Lee Craven

It's something that we have talked about, no promises, but it could make it into a future version

Security Update for IP.Board 3.0.2
It has come to our attention that there are two potential SQL injection vulnerabilities present in IP.Board 3.0 which can be taken advantage of via careful URL crafting.

Resolution
The attached zip contains two files which fix the issue. The files are for IP.Board version 3.0.2 only. Those still running 3.0.0 or 3.0.1 will need to upgrade to 3.0.2 as soon as possible.

The main 3.0.2 download zip was updated at 10:15 am EST August 18, 2009. If you download 3.0.2 after this time: your files are already updated.

Simply download the attached zip file and upload the files contained within to your IP.Board directory on your server. No other action is required.

 180809.zip   13.73K   7984 downloads

Support Note: While our technical support department will apply this patch for you on request for those with support service, we strongly suggest you apply this patch yourself whenever possible. Applying the patch is a simple matter of uploading files to your server and, once done, your community is instantly protected without having to wait for our technicians to do the upload for you.



Impacted Versions:
3.0.0
3.0.1
3.0.2 versions downloaded before posted time or unpatched

Not Impacted:
2.0.x
2.1.x
2.2.x
2.3.x


The vulnerability information was purchased by Beyond Security's SecuriTeam Secure Disclosure. The discoverer of the vulnerability requested to remain anonymous. IPS thanks this group for bringing it to our attention.

Not really asking, just know that someone is going to create a thread asking, so thought I'd toss it up so that the initial "When It's Ready™" and complaints about people trying to rush IPS will all be out of the way.




^{Disclaimer:
If you think I'm actually asking when IP.Board v3.0.2 will be released, then you need to read this post again.  Continue until you stop thinking that I'm seriously asking.}

AtariAge, on 15 July 2009 - 12:35 PM, said:

We can never fix "all" bugs in any particular release.  Every day we come in, there's more new bugs reported.  If we tried to have all open bugs resolved, you'd never get 3.0.1 released.

I've said this before, but I'll reiterate - people shouldn't get hung up on the raw number of bugs.  It means nothing.  Hardcoded text is reported as a bug, but for the majority of our users that's not an issue.  Importing a language pack using windows-2943692837 when the original translator used iso-8859-1927889237 doesn't convert correctly in 3.0.0 - again, for the majority of our users this doesn't matter.

There will be bugs reported but not yet fixed when 3.0.1 is released, I'm positive of that.

nforums, on 24 June 2009 - 05:05 PM, said:

I've just been learning it myself and the integration between gallery, blogs, and forum is really great.

The final and supported version of IP.Board 3.0.0 along with its applications (Blog/Gallery/Downloads) is nearly here! We are happy to announce our last license and conversion sale before IP.Board 3.0.0 is released.

IP.Board Standard License Sale

Starting now and ending June 30, 2009 at 5:00 pm EDT the price of an IP.Board Standard License will be reduced from $149.99 to $129.99 for all new orders. The 6-month renewal price will remain the same.

Free Conversion Service

If you are currently using a different forum software, now is the time to switch to the web's most advanced community software without any work on your part!

Our staff will convert your database to IP.Board at no cost to you. This is a savings off the normal $60.00 conversion fee! This applies to basic conversions from the software listed on the conversion information page. To take advantage of this offer, just email accounts@invisionpower.com by the end of the sale and our conversion team will take care of your database conversion for you. You will need to have an active IP.Board license to take advantage of this offer.

If your software is not listed on the conversion information page, we can still convert your software as a custom conversion. Just contact sales for a quote or more information.




Please email sales@invisionpower.com if you have any questions. Thank you!






Scheduling Note

Because of the tremendous increase in conversion requests over the last two weeks, our conversions staff may work with you to schedule a general time frame to perform the conversion service. You will have a single person to work with to arrange your conversion to make the process as easy as possible. Also, when contacting about a conversion, please specify if you want to convert to 2.3.6 or wait for 3.0.0 to be released before proceeding.

Also, be sure to get your request in as soon as possible. Because IPB3 final is very close, we want to be sure all conversion requests under this sale are scheduled before the rush of requests come in after IPB3 is released.

Introducing Community Content System

Many clients have expressed interest in tools that would allow them to extend IP.Board's traditional forum community functionality by providing methods of creating new pages within the IP.Board framework.  Uses for such a system span from a simple custom portal all the way through to a complete website built utilizing IP.Board's powerful backend codebase.  When your community and site systems are truly integrated, single sign on and a matching website/forum theme become much easier.

Our new Community Content System lets you do all of this and more. CCS is a new application that allows you to create content for your site. Blog entries over the next several days will discuss some of its powerful features in more detail along with examples showing you just how easy it is to create website pages and other content just by clicking through the admin control panel. For now in this introduction, here is a brief overview of its main features:

• Page Templates
  If you are creating many pages for your website you will find that they generally follow a similar structure each time.  By utilizing page templates, you can create templates complete with the full functionality of our skin system, including use of template conditionals and plugins. You can create the HTML structure once, and reuse it for some or all of your pages. Novice users can type in normal HTML code or power users can choose to use the powerful skin tags.
  
  
• Page Manager
  The core of CCS: this tool allows you to create pages, plain and simple. No fancy terminology or new methods to learn. A wizard will guide you through creating your pages, and allow you to configure things like permissions for who can view the page, which page template to use, and more. Pages can be edited as raw HTML, raw PHP, or through our traditional WYSIWYG editor using BBCode. You can also set page-types as JavaScript or CSS and the system will automatically detect those special types.
  
  
• Media Manager
  A tool to allow you to manage images and other media for your site.  You can define the root path to your file storage directory, and then create folders and upload image files within that directory via the ACP.  You can move and delete files and folders from the ACP as well.
  
  
• Block Manager
  An extremely powerful tool that allows you to create "blocks" for your pages. Blocks are inserted utilizing template plugins so you can insert blocks anywhere in the CCS content or even anywhere in your forum community using the skin manager in the admin control panel. This means that content blocks you create in CCS are not just limited to that application!  There are three types of blocks you will work with:
  
  
  • Custom - create blocks by editing BBCode (using our WYSIWYG editor), raw HTML, or raw PHP. Input any information you like.
    
  • Plugins - some blocks require code to execute in order to determine what should be shown.  For instance, you may wish to show a mini-calendar on one of your pages or a login box so users can login right from your home page.  Plugin blocks allow developers to create blocks that can easily plugin to the system without having to create code modifications.
    
  • Feeds - not just limited to RSS.  You can create "feeds" of almost any type of data - forums, topics, replies, calendar events, blog entries, gallery images, download manager files, and of course traditional RSS imports.  A wizard will guide you through creating these feeds, allowing you to specify how the feed should be pulled (do you want to show the last 5 gallery images?  what about a random sampling of forum topics? how about all topics from the visitor's friends list since their last visit?) to make it simpler for you to define the block.

The system is very flexible, allowing you to do nearly anything you want, while at the same time providing a simple user interface and wizard-based approach for creating content to keep things easy for newer users. Power users can ignore all the special features and just type in raw-PHP if they prefer. The choice is up to the administrator.

The CCS supports friendly urls (you define the folders and page names while creating pages), and does not require the page output to be accessed through your forum directory. This means you can have your community at example.com/forums but your main web site can show under just example.com easily. You can use IP.Board's skin system (inheriting the forum skin) or you can elect to create raw pages without inheriting any CSS, wrapper, or JavaScript from IP.Board.


Pricing and Availability

The CCS was developed completely separately from the IPB3 and applications process allowing us to develop CCS without any delay in IPB3's development time. As such, we are happy to say we will be able to release CCS about two weeks after IPB3's first supported release! Pricing will be announced at that time.


We are sure there will be many questions about the CCS and we welcome them. Over the next several days there will be blog entries on our company blog going into greater detail on each of the core features of CCS. Hopefully all of your detailed questions will be answered then. Please accept our apologies if we may sometimes ask you to wait for the next blog update before answering your questions. Thank you!

I managed to find your article, not too bad but that is old

I think I will write a hook for IPB 3..

I could not actually find it on there apart from the combined one, so made another one quickly, but you have seen it anyway and are writing one for 3.0 (which will mean one less one for me)

Although I understand your position on this is based on the bottom-line, and available time, I'm still rather irked by this, even though I have to agree with what you said. I mean, within months of the only practical way to get a progress bar with a *Stable* PECL library, that Hosts would be willing to install on a Shared server..... you kill the ability to use it!

The timing was particularly lousy from my perspective. The feature was there for ages and, although UploadProgress was still in Beta until recently, it actually DID work. PECL:APC was never a solution, since it had known problems with Zend from the get-go. It just baffles me that that functionality was removed, even though I know it's very likely that a better replacement will be written eventually. I guess it's the "eventually" that irks me most, but I realize I'm in a tiny minority when it comes to this.

Owell. Guess I'll have to wait another however-many-more-months it takes. *grumble*

Bakakid, on 04 June 2009 - 11:44 AM, said:

I'm guessing that was aimed at me.

I didn't completely disregard the purpose of those modifications. I was stating through personal opinions that for me they are pointless.

Also, I said that the shoutbox influences people to not post in the forums. Not the Chat bar.

Regardless of those points, I believe that with the chat bar an option should be included to either allow it to be used globally with all members as well as with friends.

I just want to say that something is definitely right about IPB3.0.

In the couple weeks that IPB3.0 RC1 has been out, I've already downloaded a dozen hooks/mods that have drastically improved my forum. My members are loving the little features here and there.

Although I can't say I know much about the code, I will admit that it seems a lot easier for modders to create really awesome hooks (with relative ease?). New mods are released almost everyday, and it's obvious that there should be some really awesome applications in the near future!
Specifically, want to give credit to some of the community devs/coders who have already released some really useful mods: SOSInvision, Michael, m4rtin, Alex, MichaelJohn, teraßyte

It's really positive to see developers releasing so many mods so quickly, as I felt one of the biggest problems in IPB vs vB was the modding community. Hopefully more coders will pick up IPB3.0 and start developing new and intuitive modifications!

I, for one, know I'll be spending money rewarding some of these awesome coders!
Just my 2 cents!


Keep up the great work and look forward to RC2 and beyond!

if sucking up gets me RC2 then i will do it as well

We turned it off because a few of our members felt the need to target certain other members and negative rep all their posts.  In any event, you can turn it on and off and there are some controls for it in the ACP.

You can modify a member's total reputation points from the edit member screen in the ACP