here i will collect all the info about fudforum i have/will find out, mostly how to adapt the software to the specific requirements of hosting in the darknets, or about my installation.

starting with the first little hack, which prevents users of posting their own session token when they post links from this forum. given the fact that we only work with url sessions now, this could attackers enable to take over the account (if the session should still be open at the point in time). a little regex prevents this, to be inserted in post.php, line 826 at the start of the function apply_custom_replace:

return preg_replace("/&S=(\w{32})/", "&S=replaced.session.token.for.opsec", $text);

this will shortcircuit the function to do only one replacement, which replaces the session token with a string.

cheers

trw
Posted on def3

  To: trw
trw wrote:

here i will collect all the info about fudforum i have/will find out, mostly

how to adapt the software to the specific requirements of hosting in the darknets, or about my installation.

Good idea. At some point we should collect the previous changes we made (nntp.inc, etc) and put it all in one place.

We have made a few small changes to several files at this point (also, I've written two plugins). I'll collect my stuff next week and we can place this all somewhere.

BTW, nice work on your progress with the sessions!

Retro Guy



--
Posted on RetroBBS

BTW, nice work on your progress with the sessions!

yeah, thanks. it's a load of my mind. and it makes ff much more usable and secure (for the server admin, anyway).

what plugins have you written for ff ? do you the auth and the spam killer ?
Posted on def3

and another quick'n'dirty one: the script below (hacked from pieces of admforum.php and admnntp.php) reads from a file called groups_to_create.txt in webroot/adm/, and creates all the forums listed in that file, plus the update rule to sync over nntp. it's very raw yet, and throws an exception for the display of the results, but the creation as such works.

<?php
/**
* copyright            : (C) 2001-2013 Advanced Internet Designs Inc.
* email                : mailto:forum@prohost.org
* $Id: admforum.php 5707 2013-10-12 11:05:47Z naudefj $
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; version 2 of the License.
**/

/** Return PHP's maximum upload size in bytes. */
function get_max_upload_size()
{
$us = strtolower(ini_get('upload_max_filesize'));
$size = (int) $us;
if (strpos($us, 'm') !== false) {
$size *= 1024 * 1024;
} else if (strpos($us, 'k') !== false) {
$size *= 1024;
}
return $size;
}

/* main */
require('./GLOBALS.php');
fud_use('adm.inc', true);
fud_use('forum_adm.inc', true);
fud_use('cat.inc', true);
fud_use('widgets.inc', true);
fud_use('logaction.inc');

$tbl = $GLOBALS['DBHOST_TBL_PREFIX'];

// AJAX call to reorder forums.
if (!empty($_POST['ajax']) && $_POST['ajax'] == 'reorder') {
$new_order = 1;
foreach ($_POST['order'] as $id) {
q('UPDATE '. $tbl .'forum SET view_order = '. $new_order++ .' WHERE id = '. $id);
}
rebuild_forum_cat_order();
exit('Forums successfully reordered.'); // End AJAX call.
}

require($WWW_ROOT_DISK .'adm/header.php');
$max_upload_size = get_max_upload_size();

/* This is here so we get the cat_id parameter when cancel button is clicked. */
$cat_id = isset($_GET['cat_id']) ? (int)$_GET['cat_id'] : (isset($_POST['cat_id']) ? (int)$_POST['cat_id'] : '');
if (empty($cat_id)) { // Or get it from DB.
$cat_id = q_singleval('SELECT MIN(id) FROM '. $tbl .'cat');
}
$cat_name = q_singleval('SELECT name FROM '. $tbl .'cat WHERE id='. (int)$cat_id);

$edit = isset($_GET['edit']) ? (int)$_GET['edit'] : (isset($_POST['edit']) ? (int)$_POST['edit'] : '');
if (file_exists('groups_to_create.txt'))
{
echo 'opened file';
$file_handle = fopen("groups_to_create.txt", 'r') or die("File does not exist or you lack permission to open it");
$_POST['frm_parent']= '0';
$_POST['frm_url_redirect']= '';
$_POST['frm_tag_style']= '16';
$_POST['frm_passwd_posting']= '0';
$_POST['frm_post_passwd']= '';
$_POST['frm_moderated']= '0';
$_POST['frm_max_attach_size']= '2048';
$_POST['frm_max_file_attachments']= '2';
$_POST['frm_mod_attach']= '0';
$_POST['frm_mod_notify']= '0';
$_POST['frm_message_threshold']= '0';
$_POST['frm_forum_icon']= '';
$_POST['frm_pos']= 'LAST';
$_POST['frm_forum_opt'] = (int) $_POST['frm_mod_notify'] | (int) $_POST['frm_mod_attach'] | (int) $_POST['frm_moderated'] | (int) $_POST['frm_passwd_posting'] | (int) $_POST['frm_tag_style'];
$_POST['nntp_server']= 'my.server.ip';
$_POST['nntp_port']= 'my.server.port';
$_POST['nntp_login']= 'my.login';
$_POST['nntp_pass']= 'my.password';
$_POST['nntp_timeout']= '25';
$_POST['nntp_auth']= '128';
$_POST['nntp_imp_limit']= '5000';
$_POST['nntp_custom_sig']= '';
$_POST['nntp_nntp_post_apr']= '0';
$_POST['nntp_allow_frm_post']= '2';
$_POST['nntp_skip_non_forum_users']= '0';
$_POST['nntp_create_users']= '32';
$_POST['nntp_complex_reply_match']= '16';
$_POST['nntp_allow_nntp_attch']= '8';
$_POST['nntp_frm_post_apr']= '0';
fud_use('nntp_adm.inc', true);
while(! feof($file_handle))
  {
  $line = fgets($file_handle);
list($category, $forum, $description, $newsgroup) = explode(":", $line);
$cat_id = $category;
$_POST['frm_name']= $forum;
$_POST['frm_descr']= $description;
$frm = new fud_forum;
fud_use('groups_adm.inc', true);
fud_use('groups.inc');
$frm->cat_id = $cat_id;
$frm->add('LAST');
rebuild_forum_cat_order();
logaction(_uid, 'ADDFORUM', $frm->id);
echo successify('Forum was successfully created.');
$_POST['nntp_forum_id']= $frm->id;
$_POST['nntp_newsgroup']= $newsgroup;
$nntp_adm = new fud_nntp_adm;
$nntp_adm->add();
echo successify('Newsgroup rule successfully added (see <a href="#list">list</a> at bottom of page).');
}
}
else
  {
        echo 'groups_to_create.txt does not exist';
  }
fclose($file_handle);
if ($edit && ($c = db_arr_assoc('SELECT * FROM '. $tbl .'forum WHERE id='. $edit))) {
foreach ($c as $k => $v) {
${'frm_'.$k} = $v;
}
} else {
$c = get_class_vars('fud_forum');
foreach ($c as $k => $v) {
${'frm_'.$k} = '';
}

/* Some default values for new forums. */
$frm_pos = 'LAST';
$frm_max_attach_size = floor($max_upload_size / 1024);
$frm_message_threshold = '0';
$frm_max_file_attachments = '5';
$frm_forum_opt = 16;
}

if (isset($_GET['chpos'], $_GET['newpos'])) {
frm_change_pos((int)$_GET['chpos'], (int)$_GET['newpos'], $cat_id);
rebuild_forum_cat_order();
unset($_GET['chpos'], $_GET['newpos']);
echo successify('Forum position was successfully set.');
} else if (isset($_GET['del'])) {
if (frm_move_forum((int)$_GET['del'], 0, $cat_id)) {
rebuild_forum_cat_order();
$frm_name = q_singleval('SELECT name FROM '. $tbl .'forum WHERE id='. (int)$_GET['del']);
logaction(_uid, 'FRMMARKDEL', (int)$_GET['del']);
echo successify('The <b>'. $frm_name .'</b> forum was moved to the <b><a href="admforumdel.php?'. __adm_rsid .'">trash bin</a></b>.');
}
} else if (isset($_POST['btn_chcat'], $_POST['frm_id'], $_POST['cat_id'], $_POST['dest_cat'])) {
if (frm_move_forum((int)$_POST['frm_id'], (int)$_POST['dest_cat'], $cat_id)) {
rebuild_forum_cat_order();
$r = db_saq('SELECT f.name, c1.name, c2.name FROM '. $tbl .'forum f INNER JOIN '. $tbl .'cat c1 ON c1.id='. $cat_id .' INNER JOIN '. $tbl .'cat c2 ON c2.id='. (int)$_POST['dest_cat'] .' WHERE f.id='. (int)$_POST['frm_id']);
logaction(_uid, 'CHCATFORUM', (int)$_POST['frm_id']);
echo successify('Forum was successfully moved.');
}
}

// Reorder forum display order.
if (isset($_GET['o'], $_GET['ot'])) {
if (in_array($_GET['ot'], array('name', 'descr', 'date_created'))) {
$i = 0;
$r = q('SELECT id FROM '. $tbl .'forum WHERE cat_id='. $cat_id .' ORDER BY '. $_GET['ot'] . ((int)$_GET['o'] ? ' ASC' : ' DESC'));
while ($o = db_rowarr($r)) {
q('UPDATE '. $tbl .'forum SET view_order='. ++$i .' WHERE id='. $o[0]);
}
rebuild_forum_cat_order();
}
}

// Get list of categories.
$cat_sel = create_cat_select('cat_id', $cat_id, 0);
?>
<h2>Forum Management System</h2>

<fieldset class="fieldtopic">
<legend><b>Change category:</b></legend>
<table width="100%">
<tr><td>
<?php
if (empty($cat_sel)) {
pf(errorify('Your forum doesn\'t have any categories.<br />Please use the Category Manager to create some before returning to this screen.'));
} else {
?>
<form method="post" action="admforum.php">
Manage forums in catagory:
<?php echo _hs; echo $cat_sel; ?> 
<input type="submit" name="frm_submit" value="Change" />
</form>
<?php } ?>
</td><td>
<nobr>[ <a title="List forums in the recycle bin" href="admforumdel.php?<?php echo __adm_rsid; ?>">Deleted Forums</a> ]</nobr>
</td></tr>
</table>
</fieldset>

<?php
if (empty($cat_sel)) {
require($WWW_ROOT_DISK .'adm/footer.php');
exit;
}
if (!isset($_GET['chpos'])) { // Hide this if we are changing forum order.
echo '<h3>'. ($edit ? '<a name="edit">Edit forum:</a>' : 'Add forum to <i>'. $cat_name .'</i>:') .'</h3>';
?>

<form method="post" id="frm_forum" action="admforum.php">
<?php echo _hs; ?>
<table class="datatable">
<tr class="field">
<td>Forum Name:<br /><font size="-2">The forum's name.</font></td>
<td><input type="text" name="frm_name" value="<?php echo $frm_name; ?>" maxlength="100" /></td>
</tr>

<tr class="field">
<td valign="top">Description:<br /><font size="-2">Description that will be shown on the forums main index page. Can contain HTML.</font></td>
<td><textarea nowrap="nowrap" name="frm_descr" cols="28" rows="5"><?php echo htmlspecialchars($frm_descr); ?></textarea></td>
</tr>

<?php
$forum_names = "forum index\ndon't display it";
$forum_ids   = "0\n-1";
$c = uq('SELECT id, name FROM '. $tbl .'forum WHERE cat_id='. $cat_id .' AND id != '. (empty($edit) ? 0 : $edit) .' ORDER BY name');
while ($r = db_rowobj($c)) {
$forum_names .= "\n". $r->name;

Click here to read the complete article

this thing works, i have just created all the feeds with it. one was missing an entry, so the code is really not finished. Posted on def3

On Sun, 06 Oct 2019 15:44:10 -0400
trw <trw@i2pmail.org> wrote:

this thing works, i have just created all the feeds with it. one was
missing an entry, so the code is really not finished. Posted on def3

Looks good. This will really help in building ff site, as it takes a
long time to create and configure a lot of groups at once. (It's really
boring!)

Thanks for this!

Retro Guy

and the one that I used to jump over a certain message in comp.lang.python that had a subject with an encoding that caused the sql statement to crash:
insert in /Fudforum_data_dir/scripts/nntp.php in line 131:
$nntp->group_first = 1500; which will set the counter of the group to 1500. of course, you will have to remove this line after the run, or before you use it for other groups. the easiest is to save the file under a new name and run it only once. Posted on def3

  To: trw
trw wrote:

and the one that I used to jump over a certain message in comp.lang.python

that had a subject with an encoding that caused the sql statement to crash:

insert in /Fudforum_data_dir/scripts/nntp.php in line 131:
$nntp->group_first = 1500; which will set the counter of the group to 1500. of course, you will have to

remove this line after the run, or before you use it for other groups. the easiest is to save the file under a new name and run it only once.

Posted on def3

I can't find anywhere in that loop that it breaks out for any reason (only 'continue', which is good). My nntp.php seems a little different than yours, the line is 134 in mine.

Is it crashing execution of the file itself?

--
Posted on RetroBBS

Is it crashing execution of the file itself?

it is this topic here: http://x5qrtsbiebrxj65t.onion/index.php?t=msg&th=46384&goto=63843&S=replaced.session.token.for.opsec#msg_63843

There is a call from nntp.php to a function, trying to determine if the message is a first in the thread or not. The sql statement in that function crashes if a message has certain characters (because this changes implicitly the encoding, or so it seems). When that function crahes, nntp.php stops to import that group, and goes to the next one.
Posted on def3

And another one: move the webroot of Fudforum to a different location.

This is mostly a note to myself, as I think I am the only one still using this :).

So, to move the webroot of Fudforum:

# cp -rv /your/forum/dir /your/new/forum/dir
# cp -rv /your/data/dir /your/new/data/dir
# chown -R www-data.www-data /your/new/forum/dir
# chown -R www-data.www-data /your/new/data/dir
# mv /your/forum/dir /your/forum/dir_backup
# mv /your/data/dir /your/data/dir_backup
# ln -s /your/new/forum/dir /your/forum/dir
# ln -s /your/new/data/dir /your/data/dir
# nano /your/new/data/dir/include/GLOBALS.php
(here you have to adapt the paths so that they point to the new absolute paths, php seems not to follow symlinks)
(make some testing)
# rm -rf /your/forum/dir_backup
# rm -rf /your/data/dir_backup

cheers

trw

--
Posted on def3

and btw, I hope this has fixed all this annoying 503s, they should have been because of low disk space.

--
Posted on def3

trw wrote:

And another one: move the webroot of Fudforum to a different location.

This is mostly a note to myself, as I think I am the only one still using this :).

Always a good idea to keep a log somewhere. Why not here :) (I do that also).

So, to move the webroot of Fudforum:

# cp -rv /your/forum/dir /your/new/forum/dir
# cp -rv /your/data/dir /your/new/data/dir
# chown -R www-data.www-data /your/new/forum/dir
# chown -R www-data.www-data /your/new/data/dir
# mv /your/forum/dir /your/forum/dir_backup
# mv /your/data/dir /your/data/dir_backup
# ln -s /your/new/forum/dir /your/forum/dir
# ln -s /your/new/data/dir /your/data/dir
# nano /your/new/data/dir/include/GLOBALS.php
(here you have to adapt the paths so that they point to the new absolute paths, php seems not to follow symlinks)

Interesting. Symlinks for files, or directories? rslight has symlinked files without trouble, but haven't done so with directories.

(make some testing)

Good idea!

# rm -rf /your/forum/dir_backup
# rm -rf /your/data/dir_backup

Always scary :)

Retro Guy

--
Posted on: novaBBS
www.novabbs.com

trw wrote:

and btw, I hope this has fixed all this annoying 503s, they should have been because of low disk space.

Damn non-infinite disks! I hate those :)

def3 really looks good. As you know, some of the css of rslight is copying some of the colour scheme of def3 because I like it.

On another ff note, I mentioned a while back the size of my ff database and how large it was. I was surprised then when I deleted ff from that server, the freed disk space was double the database size. The database was around 12G and once ff was completely deleted, it freed 24G of space. Not sure why that is as I really doubt it duplicates the entire database.

The rslight database for the same groups as ff had is currently 4.3G

Retro Guy

--
Posted on: novaBBS
www.novabbs.com

Interesting. Symlinks for files, or directories? rslight has symlinked files without trouble, but haven't done so with directories.

Wasn't sure that it would work, but lighttpd makes no trouble :-) . I will still change back to nginx soon, i think. The migration of the webroot solved almost all 503 errors, but it still happens from time to time. i think nginx is a little better in performance.

 # rm -rf /your/forum/dir_backup
 # rm -rf /your/data/dir_backup
Always scary :)

Oh yes. Many hours spent ....nuff said

def3 really looks good. As you know, some of the css of rslight is copying some of the colour scheme of def3 because I like it.

yeah, it is just a very nice color scheme (which I have not done, as you know. Probs go to the locals css genius, wonder if he's still around, btw).

On another ff note, I mentioned a while back the size of my ff database and how large it was. I was surprised then when I deleted ff from that server, the freed disk space was double the database size. The database was around 12G and once ff was completely >deleted, it freed 24G of space. Not sure why that is as I really doubt it duplicates the entire database.

Thats funny. Would be really interesting to learn why this was the case. My sql files take some 1,9 GB for the whole ff install, but then I don't store the messages in the db, but as plain files.

The rslight database for the same groups as ff had is currently 4.3G

ff is a ressource hog for sure. if def3 wasn't the most used of my three nodes (by far), i would have dumped ff by now. but the users (read: lurkers) seem to like it better than bbs or vichan. or maybe the other addresses are just not as well known as def3.

cheers

trw

PS: just as I wanted to post this on def3: guess what: 503 again, lol. ok, nginx it is.

--
Posted on def2

Anonymous wrote:

Interesting. Symlinks for files, or directories? rslight has symlinked files without trouble, but haven't done so with directories.

Wasn't sure that it would work, but lighttpd makes no trouble :-) . I will still change back to nginx soon, i think. The migration of the webroot solved almost all 503 errors, but it still happens from time to time. i think nginx is a little better in performance.

A while back I think I posted a few settings for nginx that deals with this issue. Seems nginx gives php a very short time to respond, and sends a 503 if php doesn't finish in time. I'm guessing lighttpd may have similar settings, but I don't know for sure.

ff is a ressource hog for sure. if def3 wasn't the most used of my three nodes (by far), i would have dumped ff by now. but the users (read: lurkers) seem to like it better than bbs or vichan. or maybe the other addresses are just not as well known as def3.

That was my thinking also before dropping ff in clearnet. Many (most?) users find it familiar, similar to other forum software, and they understand it quickly.

Retro Guy

--
Posted on: Rocksolid Light
rslight.i2p

A while back I think I posted a few settings for nginx that deals with this issue. Seems nginx gives php a very short time to respond, and sends a 503 if php doesn't finish in time. I'm guessing lighttpd may have similar settings, but I don't know for sure.

I found the thread (n def3 :-)), have to play around a little. Thanks for the hint,

cheers

trw

--
Posted on def2