Facebook App - Does it Support Modifications?

[thincom2000]

Well, they could do that anyway with any kind of distributed attack, but it is harder to accomplish. By contrast, the session table attack I've discussed requires very few resources or coordination and...

[thincom2000]

I can certainly do that, and probably will, moving forward. However, it is not a standard vBulletin setup to list cron.php in the server's crontab -- that is, it is not in the installation instructions...

[thincom2000]

First, the kind of attack we're discussing affects very small hobby and niche forums with low traffic -- I've mentioned that low traffic is required to perform that attack successfully. As soon as non-attackers...

[thincom2000]

I'm dealing with 0 real users online at the same time and 50,000 attackers at the same time that have the same user ID and IP address(es). Thus cron.php never runs and they are able to keep creating sessions...

[thincom2000]

Five legitimate users with the same user ID? That doesn't make sense to me. If you want to account for guest users, you can make two limits, one for guests (higher, maybe 1000) and one for logged in users...

[thincom2000]

It turns out the vulnerability I noticed was not attempting to cause email SPAM but was instead attempting to cause a Denial of Service. See: http://tracker.vbulletin.com/browse/VBIV-16057

[thincom2000]

Had a similar problem. Logged-in SPAM users have been using entry.php?do=sendtofriend&do=sendtofriend to fill up the session table completely. This repeats every couple of days. That seems like a...

[thincom2000]

Unfortunately that JIRA link now only shows PERMISSION VIOLATION, and unfortunately after reviewing the code for vB 4.2.1 (implied heavily as the fix release in http://www.vbulletin.com/forum/forum/v...

[thincom2000]

So in other words, we have to modify core files. There's no hooks or template hooks? For a premium add-on product, modifying files is not something we ever want to ask our customers to do as part of an...

[thincom2000]

I have been asked by some customers to look into the Facebook app in order to integrate our own third-party vBulletin product VaultWiki into it. However, it will be useless to purchase the Facebook app...

[thincom2000]

Yup, I borked my live installation once because my testvb used the same datastore prefix.

Also, the DISABLE_MAIL pleases me since we can specify email addresses that are okay, but is there a syntax to list more than 1 OK address?...

[thincom2000]

You have to upgrade the mod. Old versions of mods are not compatible with vB 4.1.4 because vB changed its WYSIWYG code. They told us when vB came out that it would break mods, I don't know why they didn't...

[thincom2000]

Hasn't seemed slow to me at all. Perhaps the issue was during the upgrade attempt 1 and actual upgrade. If they were making changes to the database structure and file system, this would definitely cause...

[thincom2000]

Reviewed the code for Cyb - Advanced Forum Rules and this can be the culprit as I see an exploit there: you can inject SQL and modify the database if you tamper with the HTML form when agreeing to the...

[thincom2000]

If vbf.php is the backdoor, it's not a default vBulletin file. A simple google search implies it stands for vbFreelancers, which is a group that has made a number of modifications for vBulletin. If all...

[thincom2000]

While there may be some browser tools to read web pages in other languages, as mentioned above, services like these will not be perfect.

When you want to switch the forum from one language...

[thincom2000]

After downloading the ZIP again, I notice it hasn't been updated since last January. Will there be an update soon for the icons used in the Mobile style?

[thincom2000]

1. I don't believe so, vBulletin doesn't have shopping cart support and leaves it up to the site owner to integrate a third-party cart (except for paid subscriptions). If you are talking about a paid...

[thincom2000]

You can set a number of image paths using the stylevar system. When editing stylevars, search for the imgdir variety.

For background gradient images, search for "background" and...

[thincom2000]

You don't need an extra license for the CMS. Simply create 2 "sections", English and Spanish, and give them the custom URLs /en and /es. Then just create your language content in the appropriate...