phpBB • Free and Open Source Forum Software

php_BB_Lover · by **php_BB_Lover** » Tue Jun 23, 2020 8:31 am

Hi,
i tested on phpbb3.3, it works good thanks,
two questions for you:
1. it only works on new post, not working on edit post. is there any modification to do this?
2. there is no link for @username to user's profile. what file should i edit to achieve this?
thanks,

by **Paul** » Wed Jun 24, 2020 12:13 pm

1. Editing is not supported because the extension can't detect if the mention was there already previously
2. This is not supported right now.

php_BB_Lover · by **php_BB_Lover** » Thu Jun 25, 2020 6:29 am

Paul wrote:1. Editing is not supported because the extension can't detect if the mention was there already previously
2. This is not supported right now.

1. would you please guide me to edit your extension and do that? we can check the post's content if it has [mention] or not right? or its harder than this?
2. the same thing for @username, if its not hard to do this please guide me to edit your extension for this functionality!
by the way, thank you very much for this great extension,

by **Paul** » Thu Jun 25, 2020 6:34 am

No, I won't be adding those features

php_BB_Lover · by **php_BB_Lover** » Thu Jun 25, 2020 9:56 am

Paul wrote:No, I won't be adding those features

i didn't ask you to add those features, i just asked you to guide me to add them on my copy!
but anyway thanks,

klingklang · by **klingklang** » Sat Jul 04, 2020 4:21 pm

php_BB_Lover wrote: 2. there is no link for @username to user's profile. what file should i edit to achieve this?

Hi, I've figured out a way to obtain this with just a minor edit to this ext source code:
1) add a custom bbcode [user] as described here
2) edit /ext/paul999/mention/styles/all/template/js/mention.js by changing

Code: Select all

return '[mention]' + item.original.value + '[/mention]';

to

Code: Select all

return '[mention][user]' + item.original.value + '[/user][/mention]';

you may have to play a little bit with mention.css as well, to tweak the colors at your convenience.

Please note that I'm by no means an expert, and although this works on my board, I don't know if something unexpected could happen following these changes. Bye

by **Paul** » Sat Jul 04, 2020 4:25 pm

And if a username gets changed it will be directly broken

php_BB_Lover · by **php_BB_Lover** » Sun Jul 05, 2020 10:37 am

klingklang wrote:
php_BB_Lover wrote: 2. there is no link for @username to user's profile. what file should i edit to achieve this?
Hi, I've figured out a way to obtain this with just a minor edit to this ext source code:
1) add a custom bbcode [user] as described here
2) edit /ext/paul999/mention/styles/all/template/js/mention.js by changing
Code: Select all
return '[mention]' + item.original.value + '[/mention]';
to
Code: Select all
return '[mention][user]' + item.original.value + '[/user][/mention]';
you may have to play a little bit with mention.css as well, to tweak the colors at your convenience.

Please note that I'm by no means an expert, and although this works on my board, I don't know if something unexpected could happen following these changes. Bye

thank you very much! it worked!
i only got this error while adding user tag in bbcode.

Code: Select all

Warning
The BBCode you are trying to add seems unsafe. If the BBCode uses a {TEXT} token in a sensitive context, try using a more restrictive type instead. Only proceed if you understand the risks involved.

but i just hit yes and worked! thank you.
i dont know if adding user tag is unsafe or not because of this error!

php_BB_Lover · by **php_BB_Lover** » Sun Jul 05, 2020 10:39 am

Paul wrote:And if a username gets changed it will be directly broken

then give us the solution!
at least he helped us by giving that solution!

by **Paul** » Sun Jul 05, 2020 10:52 am

Sorry? I am not required here to provide you with a solution.
You should be happy to I provide the extension, and instead respect the volunteers here. It has a reason that I don't provide certain features, simply because it is not that easy to add. You are free to use that solution, however it simply has issues and thats what I pointed out.

php_BB_Lover · by **php_BB_Lover** » Sun Jul 05, 2020 11:00 am

Paul wrote: Sorry? I am not required here to provide you with a solution.

i said [then]. i didn't say [should]
thanks for the extension by the way.

klingklang · by **klingklang** » Sun Jul 05, 2020 8:41 pm

php_BB_Lover wrote: i dont know if adding user tag is unsafe or not because of this error!

Unfortunately, further research has taught me that by using {TEXT} inside a html tag, you open your board to malicious attacks, which could be easily done by injecting code inside your [mention] tag. Which by the way could be tweaked to bring to the user's profile without the need for an extra [user] tag, nor any editing of the source code.
If you are sure that none of your users have an apostrophe (for example) in their nickname, you could replace {TEXT} with {INTTEXT} and be safer, but I have those, and can't go that way. So, never mind the minor issue of a user changing his nickname and see his mention links broken: this is a major security problem, big enough to convince me to give up on this idea, at least for now

php_BB_Lover · by **php_BB_Lover** » Mon Jul 06, 2020 12:27 am

klingklang wrote: Unfortunately, further research ...

thank you. your right. i will wait too.
please reply my post here and give me the solution for [user changes username fix] if you find it!
thanks

klingklang · by **klingklang** » Mon Jul 06, 2020 5:13 am

Ok, I've found a better way (or, at least, I think it is: maybe Paul could comment on this), which fixes the security breach and kind of mitigates the nickname change issue. Here's the fix:
1) in /ext/paul999/mention/controller/main.php, you have:

Code: Select all

			$return[] = [
				'key'       =>$row['username'],
				'value'     => $row['username'],
			];

change it to:

Code: Select all

			$return[] = [
				'id'		=>$row['user_id'],
				'key'       =>$row['username'],
				'value'     => $row['username'],
			];

2) in /ext/paul999/mention/styles/all/template/js/mention.js, you have:

Code: Select all

                return '[mention]' + item.original.value + '[/mention]';

change it to:

Code: Select all

                return '[mention=' + item.original.id + ']' + item.original.value + '[/mention]';

3) change the [mention] custom bbcode this way;

Code: Select all

[mention={NUMBER}]{TEXT}[/mention]

Code: Select all

<span class="mention"><a style="color: #4a9a6a;" href="https://your.url/memberlist.php?mode=viewprofile&u={NUMBER}">{TEXT}</a></span>

(change/remove the color and replace your. url to suit your board)

You should be good

Please let me know if it works for you and if you or Paul see more major issues with this solution

klingklang · by **klingklang** » Mon Jul 06, 2020 3:44 pm

Paul wrote:And if a username gets changed it will be directly broken

With my latest solution, the link points to the user id, so it won't get broken (albeit still showing the old nickname). Do you think it's a sensible approach or i will run into more problems down the road? Thank you, also for this brilliant extension which brings a feature I very much envied to Xenforo

Simple mentions

thank you - Simple mentions

advertisements