« first day (805 days earlier)      last day (4143 days later) » 

9:00 PM
but move on. I mean, that is the reason it isn't working?
 
@DanielMinett So then it seems the information we are looking for is not in there
 
@Jasper I noticed earlier you mentioned a line of code, it is different to this one: <?php session_start(); var_dump($_SESSION)?>
 
@DemCodeLines No. It shouldn't. After submit you should have a $_POST['url']
 
@DanielMinett The only difference is that originally I thought we had to initialize the session ourselves, and now I am assuming that vBulletin does that for us already and the fact that $_SESSION is not empty shows that I am right about that
 
@Jasper Ok, what should we do now?
 
9:04 PM
@ircmaxell getting closer to a minimal test case for that leak
buffer overflow*
 
@DanielMinett I'm looking into something right now. Basically, we have to find out where they do store something we can identify the user by, as they must store it to be able to identify the current user by themselves
 
@Jasper, could we query the database when the hyperlink is clicked?
 
@igorw awesomew
 
@DanielMinett Yes, I do intend to query the database, but the database holds all users and there is no way to find out which one is the current user, which is what we need to find out first
 
Oh yea of course, would the info we need be stored HTTP? @Jasper
 
9:11 PM
That moment when a fool proof password API is just not enough
 
@DanielMinett The usual place to store such a thing is the session variables, but I can't find anything there.
 
lolol
What exactly was you expecting to see?
@Jasper
 
Anything that could be the user id
@DanielMinett Let's try <? var_dump($_COOKIE) ?> it makes no sense to store it there as it makes it really hard to do things safely then, but let's at least see what they got there
 
@Jasper its VB, I would not be shocked. On it
@Jasper your the man
 
@DanielMinett How so?
 
9:16 PM
@Jasper pastebin.com/gZbwjy5k Told you VB do silly things
 
@DanielMinett Fair enough, it may just be that I don't understand $_COOKIE well enough, I'll be reading the manual and possibly asking some questions here later, btu let's first get this link thing down
@DanielMinett Do you have a frontend that let's you interact directly to the database?
 
@Jasper sounds good
PHPMyAdmin :)
 
@DanielMinett Just thinking for a second here: is it a problem if users can fake votes? if it is we might need to change our approach a little, as the way I was planning to do things was to add the username to the GET variables of the request of the external file, but that's easily fakeable
 
@ircmaxell I only have 5.5 compiled with --enable-debug, can you maybe check against 5.4 and 5.3?
 
9:23 PM
@PeeHaa user updated question it now has password_verify($form_password, $hash) where $hash is $form_password hashed. So yeah the password will verify all the time.
 
No major issue, the link goes to another site and only allows IP votes per 24 hours
@Jasper
 
Ok
 
@Jasper Plus the popup box on my site only shows once evrey 24 hours unless you edit/delete the cookie for it
 
@DanielMinett The idea would be that the entire popup box could be avoided this way
 
Ahh we need the popup box @Jasper
 
9:29 PM
@DanielMinett The way I was thinking about doing things, the user can copy the link from the popup and paste it in the browser to vote again, and the link will include his or her username, which if he or she changes to another user name becomes indistinguishable from that other person voting.
Working around these issues is possible but makes the whole thing harder
 
@Jasper I understand but we had to put the popup there because people where not voting otherwise
 
Hey! I'm new here in stackoverflow :) Playing one game then will chat more
 
We have seen nearly 2000 more votes in around 14 days because of it
 
@DanielMinett I didn't mean that you need to remove the popup, just that a user with a clever eye can spot the weakness in the system and vote without using the popup and even fool the voting system into thinking he's another user
 
@ECode Hiya!
Hope you didn't mind I edited your answer :)
 
9:31 PM
@DanielMinett Anyway, there's a table named user possibly with a prefix and in that table there should be a column that holds the username. What we need to know the exact name of that table and the name of the column that holds the username
 
@Jasper, ohhh so we would still have the popup then? If so, thats not an issue. We can see from the number of votes per username if someone is voting more than 31 times a month
One second, I know it but want to double check
 
@DanielMinett Good. And it's not a problem either that I can go to http://someurl.com/vote.php?user=DanielMinett and the system thinks that I was you voting?
 
Table: vb3user
Column: username

@Jasper
Yeah thats no issue @Jasper
 
@DanielMinett Ok. What we'll do is we'll change the plugin file to do a query on the database that's something like `SELECT username FROM vb3user WHERE userid = <Id>', where <id> is the contents of $_COOKIE['bb_userid'] and then echo the username we have. Basically, what the plugin does now is echo the username of the current user
 
9:38 PM
Oh ok
Not too hard
What should I do now with that? @Jasper
 
Then for the popup template we'll do something like: <a href='http://voteurl.com?user={plugin}>Click here</a>. Then in the external script you can use $_GET['user'] to see who voted.
(Also if strange characters are allowed in the usernames, it might be good to have the plugin do urlenconde on it before it echos the username
 
@Jasper sorry internet was playing up
Nah no unusual characters are allowed
Ok, so how do we attack this from here
 
Basically, I believe it's all there
 
Sweet. So the first section just create a new file in root for it?
 
@DanielMinett Don't know which part you mean
 
9:49 PM
`SELECT username FROM vb3user WHERE userid = <Id>', where <id> is the contents of $_COOKIE['bb_userid'] and then echo the username we have. Basically, what the plugin does now is echo the username of the current user
Sorry its been a lot of years since i did anything like this so trying to get back into it
 
No that'll be replacing the var_dump($_COOKIE) we have in the plugin
 
Oh ok, so right into file gotcha
@Jasper should we use '<ID>'
<Id>
 
No I just used it as a placeholder
 
Sorry getting back into this, should we define a specific term or use 0?
 
We use $_COOKIE['bbb_userid'] for it
 
9:57 PM
ahh ok
@Jasper Slap me if this is wrong

`$vote = mysql_query ("SELECT username FROM vb3user WHERE userid = $_COOKIE['bbb_userid']");`
 
@DanielMinett it's wrong
 
Educate me :P
Please
 
first , you need to put $_COOKIE['bbb_userid'] in braces if you want it in string
but don't do it ;)
 
Lol ok? Confused slightly haha
 
It is vulnerable to SQL injection that way
 
10:01 PM
@TheCOMPLETEPHPNewbie That's the basic idea (there are some problems with it, though, as (1) you should use mysqli_* pr PDO instead of mysql_*, (2)you probably need to connect to the database as well and (3) using a way to escape the userid(like intval()or using prepared statements) is a good thing to make sure here's no SQL injection (as we don't know where it has been)
OF course, there's also the issue @dev-null-dweller mentioned and I missedf
 
@DanielMinett Since $_COOKIE comes from the user it's possible they have sent a malicious string. You should use prepared statements to prevent it.
 
@LeviMorrison Sorry I am right now a high level noob. I'm not 100% sure what to be doing
 
If user id is numeric you can just do "sql here = ". intval($_COOKIE['bbb_userid'])
 
and not need the rest of the stuff?
$vote = mysql_query ("SELECT username FROM vb3user WHERE userid = . intval($_COOKIE['bbb_userid'])");
 
nope, $vote = mysql_query ("SELECT username FROM vb3user WHERE userid = ". intval($_COOKIE['bbb_userid']));
 
10:05 PM
Fuck I love the new zimbra web interface a lot
 
@dev-null-dweller Ahh I see where I messed up
 
@PeeHaa Easy on the language :)
 
@PeeHaa thanks for help in 'password_compat' question
 
0
A: Basic php Regex Help for changing url structure

hakreYou want to add s720x720 between the dirname and the basename (if taken the URL as a path). PHP has a function to out the URI apart here (see pathinfo): $url = 'http://sub-domain.example.net/random-folder-here/4422414324235_4234234.jpg'; vprintf("%s/s720x720/%s", pathinfo($url)); Output: http...

^ pathinfo FTW.
 
@LeviMorrison Sorry. However that is really how I feel about the new interface. I think I want to make love to it ;)
@dev-null-dweller np :)
 
10:09 PM
@PeeHaa Screenshots?
 
@Jasper Can you invite me into a private chat please? Not sure how
 
1 sec
 
@LeviMorrison ^ for a completely free and complete mail solution I think they have done a pretty good job
 
@PeeHaa i still have free google apps (:
 
10:13 PM
@Lusitanian I never got used to the new google mail web interface
 
@PeeHaa eh, i'm totally fine with it
i'd rather run my email servers myself but sooo lazy
 
Hey guys, new question. Is there a way to fill a chart using mysql resuts without using a foreach? My idea is if ID matches chart ID put it in there, it's for a calendar scheduling purpose. I create the chart using a while function, and inside that while function I want it to check if inside the mysql results there is a matching ID from results, if so put it in.
 
@Lusitanian Zimbra is pretty easy to install. It is resource hungry though
 
@PeeHaa That was awesome, thanks :)
 
@PeeHaa do you run it on a vps?
 
10:15 PM
np and welcome to SO! @ECode
@Lusitanian yeah
 
through what provider? @PeeHaa
 
Thanks Thanks :)
 
user1125394

Java

Dedicated to the discussion of the Java programming language a...
 
user1125394
not serious room
 
@Lusitanian I'm just moved to cloudvps.com. I have done some business with them in the past (while I was at my previous company) and they are pretty competent.
 
10:16 PM
@PeeHaa lol, "pretty competent" is one of the nicest things I've heard you say about anybody
meh, netherlands though.
 
@Lusitanian It is a huge compliment when I'm talking about hosting providers yep :)
@Lusitanian Yep. Dutch
 
linode's awesome but expensive
 
Is there such a way or should I try programming differently?
 
@Lusitanian I have looked into them a while back, but indeed came to the conclusion they are pretty expensive.
 
yup, amazing control panel + great support + reliability tho
 
10:19 PM
It's pretty darn hard to find a reasonably priced one and have smart people
 
cheap, fast, reliable. pick any two.
 
Basically yeah
 
redhat cloud (there is php support as well) openshift.redhat.com/community/developers/pricing
 
0
Q: PHP: Fill fixed size chart with mysql data

DariusI have a table chart. Lets say 5 by 5. I run a loop such as <table> <tbody> <?php for ($i = 0; $i < 5; $i += 5) { echo "<tr> <td>one box</td> <td>one two</td> <td>one three</td&...

Hey, how come my posted link with question showed up as a big box and not like hakre's? O.o
 
10:30 PM
@Darius hakre's post is prefixed by something
 
Got it.
 
@Darius add how you retrieve data from mysql / how does it look like
 
@ircmaxell submitted a ticket
 
@dev-null-dweller ok. Give me a sec.
 
10:47 PM
Thanks @Hakre , will be looking at how to implement this method.
 
@PeeHaa i don't see any tests written. just an observation, nothing more.
 
You have reached the voicemail of PeeHaa. Please leave a message after the beep...
Beep left out on purpose
 
Hi all... Is anyone able to help with this one, or know anyone that is good with ADSI through php? stackoverflow.com/q/14011625
 
Back! :) How's everone doing?
 
10:56 PM
@ECode Good good. How are you?
 
Good. I'm bored tough. Anybody got any idea for little coding project with php,javascript etc.
 
^ user is just popping from one error to another while getting his code written on SO - no wonder of the question explosion.
 
@ECode pick one of the open source projects you use most regularly, check out the bug tracker and fix a bug. can also be in form of docs or tests.
 
@igorw Good idea! I'll keep that in my mind but looking for something else now.
 
This arrayiterator stuff is fun @.@ It's something new for me, but will be great for future programming.
 
does anyone know the default font size in css?
 
16px (or 1em with default accessibility settings)
 
@Darius Just watch out for the little annoyances. A lot of PHP builtins that expect arrays still can't work with the SPL iterator / ArrayObject classes. Disappointing. :/
 
Still above my level, but thanks for the heads up!
 
11:10 PM
@tereško, thanks!
:)
 
@DemCodeLines ,if you want your page layout to relay on users default font size, you have to keep in mind that it can cahnge
both for low-vision and mobile users
 
11:27 PM
is it protected static or static protected ?
 
I always do the latter but IIRC it doesn't matter.
 
IIRC ?
 
11:39 PM
@qwertymk "If I Recall Correctly"
 
user142019
Hello.
 
Hey
 
1 message moved to recycle bin
Hello @Zoidberg'--
 
user142019
What's up.
 
I see a flag, I see a zoidberg. Everything's as usual
 
user142019
11:43 PM
No, not everything is as usual.
 
You mean the flag is legit for once?
 
user142019
You see a flag, you see a Zoidberg, but that Zoidberg doesn't complain!
 
user142019
No it was not legit.
 
user142019
But I'm in a positive mood today.
 
@Zoidberg'-- Nothing much. Having a drink yelling at code.
 
user142019
11:44 PM
Nice.
 
@Zoidberg'-- , go away.
 
lol
 
user142019
No.
 
user142019
I refuse.
 
@Zoidberg'-- You're in a good mood today, @tereško isn't ^^
 
11:45 PM
And stop coming here to bitch each and every time you see a flag
 
A tag? :P
 
@NikiC there is a cat on my keyboard
 
@Zoidberg'-- So, doing anything interesting lately?
I mean short of that usual "writing an OS" stuff?
 
user142019
I have been learning C# and F#, as well as RavenDB.
 
user142019
I like them so far.
 
user1125394
MongoDB
 
user142019
I don't like MongoDB. It has no transactions.
 
Re mongodb and nosql in general, I found this very relevant: lucumr.pocoo.org/2012/12/29/sql-is-agile
 
11:53 PM
> You've reached the maximum of 17 Deletion votes per day; come back in 7 minutes
2
 
user1125394
@NikiC damn I was goign to post it
 
Huh? Did I just get an extra del vote?
 
user142019
You're using mysql_ so it's already terrible. Also, off topic. — Zoidberg'-- 2 mins ago
 
user142019
:P
 
@PeeHaa Goes up with rep.
 
11:53 PM
@Charles You don't say. I thought it was capped after 20k rep
 
Seems to go up by one vote for every 1k rep. I have 18 at 23k.
 
@Charles And cv?
 
user1125394
but I think if you're rich enough you put both sql and nosql in your system
 
Seems capped at 50.
 
kk tnx
 
11:55 PM
@cyril I have another article for that too (from Etsy). Their lesson is basically: Don't use two database systems at the same time
 
user1125394
oh ok
 
@cyril Basically the point is: "It's already hard enough to manage one database system, why in the world you want to manage two?"
 
What cv-pls & delv-pls stands for?
 
11:58 PM
 
Dec 22 at 22:12, by Madara Uchiha
cv-pls: Backlog (mirror) | Meaning | Chrome/Firefox Addon | Cat Content | Snippets: MySQL | Reference: Errors | Operators
Click "Meaning"
 
user1125394
@hakre so finally you filled that blue square
 
@cyril It's masked and sun-protected now, yes.
 
@Charles thanks!
 

« first day (805 days earlier)      last day (4143 days later) »