All right, I'm calling this DONE.

http://wakaba.c3.cx/releases/kareha_3.1.0.zip

A review of the main changes:

• Post previewing through fancy-pants XMLHttpRequesting.

• More anti-spam options:

  • There's now a spam bot trap, which involves hidden fields named "name" and "link" that will cause your post to be discarded if they are filled in, as most spam bots will do. This can be disabled with the SPAM_TRAP option if it causes trouble. Custom templates will need to be updated as the real name and link fields are now called field_a and field_b.
  • You can now specify multiple spam files, to allow you to easily keep the normal spam.txt up to date, while adding your own entries to another file.
• You can now select which markup formats to support.

• Admin updates

  • Easier configuration of IP masking.
  • More configurable file editing.
  • Multiple deletion
  • Simple banning (you can have the script add lines to a file according to a template. The default setup adds .htaccess lines).
• Fixed URL parser to handle Wikipedia links, and removed the http: bug.
• Fixed >>q links.
• Fixed the auto thread closing (which wasn't working on 4-ch)
• Fixed the bug that wiped out a bunch of threads here.
• Added rel=nofollow to HTML mode.
• Made the error page for too long comments mention how much too long they are.
• Added .rb to FORBIDDEN_EXTENSIONS.

After upgrading to this version, users will most likely need to shift-reload to pull in the new CSS and JS files. I added support in this version for checking the JS version so the script can tell the user to do this automatically, but it will only work starting from the next update.

One thing that's missing still, that I'd really like, is DNSBL support. The SBL and XBL (http://www.spamhaus.org/xbl/) in particular would be very useful, since they list spam web servers, so you could parse the posted message for links, and look those up in the black lists. The problem is that a DNS lookup is relatively slow, and if you have to do a lot of them, it will take too long to post. Doing multiple DNS lookups in parallel is what is needed, but doing it by forking is kind of expensive. The system calls aren't thread-safe, either, so threads are also out. What's needed would be some sort of custom UDP DNS lookup code that can do multiple lookups, but I don't really have the time to work on that. If anyone wants to flex their Perl muscles and implement this, I would be really thankful.

>spam bot trap

Neato!

Good show all around, old bean.

Awesome! For the past 2 days, my board has been getting spammed like crazy. Hopefully this new version will do the trick!

Oh, and of course, thanks to rotter in http://wakaba.c3.cx/soc/kareha.pl/1104803127/35 for the idea for the spam trap.

Forgot this one new feature:

• The spam file now supports regular expressions. Any entry surrounded by // will be treated as a regular expression. The "xism" flags are also supported. For instance, to forbid all HTML links:

  /<a[^>]+href=/is

Thanks for the release! I'm having a little trouble, though, with my image board at http://dongs.hadoken.net

The deletion password input field in mode_image doesn't seem to have an auto-generated password, even after the first cookied post. I'm using a custom templates.pl file with "field_a" and "field_b" instead of "name" and "link".

Ah, the Javascript function set_inputs() has changed name to set_new_inputs(), to avoid having the old one fill in the "name" and "link" fields by accident during the upgrade. You need to change this in your template.

Changed all "set_inputs" in templates.pl to "set_new_inputs" and the issue remains the same.

Any errors on the Javascript console?

>>10
How would I check that? :(

>>11
In Firefox, it's under Tools > Javascript Console

Ok, I'm a little dumb, but how do you properly upgrade an existing board with the new version?

I don't want to accidently erase all the existing posts or something stupid like that. And I'd like to keep everything configured the same way as it is now, if that's possible too.

Are there just a few specific files that I need to overwrite?

If you haven't made any changes to the template, just copy in all the new files (from kareha/, kareha/mode_message/, and kareha/mode_message/css/), except config.pl. To be on the safe side, back up your config.pl beforehand. Then rebuild caches.

If you have changed the template, it's trickier, and you need to combine your changes with the new template.pl. Hopefully you haven't done that.

>>12
Brought up the Javascript Console, nothing to show at all.

Thank you very much making multiple deletion system,
It would greatly reduce my time for managing the board.

Well Ive updated the program but with Firefox I get
XML error when I click the Thread name in board.
Saying XML path Error need to close </a>

It only happens to the thread that is not in top page in BBS.

Is there any way I can fix this problem?

Oh forgot to write the URL

http://no1game.temporarydomain.net/bbs/

Thank you.

Should I post message in this thead or support thered?

sorry it get solved. Ive uploaded old version of template.

Okay, it seems the issue I reported in >>7 had nothing to do with the deletion password itself, but rather with the script not creating cookies (as names and e-mails aren't saved either).

Please tell the story behind VIPPER.css!

It's just the slightly different style used on http://ex14.2ch.net/news4vip/.

Oh, that's what I thought. The addition of this style made me realize that using red only to mark capcodes isn't sufficient to make them usable for their purpose.

Bumping for >>19.

mode_message/templates.pl:use constant S_CLOSEDTHREAD => 'This thread has been closed. You can not post in this thread any longer.';
mode_message/templates_jp.pl:use constant S_CLOSEDTHREAD => 'This thread has been closed. You can not post in this thread any longer.';

There is no "can not", only "cannot".

You can not post, if you want.

The bugs have been piling up for a while, so it's time for a bugfix release.

http://wakaba.c3.cx/releases/kareha_3.1.1.zip

This version has nothing new, but it's a recommended install to get rid of some bugs and minor security issues. Changed files are kareha.pl, wakautils.pl, admin.pl, templates.pl and config_defaults.pl (only the version number bump, nothing else).

Fixed bugs include:

• Problem with posting in IE and Opera under some circumstances.
• Spelling and template fixes (thanks to >>25 and whoever it was that complained about the "Lorem ipsum")
• Attempt to fix compatibility with Perl 5.005 again.
• Some minor security fixes, to be explained later.

Needs more supersage. lolololol

Argh, you changed templates.pl again? What is new there?

>>29

Just some fixes in the string section, nothing to worry about.

>>30
Could you specify what the changes are, exactly? I'd like to import them into my custom template file. Thanks.

>>31

I think it was just some spelling fixes in the error strings. Just copypaste those.

Whee!

(Safari 2.0.4, btw)

>>33

Hmm? That's pretty much correct behaviour, even though it's annoying.

Post previewing doesn't seem to behave nicely with non-Western characters/encodings (ie, when copy-pasting SJIS art).

>>35

That's a per-browser setting, not kareha's fault.

>>35

It works fine for me, at least. It relies on the .innerHTML attribute using the same character set as the page, which seems a reasonable assumption... What browser are you using?

Hey, I know the "Preview Post" feature depends on AJAX, and that's just fine. But it's a little surprising when "Post Preview" submits the post, due to JavaScript being off. Can you make it not do that? Just a thought.

If it does that, your browser is broken - it's a type="button" element, not a type="submit" element.

How do you even see it with Javascript off?

When you preview post, can you set it to detect what text formatting option is selected? I'd love to use it for previewing my AA but it is unusable for editing AA.

>>40

It's supposed to do that already, and people use it for that. What browser doesn't it work in?

idea: when using the email field, only allow it to create a link if it seems to be a well-formed address. Like, don't link any random thing tossed in there, only @.* stuff.

testing >>38 with css and javascript turned off (which allows the button to be seen) does nothing.

>>42

It's kind of traditional for "sage" to become "mailto:sage", though. Right now it checks for a well-formed http:// or other address and makes that into a normal link, and adds mailto: as a fallback.

(PS: You shouldn't throw around the word "well-formed" so easily when talking about mail addresses: http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html)

>>44 Dear god! That link is insanity!