Show all posts by user
If you are having a problem with Phorum, this is the place to look for an answer. You can also find help on our Discord.
Re: Phorum 5.2 and php7 - 6 years ago
Hello, I am testing my 5.2.22 installation, that used to run on PHP 5.6, on PHP 7.2 I have done just some very simple tests on the main operations: - login - change my password - post - reply - save general settings in admin and a few others. I haven't see, so far, any evident problem. I also see warnings, but I saw warnings even on PHP 5.6 and it's hard to say if the warniby eugenio - Phorum Support
Re: Improving md5 password storage security - 9 years ago
Too bad it looked like a spammy message :)by eugenio - Phorum Development
Re: Improving md5 password storage security - 9 years ago
@Skye: OK. Even in that case, however, I think it's not the first 8 chars of the encrypted password. @phorum staff: I've sent an email to security@phorum.org, describing the changes I've done to implement salted storage and describing a (potential, not sure) security hole in the current Pby eugenio - Phorum Development
Re: Improving md5 password storage security - 9 years ago
Hi Oliver, OK. Can you confirm the rest of the analysis is OK? QuoteOliver Riesen-Mallmann Hi Eugenio, 1) change password and password_temp to varchar(255) in DB Even if you don't care yet about upgrading, I prefer to use new password and password_temp columns in the database. Regards Oliverby eugenio - Phorum Development
Re: Improving md5 password storage security - 9 years ago
Hello Skye, why you say that only the first 8 characters are sent, when you request a new password the whole password in clear (NOT encrypted) is sent over email. QuoteSkye N. I could be wrong but my feeling is that since you're only sending the first 8 chars of the encrypted password over email, there's little or no riskby eugenio - Phorum Development
Re: Improving md5 password storage security - 9 years ago
Hello all, I am trying to figure out what to do to improve security. Let's assume for a moment that you don't have to upgrade existing passwords. Changes needed: 1) change password and password_temp to varchar(255) in DB 2) in users.php change: $dbuser[$fld] = md5($dbuser[$fld]); to: $dbuser[$fld] = password_hash($dbuser[$fld], PASSWORD_DEFAULT); 3) in users.php substby eugenio - Phorum Development
Error using SMTP module - 9 years ago
Hello, I have enabled the SMTP module but when I try to post a test message I get a Class 'SMTP' not found error in the file class.phpmailer.php I can fix it adding: require ("class.smtp.php"); on topo of class.phpmailer.php but I would prefer to avoid it and understand why the autoloader is not working. Best, Eugenioby eugenio - Phorum Support
Re: Improving md5 password storage security - 9 years ago
All you said is correct, but storing passwords using a better encryption is so cheap in terms of development cost (probably a few lines of code) respect to its advantages that is the first thing I would implement. Eugenioby eugenio - Phorum Development
Re: Improving md5 password storage security - 9 years ago
Hello Scott, thanks for your reply. I saw the change has been committed on 12 Oct 2016 so it has been included in the last version of Phorum? And what is this change supposed to do? I only see that it forces the users to change their password, but is the encryption still the same? Thanks Eugneioby eugenio - Phorum Development
Re: Improving md5 password storage security - 9 years ago
Hello, any news about this topic? Phorum is still using not salted md5, right? Is there any plan to improve security or any module to implement salted password encryption without hacking the core code? Thanks Best, Eugenioby eugenio - Phorum Development
Re: Notification email with post content - 9 years ago
Slightly related to the problem above: I now correctly receive an email when a new message is posted, but I don't receive an email when someone replies to a post, why? Thanks again. Best, Eugenioby eugenio - Phorum Support
Re: Notification email with post content - 9 years ago
Perfect, thanks a lot! Eugenioby eugenio - Phorum Support
Notification email with post content - 9 years ago
Hello, I've just upgraded my phorum installation to the last version 5.2.22 and I've noticed that when a new post is published I (as administrator) receive an email with a link tho the post, but the email doesn't contain the content of the post, while in my old installation there was the content as well. I can't remember if there was a setting, a module or something else thatby eugenio - Phorum Support
Re: SSL MySQL connection - 10 years ago
Hello, yes I was referring to the encryption of the MySQL connection. It is extremely useful to provide security in some situations, for example when your DB is hosted elsewhere respect to your PHP scripts. I have implemented a secure connection with an Amazon RDS instance changing these few lines in mysqli.php From: $conn = @mysqli_connect(...); to: $conn = mysqli_init(); mysby eugenio - Phorum Support
SSL MySQL connection - 10 years ago
Hello, Is it possible to establish an SSL connection with the MySQL database that hosts phorum? Thanksby eugenio - Phorum Support
"all dates" search by default - 13 years ago
Hi, is there a way to set "all dates" as the default for searches? I have found a related topic but it was about subthread. Thanks!by eugenio - Phorum Support
Re: Upgrade from 3.x: number of posts and date of registration - 15 years ago
Maurice, the database integrity tool works fine and also the email template solved my problem. For the registered date: I created a simple script that takes the datestamp of the first post of each user, I think it's a good approximation. Thanks a lot for your support, I converted my old forum (more or less 10000 messages) of my project DaDaBIK (www.dadabik.org) and everything seems to woby eugenio - Phorum Support
Re: Upgrade from 3.x: number of posts and date of registration - 15 years ago
Last thing: I remember that with the 3.x phorum an email message arrived to me and other administrators when a new message was posted. The e-mail contained subject and body of the new post. Now (5.2) I get only a message, with the subject of the post but without the body...can I change this? I'm not sure, maybe the e-mail of the 3.x installation was a hack, I can't remember :)by eugenio - Phorum Support
Upgrade from 3.x: number of posts and date of registration - 15 years ago
Hello, I have upgraded my phorum version 3 to the last 5.2 one using the relative script. Two questions: - it seems that the date of registration is set for all the users to TODAY, maybe because the old phorum didn't keep track of this info? - the number of posts starts from 0; maybe I could change (just once) the phorum_users.posts field using an update SQL statement together with a couby eugenio - Phorum Support
Re: Rating user/thread & karma - 16 years ago
Thanks for sharing your point of view Maurice. I worked for a period with Oracle Apex (http://apex.oracle.com/i/index.html) and I remember that the developers forum was very useful and attract people to create community. Now I'm quite busy but in the next days I'll try to come back there and report here which are in my opinions the features that made it so useful.by eugenio - Phorum Support
Re: Rating user/thread & karma - 16 years ago
Thanks for your answer, I will try it. I think a reputation scheme is quite important because attract people to actively participate in the community and increase the trust people for the forum.by eugenio - Phorum Support
Rating user/thread & karma - 16 years ago
Hi all, can you point me out which are, if available, the modules that allow rating user/thread and calculate the "trust" (or something similar) of a user? At the moment I've found only this one (it's about rating a thread): "Module: Rate This Thread" Thanks a lot in advance. Eugenioby eugenio - Phorum Support