Anyone running a Wakaba board ought to read this.
There's a serious vulnerability in Wakaba 3.0.8 and below which let's anyone inject whatever HTML they want to in posts. This can be fixed by removing a couple of lines in the get_decoded_hashref() and get_decoded_arrayref() subroutines in wakaba.pl, as shown in the included patch file. There should be no problem in making these changes.
Board moderators with no access to the board files may add /chr\([0-9]/ to spam.txt in order to fix the problem.
Looks like that is there to work around some absurdity in MySQL. I supposed MySQL has since changed and is now doing the wrong thing?
I'll put together a 3.0.9.
Pay no attention to the devs that tell you that you don't need something, such as noko. They seem to be into some weird sub/dom kink and want the world to bend their way. Just fork their code and make it better.
>>95
Or you know, they could just not feel obligated to bend to your every need.
> Just fork their code and make it better.
The sort of people who want things like noko aren't capable of that.
Just did these for a guy in another thread, but I might as well post them here to keep things organized
Hold back posts for moderation 1/2
Hold back posts for moderation 2/2
>>100
Just do ALTER TABLE comments ADD approved TINYINT; in the sql interface
>>101 Not for me, for others :p
I do get this error when I click an approve link within the admin panel:
DBD::mysql::st fetchrow_hashref failed: fetch() without execute() at wakaba.pl line 2066
Ignore the line number, my copy is modded.
sub get_decoded_arrayref($)
{
my ($sth)=@_;
my $row=$sth->fetchrow_arrayref();
That's the issue line.
>>102
No idea. Are you using SQLite or a regular mysql database? I've only tested this on SQLite. Also, did you try to run the actual patch on your modded wakaba.pl? That could very well be the issue.
The mod works, it just also throws that error into the error log. It's just MySQL.
What happended to this site? Everything I see here is so old :(
AND I have no clue about how to get kareha running.
>>105
Wakaba is mostly mature at this point. There really isn't too much to do to Wakaba to make it a futaba channel clone so therefore, there really isn't much to discuss. I suppose it would be nice to update Wakaba and Kareha to make it HTML5 semantic.