA Team
Posts: 2903
Joined: Thu Dec 20, 2001 8:00 am
Location: NL, Bussum
Name: Eelke Blok
Contact:

Re: Out of the box phpBB 3 is awful for SEO

Post by Eelke »

I think the point being made is that the title of this thread is unnecessarily provoking. "Awful" is an awfully (pun intended) harsh word to use, and I don't think it can possibly be considered constructive (to use thecoalman's wording). What the previous poster really is saying is, phpBB 2 was maybe awful, but phpBB 3 has made some big steps in the right direction. There has been some good, constructive discussion here, but I can also relate to those that have used the word "demanding". Some posts are, IMHO, not so much presented as being constructive suggestions, but rather sound a lot like making demands and presenting personal beliefs as the end-all, be-all truth. This (again all IMHO) is never a great way to get a point across, even in the uncommon situation that your personal beliefs really are the end-all, be-all truth ;)

Frank Rizzo
Registered User
Posts: 135
Joined: Sun Jan 05, 2003 11:10 pm
Contact:

Re: Out of the box phpBB 3 is awful for SEO

Post by Frank Rizzo »

There are two threads going on here at the moment. I've said all I have said about the SEO point and I still stand by it.

---

On the point about the exploit I very disappointed with the blase attitude of some.

This is a SERIOUS issue which is not being addressed. I do not know about new installs but there are many boards out there which have not been patched.

I have just demonstrated this again to a user within the last few postings. I successfully managed to

a) exploit his email a friend system
b) post a message on his board when I did not have rights to do so.

I could have also pm'd many users on his board.

Why are people here being so blase about it?

User avatar
Eelke
QA Team
Posts: 2903
Joined: Thu Dec 20, 2001 8:00 am
Location: NL, Bussum
Name: Eelke Blok
Contact:

Re: Out of the box phpBB 3 is awful for SEO

Post by Eelke »

Did you report the exploit to the security tracker? Sorry if you mentioned it, but I didn't find a reference to it.

Frank Rizzo
Registered User
Posts: 135
Joined: Sun Jan 05, 2003 11:10 pm
Contact:

Re: Out of the box phpBB 3 is awful for SEO

Post by Frank Rizzo »

Yes, a tracker was submitted and I believe actioned on.

I have just tested a fresh install on a new server and I'm please to say the exploit has been fixed. Top marks to the team for that.

There is, however, still a potential problem for users who have not patched their boards. I don't know if the RC1 to RC2 upgrade fixes the problem, or if operators have to manually change some settings themselves. Either way there are board operators out there who should be informed of the problem and told how to fix it.

I found a couple here, within minutes. It wouldn't take a bot net long to scour the net looking for the vulnerable boards.

User avatar
Rotsblok
Registered User
Posts: 648
Joined: Fri Nov 11, 2005 12:47 pm
Location: Upper north of Holland
Name: Rikkert Westa
Contact:

Re: Out of the box phpBB 3 is awful for SEO

Post by Rotsblok »

Frank Rizzo wrote:Yes, a tracker was submitted and I believe actioned on.

I have just tested a fresh install on a new server and I'm please to say the exploit has been fixed. Top marks to the team for that.

There is, however, still a potential problem for users who have not patched their boards. I don't know if the RC1 to RC2 upgrade fixes the problem, or if operators have to manually change some settings themselves. Either way there are board operators out there who should be informed of the problem and told how to fix it.

I found a couple here, within minutes. It wouldn't take a bot net long to scour the net looking for the vulnerable boards.
This is not the problem of phpBB but a problem of the board owners. As mentioned earlier phpBB cannot held responsible for those not upgrading their boards. Nor can they be held responsible for board owners not reading the version numbers etc.

Why you still can find those ppl . Cos they are. If I want i can still find phpBB 1.x boards. So please stop calling this problem cos phpBB cannot do anything against it.
Nederlandse Support site
Several dutch translations for 3.1 extensions if you need one or there is an update of an extension feel free to notify me.

Frank Rizzo
Registered User
Posts: 135
Joined: Sun Jan 05, 2003 11:10 pm
Contact:

Re: Out of the box phpBB 3 is awful for SEO

Post by Frank Rizzo »

I think there is a care of duty issue here.

There are boards out there with a specific exploit. Board operators need to know that there is an exploit and that their board is vulnerable.

Is there any harm in posting an official announcement about this?

User avatar
Rotsblok
Registered User
Posts: 648
Joined: Fri Nov 11, 2005 12:47 pm
Location: Upper north of Holland
Name: Rikkert Westa
Contact:

Re: Out of the box phpBB 3 is awful for SEO

Post by Rotsblok »

hmmm maybe the announcement of the release of RC2.
We encourage only those running the release candidates wanting to test out the new version, it is still recommended to wait for the full release; after all this is a release candidate.
And its not really a care of duty as it has been stated that RC1 is not a final release etc.

And if you are a board owner you should always check regularly for updates, if you fail to do so then only you can be held responsible.
Nederlandse Support site
Several dutch translations for 3.1 extensions if you need one or there is an update of an extension feel free to notify me.

Acyd Burn
Consultant
Consultant
Posts: 5830
Joined: Wed Dec 05, 2001 8:31 pm
Location: Behind You
Name: Meik Sievertsen

Re: Out of the box phpBB 3 is awful for SEO

Post by Acyd Burn »

There is no exploit at all - it is a simple bug affecting those having converted their forums to RC1. The update from RC1 to RC2 is fixing this for those. BTW, the complete UCP (including PM'ing) is forbidden for bots, even if permissions allow this. Every change is listed within the changelog, we are not hiding anything - those entries marked with [Sec] are security-related updates, either preventing something we think may be a problem later or fixing an issue which may go into the security related group. But there was no exploit.

RC is meant as a release candidate - we expect everyone to update, else we won't give any support. Users running RC1 will need to update to RC2 before they get any help. The same as with gold versions.

Frank Rizzo
Registered User
Posts: 135
Joined: Sun Jan 05, 2003 11:10 pm
Contact:

Re: Out of the box phpBB 3 is awful for SEO

Post by Frank Rizzo »

I think we need to be absolutely sure here. I have just had a pm:
I have updated to RC2 2 days ago. How are you able to exploit my website and post ..... ?
So that is a user who updated to RC2 and still has a board which is an open spamfest.

User avatar
Kellanved
Former Team Member
Posts: 2635
Joined: Wed Jan 26, 2005 2:48 pm
Location: Meta-level

Re: Out of the box phpBB 3 is awful for SEO

Post by Kellanved »

I can only re-iterate the facts.

The bug was reported on May 20th. The bug affected the 2.0.x -> RC1 converter. Out of the box RC 1 boards were unaffected.

The bug was fixed on May 21st.

The RC2 database update script has code in place to remove the Bots from the registered user group.


Has your friend run the database update script? By which means was the board updated?
Nocando is in Idontwanna county. No support via PM

Frank Rizzo
Registered User
Posts: 135
Joined: Sun Jan 05, 2003 11:10 pm
Contact:

Re: Out of the box phpBB 3 is awful for SEO

Post by Frank Rizzo »

Well maybe this is a different bug. I don't know about the the user who PM'd me. He says he ran RC1 to RC2 update and still has the problem.

Here is the sequence which I discovered the problem:

18-Jun-07 I upgraded a v2 board to RC1

19-Jun-07 whilst seo'ing I discovered that under certain conditions it was possible for a non registered user to do the 'exploits' whilst a non registered guest could correctly not.

I considered this to be a serious flaw and sought advice.

A security tracker was filed with an example of how to perform the exploit. A few boards of registered users here were tested (where all boards I tested the board operators were informed). I even performed the exploit on this board by pm'ing a mod and posting a phantom message as a non registered user.

If you are saying that the bug was fixed early in May then I think you either need to check that or realise that this is a totally different bug / exploit / flaw.

In summary, the answer is to lock down the permissions of the bot group. Setting the permissions to No does not work. You need to set it to Never for all but Read Forum, Download Messages.

User avatar
Kellanved
Former Team Member
Posts: 2635
Joined: Wed Jan 26, 2005 2:48 pm
Location: Meta-level

Re: Out of the box phpBB 3 is awful for SEO

Post by Kellanved »

The bug was fixed mid-may.

We have to concede one thing: I have forgotten to clear the permission cache in the update script, so that the bot users might still have the registered user permissions. We will include that last step in the RC3 update.
Nocando is in Idontwanna county. No support via PM

Acyd Burn
Consultant
Consultant
Posts: 5830
Joined: Wed Dec 05, 2001 8:31 pm
Location: Behind You
Name: Meik Sievertsen

Re: Out of the box phpBB 3 is awful for SEO

Post by Acyd Burn »

I even performed the exploit on this board by pm'ing a mod and posting a phantom message as a non registered user.
Since bots are not able to PM i assume you hit a different bug whereby the session system used your registered user account but with the different user agent (we do not have browser checks enabled here). We fixed this by setting the bot variable to false if this is the case to not let the user "use" a different name but still being the registered user even if surfing with a user agent matching a bot.

I do not think the wording "exploit" is correct here. Sure, it is security related, but an exploit is a script you run to take down a board or perform malicious actions.

I also think we will deny access to the posting page completely for bots as we do this for the user control panel.

With the next update permissions will be refreshed completely within the database update script - preventing such things from happening again.

User avatar
bbrian017
Registered User
Posts: 720
Joined: Mon Mar 19, 2007 2:20 pm
Location: Canada
Contact:

Re: Out of the box phpBB 3 is awful for SEO

Post by bbrian017 »

:) how would one check a sites SEO ranking, and or how would one check the indexing?

This is FRENCH only site
phpBB3 SEO mods are demonstrated here : http://phpbb3.phpbb-seo.net/

Locked

Return to “phpBB Discussion”