Jump to content

OctoDev

Clients
  • Posts

    1,083
  • Joined

  • Days Won

    1

 Content Type 

Downloads

Release Notes

IPS4 Guides

IPS4 Developer Documentation

Invision Community Blog

Development Blog

Deprecation Tracker

Providers Directory

Forums

Events

Store

Gallery

Posts posted by OctoDev

  1. 34 minutes ago, HeadStand said:

    I am unable to reproduce this issue. 

    I'm about to push a new version to the MP, so please re-test with the latest. Maybe some of the other fixes I made have corrected this. Please confirm if this is still a problem.

    A new version has been pushed to the Marketplace. Changes include:

    • Dates were not parsed properly on distribution. Fixed.
    • Topic format setting was not honored when posting to the forums. Fixed.
    • When sending a newsletter with no custom template, the IPS email wrapper is now used.
    • Truncation setting was not honored on HTML distribution. Fixed.

    Note: I forgot to put the last item in the release notes, but it is fixed in this version.

    I updated it, but it looks the same. Maybe I have to reinstall?

     

    mDMfnnh.png

     

  2. 45 minutes ago, HeadStand said:

    That's actually a bug. If you're not using a custom wrapper, it's supposed to use the default. I'll add it to my list. Thanks! 

    Just an FYI - I probably will not have a chance to fix these issues today, but will work on them tomorrow. 

    this is how it looked in the email, still buggy? i hope :)

     

    BslmgIa.png

  3. 22 minutes ago, NoGi said:

    Ok so it doesn't matter how many blocks I use. If they are set to use custom HTML, the first block is overriding them all.

    It's the basic content, you need to now apply a custom HTML to it so that it matches your site. I'm trying to learn this now. A bit of a pain but actually pretty powerful once I can figure it out.

    was hoping there would be some .. i bought a similar news letter service for not even half the price and it had a nice layout, just didnt work xD

  4. 23 hours ago, NoGi said:

    I'm happy to pay more for a responsive developer rather than less for a non-responsive one.

    i must agree, paid ffor another one that never worked :) waiting to get my refund now for it, then i'll buy this.

  5. demo would be nice

    7 hours ago, Joel R said:

    I'm looking into buying this plugin.  (Thanks for developing it!).  Some questions / feature requests:

    • Disable on mobile view
    • Set height
    • Allow per-topic setting to "collapse" topic cover by each user / allow per-user setting in Account Settings to "collapse" all topic covers  
    • Default topic cover per category 

    vouch, would buy if this is added

  6. 1 minute ago, Makoto said:

    One option is to keep your applications and plugins folders locked down (remove all writable permissions), but you have to be careful when doing this. If you ever need to update or install a new application (including IPS core applications themselves), you must remember to re-enable writable permissions to the folders.

    Outside of that, if security is paramount one of the best things to do is implement a Mandatory Access Control system with grsecurity, but this is a very advanced and complicated topic.

    Welp.

    I want to allow the users to upload photos though? 

    i do not allow users to upload files at all, but i believe same exploit exists in gallery and avatar.

  7. 1 minute ago, Makoto said:

    @Jimmy Gavekort thanks for taking the time to share that, but I'm afraid there's not a practical use for it.

    I had a similar set of rules at one point, but considering that the applications folder and so on are ordinarily always left writable, all someone would have to do to get around that is upload malicious scripts to the interface folders. Even if you whitelisted individual scripts in the interface folders, an attacker could still overwrite those files with malicious code.

    So it's a lot of hassle for little to no benefit.

    So what do I do to protect my self? lol

    I warned IPS about this exploit months ago, met with ignorance and they told me it's my own fault...

  8. I have these rules.. I'm safe?

    server {
    
    server_name domain.net www.domain.net;
    
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Xss-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;  
    
    
    # ngx_pagespeed & ngx_pagespeed handler
    #include /usr/local/nginx/conf/pagespeed.conf;
    #include /usr/local/nginx/conf/pagespeedhandler.conf;
    #include /usr/local/nginx/conf/pagespeedstatslog.conf;
    
    
    root /home/nginx/domains/domain.net/public;
    
    include /usr/local/nginx/conf/cloudflare.conf;
    
    location ~ (?:^|/)\. {
      deny all;
    }  
    
    location / {
      include /usr/local/nginx/conf/block.conf;
      try_files    $uri $uri/ /index.php;
    }
    
    
    
    
    # IP.Board PHP/CGI Protection
    
    # Allow Access to Interface Files
    # Add Your Specific Application to the List if you Add New Applications
    location ~^(/applications/(blog|calendar|chat|cms|core|downloads|forums|gallery|nexus|pastebin|companydirectory|rules|videos|notes|iawards|links|pmviewer|readthattopic|rules)/interface/).*(\.php)$ {
      allow all;
      include /usr/local/nginx/conf/php.conf;
    }
    
    # Block Access to PHP / PHTML Files
    location ~ ^/(uploads|datastore|system|plugins)/.*\.(?:php\d*|phtml)$ {
      deny all;
    }
    
    # Block Access to Application PHP / PHTML Files
    # Add Your Specific Application to the List if you Add New Applications
    location ~ ^/applications/(blog|calendar|chat|cms|core|downloads|forums|gallery|nexus|pastebin|companydirectory|rules|videos|notes|iawards|links|pmviewer|readthattopic|rules)/.*\.(?:php\d*|phtml)$ {
      allow 127.0.0.1;
      deny all;
    }
    
    location ~* /phpMyAdmin {
    	deny all;
    	include /usr/local/nginx/conf/php.conf;
    }
    
    
    
    include /usr/local/nginx/conf/staticfiles.conf;
    include /usr/local/nginx/conf/php.conf;
    include /usr/local/nginx/conf/drop.conf;
    #include /usr/local/nginx/conf/errorpage.conf;
    include /usr/local/nginx/conf/vts_server.conf;
    }

     

  9. This plugin needs updating.

    [[Template core/front/global/navBar is throwing an error. This theme may be out of date. Run the support tool in the AdminCP to restore the default theme.]]

×
×
  • Create New...