PostNuke

Site search

Search results

Number of hits: 7

PostNuke Security Advisory PNSA 2005-2   (News)

VULNERABILTIES
- various missing input validations within /modules/Xanthia/ [1]
- missing input validation within /modules/Messages/readpmsg.php [1]
- possible path disclosure within /user.php [2]
- possible path disclosure within /modules/News/article.php [2]
- possible remote code injection within /includes/pnMod.php [3]
- possible cross-site-scripting in /index.php

SOLUTION
It is recommended that all admins do an immediate upgrade of their sites to v0.750b by applying the latest security fix package available from the locations listed below. Since the Xanthia-module will be updated the site's theme needs to be set to ExtraLite (or any other non-Xanthia theme) prior to applying the update. After uploading the fixpackage the modules list needs to be regenerated and the Xanthia module upgraded within Administration-Modules.
Please note the main package has been updated to include this advisory so there is no need to apply this patch if you have downloaded PostNuke after the date of this announcement.

The /index.php and /includes/pnMod.php fixes are also available for the current .760rc4a Release Candidate within the changed files only package, the main package has also been updated with the fixes.

UPDATED PACKAGES
1. PostNuke 0.750 (tar.gz format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-411.html
SHA1: 60ef6f7c93cfa638fc7d089e078db0eaa59f95b4
MD5: c40ebc31cfa3ada351dbe63f4e9a6255
Size: 2407332 Bytes

2. PostNuke 0.750 (zip format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-410.html
SHA1: 50edfbb3c12bed0b80413d421d1a90ff28ed0c22
MD5: 26dc0202c776f7463008c54ce8cf89b9
Size: 3501230 Bytes

3. Security Fix (changed files only) for PostNuke 0.750 (tar.gz format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-471.html
SHA1: 6e76d92124c833618d02dfdb87d699374120967d
MD5: a007e741be11389a986b1d8928a6c0e5
Size: 160550 Bytes

4. Security Fix (changed files only) for PostNuke 0.750 (.zip format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-472.html
SHA1: d504155418ab6d07491b3a6c0d18834fe20bbefd
MD5: e472c9917e2ff237b354bdc87838c504
Size: 247175 Bytes

CREDITS
The [1] exploits have been originally found by Maksymilian Arciemowicz from http://www.securityreason.com/ and were reported via security contact. The path disclosure issues [2] were found by 'Diabolic Crac' and reported to various trackers. The remote code injection [3] was reported by Mohamad Saleh Raub from http://www.scan-associates.net to the security contact.

Andreas Krapohl
PostNuke Development Team

Generated on May 20, 2005.

Have we forgotten the way PostNuke handles content?   (News)

allow more powerful content handling. Think of how it will then be able to extend certain content types like images to allow us uploading or modifying them, documents allowing us to keep different versions, work flow allowing us to specify a working process to manage our content.

What has changed in that part of the system since the fork from PostNuke? Well not much as I see it. I have not heard any plans for that part of the system and this is the main reason I am writing to point out this problem. What I mentioned above would allow us to extend and customize the main functionality PostNuke has out of the box like news, reviews, articles, downloads, links and FAQ. Many will argue that many different modules are around that do just about anything but I don’t mean by using modules or anything but allowing us to customize the way PostNuke holds content. A core content module could replace all those modules and provide the means for creating content elements like them but also allowing us to customize and give more power to the developer and bring PostNuke to another level.

I currently run 2 sites which are built upon PostNuke. www.cyusers.com a Greek localized site for Cypriot computing enthusiasts. www.

Generated on January 5, 2004.

Open Source Content Management Systems Make E-commerce Websites Affordable   (News)

rmation the staff had gathered and uploaded, and most of their cash reserves—because the custom developer failed to backup the site.

My first concern was how computer savvy and organized this client was. If she was going to require a lot of training and hand-holding, even implementing an open-source solution would cost more than her budget would allow. So I sent her a number of questions to answer, such as:


What kind of site do you need developed?
How did you choose php?
Is an admin interface required?
Do you need to manage banner ads?
What are your support requirements after implementation?”



After she ‘passed my test,’ I told her that I thought she’d have difficulty programming the site from scratch for $4-5,000, even in India. Then I told her that from her requirements, she was ‘re-inventing the wheel.’I told her that there are numerous free open source CMSs with all of the functionality she needed and then some. I told her that by using this approach, I could deliver a fully functional site by the end of the year within the budget she specified.

Within hours, I received a request for an in-person meeting. Because this client had a clear idea of all of the components and capabilities she wanted, I was able to recommend a comprehensive solution that would address all of the issues her specifications raised. This saved a lot of time and expense, as well as made my job much less frustrating.

After the meeting, I sent the PostNuke (http://www.postnuke.com/) manual to the client for review. I recommended PostNuke because it provides full CSS support, HTML 4.01 transitional compliance, and an advanced blocks system. However, she astutely pointed out that, according to the documentation, unique block/page configuration for multiple pages isn’t possible—a stringent requirement for the DoctorVAR.com implementation.

By examining other PostNuke site installations and reading PostNuke.com forum discussions, I quickly figured out that multiple PostNuke installs would work around the page layout problem and provide complete control over the subsite blocks. A PostNuke subsite is an additional installation of PostNuke within the ‘main’ PostNuke installation. For example, if the main PostNuke installation is installed under ‘/htdocs/postnuke’, a subsite would be installed under ‘/htdocs/postnuke/subsite1’.

Each subsite has the ability to be configured completely separately from the main PostNuke installation. This allows the administrator to manage separate topics as their own distinct ‘subsites.’ DoctorVAR.com is configured to share all information between the subsites except for the subsites’ block configuration. Subsites are configured to maintain their own block layouts—thus each page can be laid out uniquely.

The client wanted to use html blocks to handle the bulk of the content since she thought the PostNuke articles feature would be tedious to maintain. However, PostNuke only searches major modules, not html pages. To resolve the html layout and search issues, I integrated a PostNuke module called Content Express (http://pn.arising.net/ce/). This module provides the site with a very friendly admin interface for adding html pages and controlling the site navigation, as well as a search engine for html pages. However, Content Express wasn’t built for multi-site configuration, so I had to figure out what it was doing to know how to integrate it for the multi-site solution.”

To complete the site, I integrated free PostNuke modules to provide an ezine, forum, job bank, and banner/ad management. Within two weeks, my client was laying out pages and uploading data. And by the end of two months the DoctorVAR.com site was up—within her budget and without sacrificing one feature or requirement. The only software she had to purchase was a classified ads module and shopping cart for $59, plus a $30 theme. The rest of the modules were free.”

The flexibility, performance, and ease of administration of the DoctorVAR.com (http://www.doctorvar.com/) implementation is a testament to how robust and cost effective open source CMSs are.”

Additional Resources:

PostNuke.com (open source weblog/content management system) http://www.postnuke.com/

Content Express (open source Web content management system) http://pn.arising.net/ce/

WhatsNews (open source ezine module) http://nuke-modules.gading.de/

phpAdsNew (open source ad server) http://www.phpadsnew.com/one/

phpBB (open-source bulletin board package) http://www.phpbb.com/

phProfession (open source job bank) http://www.phpsolutions.co.uk/index.php

DoctorVAR.com Website Content/Stickiness Articles http://www.doctorvar.com/subsite8/?mid=12#stickiness/

DoctorVAR.com Web Presence Articles http://www.doctorvar.com/subsite27/?mid=22#WebPresence/

Web Marketing & E-Commerce http://www.wilsonweb.com/

Apromotionguide.com - Free website promotion tutorial http://apromotionguide.com/


Linda Christie, a freelance writer based in Omaha NE, is the Executive Editor for DoctorVAR.com.

Generated on April 23, 2003.

PostNuke CMS Make E-commerce Websites Affordable   (News)

e said. “So I started planning my site by analyzing how sites keep me coming back. Good content is the primary draw, but what else?”

Analyzing Website Assets and Annoyances

After a few days of surfing her favorite haunts and examining sites she’d let fall by the wayside, Christie came up with a laundry list of characteristics that she liked: short, easy to remember and descriptive site name; clear focus and organization; easy navigation; free and meaty content; plus links to additional resources.

She also identified a number of annoyances that sent her running to another site: multiple broken links, signup required to access content, popup ads, outdated content, poor navigation and/or search capability. And her number one complaint—locking you onto the site by disabling the browser back button!

Website Do’s and Don’ts

Then she went one step further and read numerous articles on what other people look for. “These articles strongly influenced not only what features were incorporated, but where they are placed,” Christie said. “For example, privacy and the ability to contact a real person are top priorities for many site visitors. So I placed both in the top navigation bar for easy access.”

She also discovered that the best sites are designed to involve visitors—to invite them to contribute content, give feedback, voice their opinions, and exchange information with and help each other. “To improve the ‘stickiness’ of the site, we expanded our plan to include a forum, polls, contributing content, free classifieds and a job bank. I also redesigned my e-newsletter tone to make it more personal, as well as to make subscribers come to the site to read the full story or fill out an opinion poll.”

Custom Development Gone Wrong

After talking to several Web developers, Christie chose a developer offering a custom designed PHP solution using SQL databases to store thousands of stories and favorite links. However, two months into the project, it became evident that the developer didn’t have adequate programming staff to launch the site within the promised three-month schedule. Unfortunately, Christie felt she had few alternatives. “I’d already spent hundreds of hours working on the site design and adding thousands of favorite links and articles to the database—work that would be lost if I changed vendors.”

Three months later and one week before launch, the site went down. The next day it was still offline, even the backend admin area. Then the dreaded call came: hackers had broken into the server hosting facility. “What about the backup? I asked.”

“The last backup file was corrupted,” was the answer. A two-month old zip file didn’t match the current software version, making site restoration almost impossible—but they said they would try. “At this point, I lost all confidence in the developer—not to mention over five-thousand records I’d uploaded,” Christie said.

Searching for a New Solution

Christie wasn’t sure what to do. “I couldn’t afford the time or money to start coding the site from scratch. I knew I would be shopping for champagne on a beer pocketbook of $5,000,” Christie said. “But I didn’t want to compromise unless I had to.”

Christie began searching online for a new developer. Soon, one of the people she contacted emailed her a slew of probing questions.

What kind of site do you need developed?
How did you choose PHP?
Is an admin interface required?
Do you need to manage banner ads?
What are your support requirements after implementation?”


“I felt like I was taking a test,” Christie said. “But the quality of his inquiries gave me confidence this person wanted to clearly understand the scope of the project, as well as my level of expertise to manage the site.”

Soon Christie scheduled a meeting with Scott Kroeger, owner of Hudson Avenue Technologies in Omaha NE, to discuss the challenges of launching such a complex site on a limited budget. After Christie reviewed her well-documented site map and specifications with Kroeger, he recommended a proven and supported open source content management system (CMS): PostNuke.

“Many developers start coding right away,” Kroeger said. “Since my background is in integration, I get more excited about finding open source software, figuring out how the code works and then using my technical skills and coding to make the modules work together. This way I don’t have to spend a lot of time programming from scratch and debugging code.”

Integrating/Customizing Open Source Solutions

The two biggest challenges Kroeger faced with the PostNuke implementation were finding a site search solution and providing unique page layout capabilities for each major category or page.

“Linda wanted the flexibility of using html blocks to handle the bulk of the content,” Kroeger said. “However, PostNuke only searches major modules, not html pages. To resolve this issue, I integrated a PostNuke module called Content Express. This module provides the site with a very friendly admin interface for adding html pages and controlling the site navigation, as well as a search engine for html pages.”

Unique block/page configuration for additional pages isn’t supported by a single PostNuke install. By examining other PostNuke site installations and reading forum discussions, Kroeger quickly figured out that multiple PostNuke installs would work around the page layout problem and provide complete control over the subsite blocks.

“A PostNuke subsite is an additional installation of PostNuke within the ‘main’ PostNuke installation,” Kroeger said. “For example, if the main PostNuke installation is installed under ‘/htdocs/postnuke’, a subsite would be installed under ‘/htdocs/postnuke/subsite1’. So my challenge was to figure out how to make all 28 installs talk to each other by modifying what database tables each subsite looked at. I configured the subsites to maintain their own block layouts—thus each major topic category or subsite/page can be laid out uniquely. Also, Content Express wasn’t built for multi-site configuration, so I had to figure out what it was doing to know how to integrate it for the multi-site solution.”

To complete the site, Kroeger integrated free PostNuke modules to provide an ezine, forum, job bank, and banner/ad management. “Within two weeks, I was laying out pages and uploading data.” Christie said. “And by the end of two months the DoctorVAR.com site I’d dreamed about was up—within my $5,000 budget and without sacrificing one feature or requirement. The only software I had to purchase was a classified ads module and shopping cart for $59, plus a $30 theme. The rest of the software was free.”

Kroeger added, “Because Linda had educated herself on Website design and defined the site specifications so well, I knew clearly from the start what was expected. This made my job much easier, which combined with my open source integration strategy, saved her a lot of time and money.”

The flexibility, performance, and ease of administration of the DoctorVAR.com implementation is a testament to how robust and cost effective open source content management systems are for supporting robust e-commerce Websites.


For additional information about DoctorVAR.com visit their Web site at http://www.doctorvar.com.


Additional Resources:
DoctorVAR.com Website Content/Stickiness Articles

DoctorVar Web Presence Articles

Web Marketing & E-Commerce http://www.wilsonWeb.com/

Apromotionguide.com - Free Website promotion tutorial http://apromotionguide.com/

Content Express (PostNuke Module)http://pn.arising.net/ce/

WhatsNews (PostNuke ezine module)http://nuke-modules.gading.de/

phpAdsNew (open source ad server)http://www.phpadsnew.com/one/

phpBB (open source bulletin board) http://www.phpbb.com/

phProfession (PostNuke job bank module) http://www.phpsolutions.co.uk/index.php


Linda Freeman is a freelance writer based in Omaha NE.

Generated on March 15, 2003.

Open source solution saves e-commerce website   (News)

Website to help computer value added resellers (VARs) improve their technical know-how, consulting, marketing and management skills.

“An Internet portal, DoctorVAR.com (http://www.doctorvar.com) would aggregate up-to-date information technology news and some of the best articles and resources for VARs,” said Linda Christie, company president. “After talking to several Web developers, we chose a custom designed php solution with SQL databases to store thousands of stories and favorite links.”

However, two months into the project, it became evident that the developer didn’t have adequate programming staff to launch the site within the promised three-month schedule. Unfortunately, Christie felt she had few alternatives. “I’d already spent hundreds of hours working on the site design and adding thousands of favorite links and articles to the database—work that could be lost if I changed vendors.”

After returning from a two month assignment in Europe, during which no progress was made, Christie spent a couple of days with the programmer to iron out the final details. “At last we were making progress. I updated some of the content and began writing press releases for the big day.”

One night the site went offline. The next day it was still down, even the backend admin area. Then the dreaded call came: hackers had broken into the server hosting facility. “What about the backup? I asked.”

“The last backup file was corrupted,” was the answer. A two-month old zip file didn’t match the current software version, making site restoration almost impossible—but they said they would try. “They’d lost dozens of other sites and had no backups for them either,” Christie said. “So at this point, I lost all confidence in the developer—not to mention over ten-thousand records I’d uploaded.”

Christie wasn’t sure what to do. “Our e-commerce project—a major commitment in time and resources--was already four months past due. And I couldn’t afford the time or money to start coding the site from scratch.”

Christie began searching online for a new developer. Soon, one of the people she contacted emailed her a slew of probing questions. “I felt like I was taking a test,” Christie said. “But the quality of his inquiries gave me confidence this person wanted to clearly understand the scope of the project, as well as my level of expertise to manage the site.”

Soon Christie scheduled a meeting with Scott Kroeger, owner of Hudson Avenue Technologies in Omaha NE, to discuss the challenges of launching such a complex site on a limited budget. Scott recommended utilizing a proven and supported open source content manager: PostNuke. “Not only is this software free, but the friendly user interface would allow me to perform all of the daily administration, even make page layout changes,” Christie said. “Scott said his goal was to make me as independent of him as possible by the end of the project.”

One of the primary reasons Christie contracted with Kroeger was that he wanted to work himself out of a job instead of creating a customized program that would require his ongoing support. “I’d been burned once already,” Christie said. “So I was excited about integrating supported public domain software that could be maintained by a multitude of providers, should Scott and I part for whatever reason. Plus there would be no software debugging needed.”

After resolving some technical difficulties with the PostNuke implementation, Kroeger proceeded to deliver the site on schedule and within the company’s limited budget. “Within two weeks, I was able to start laying out pages and uploading data. And by the end of two months the site was up. Scott integrated free PostNuke modules to provide an ezine, forum, job bank, and banner/ad management, as well as an html-oriented content manager, Content Express, that simplifies adding html pages, uploading content, and searching the entire site.

These two companies have shown that partnering with a developer that understands your business needs and integrates off-the-shelf solutions can help you quickly ramp up the right solution for the right price—without having to invest in custom software development and personnel.

For additional information about DoctorVAR.com visit their Web site at http://www.doctorvar.com.

Linda Freeman is a freelance writer based in Omaha NE.

Copyright 2003, Write Solutions, Inc., Tulsa OK. Reprinted by permission.

Generated on February 22, 2003.

Postnuke - A Heavy User's Perspective   (News)

other modules as examples and worry about the module working rather than the code looking pretty (and trust me it isn’t pretty!).

The advent of .8 causes me a few worries and I’d like to share them with the developers from the point of view of someone who relies on Postnuke. This isn’t me saying what should and shouldn’t happen (man, I’d be lost in the dark ages without you guys!) but hopefully let you see some of the worries larger sites which can’t afford downtime or loss of functionality have. If Postnuke is to become adopted by bigger corporations these are going to be points they will raise.

With each new release of Postnuke, the ‘coding’ changes. And what I mean by this is that modules need to be recoded slightly differently with each release. It wouldn’t be a problem except that a lot of excellent modules aren’t updated for weeks / months / if ever because the original developers are confused by these coding changes. Heck, I still don’t get all the pnadmin apis, and don’t have the time to really sit down and learn.

However, I understand that as the system progress towards it’s goal, each release is going to introduce changes. And you have started a documentation site which is excellent. However, I know if .8 doesn’t support some of my older modules, supported in .714, I’m going to consider not upgrading, and instead just introduce hacks to do what I need, which will make it even harder to upgrade in the long run.

News needs a complete overhaul, and yes I’m glad to see that happening in .8. News is my ‘bread and butter’ so I need it to be able to work overtime, and whilst many would like some of these features, I’m probably one of those ones who needs them all.

First off, I need next page news. I need to be able to visit the front page see the first x articles and be able to click on an image to see the next x and so on. In a site that publishes a lot of news in a day, it’s not as easy as it could be to see older articles. I also need this to happen whether I’m looking at topics or categories. The “view all articles in this category/topic” is a bad idea. Simply because if you’ve got 5000 articles, the user isn’t going to get a pleasant experience

Sections and news really need to be integrated, but it would be nice if they could be grouped together in some way, neither using topics or categories.


I think we need further options beyond topics and categories and let them be user defined. Maybe someone is giving coverage of an event which covers all topics and categories but needs to be lumped together. I wrote a simple little module for this where I have an event name and then assign urls and titles to it… but I’d like to see this integrated into the news submission.

I also think it’s needed to be able to assign an article to more than one topic/category.

It’s difficult to explain my needs in a way people would understand, so I’ll explain it by example of a music site. Each topic would represent a style of music (but hence there could be times when someone releases a mix of hip-hop and western which would need to appear in both categories). Each category would represent a label. And the 3rd option would be akin to a music festival or awards ceremony where I would want to lump articles from multiple topics and categories together.

Some of my articles contain hardcoded links to previous ones. When things changed from being articles.php to the modules format… it caused me no end of problems because I suddenly had loads of dead links. With integration of news and sections please consider that links not only exist hardcoded within the site but on the wider internet as well, so traffic needs to be successfully re-routed with each new version of Postnuke

Next images. This is something that Postnuke is sorely lacking. I know we have modules like Gallery, but I want to assign images to certain articles. For this I’ve written a module I call imagebank… which is nothing special code-wise. I know this could be written better and integration with things such as scheduled articles and other modules is a bit botched. Now when things like this are suggested a lot of people go on about upload facilities. Personally, I don’t have an issue with creating the images and uploading them via FTP (it’s easier on CPU to do all the image manipulation offline), but I’d like to be able to assign images already on my server quickly and easily (maybe even assign a whole directory which Imagebank can now do).

You can see a demo of this here to get an idea of what I’m talking about:
http://www.action-figure.com/modules.php?op=modload&name=News&file=article&sid=4820

And no, I haven’t released it for a number of reasons, the main one being the way it has to be hacked into the core.

Also items such as number of reads information should have the option of being admin only. This takes me an age to rehack. I don’t want my advertisers being able to compare my traffic data with what someone else may tell them/fake.

The collapsible blocks was a brilliant idea, but some blocks should NOT be able to be collapsed. I had to hack that functionality out because I don’t want my readers being able to turn off my advertising! Banner blockers are bad enough.

Now if something could be done with the banners module to allow zoning by topic / module / category, etc… I’d be a happy bunny. I use phpadsnew as a sepereate install and integrated into my theme (with the odd hardcoded block) but it’s not integrated with nuke enough to do the zoning.

I’d like it if the forums and comments were somehow integrated. No idea how this could be done but I do get the feeling that they are very separate entities on the site and hence cross traffic between the modules is very low.

I currently use encompass which I think is an excellent module. I know there is a lot of discussion about blocklayout vs encompass but to me the strength will be in Postnuke being able to use both… it gives me a choice and allow me to select whichever suits my needs best.

Also, everything possible needs to be done to make Postnuke as optimized and as scalable as possible. I want to ensure that whether I have 20 or 20,000 articles the difference in loading speed is as minimal as possible. Whilst my site isn’t hosted on anything grand, it does have it’s own dedicated server, and has got to the point that it really, really struggles. The bloat is to such a level I am now seriously considering moving to another CMS if things don’t radically improve in .8

Apologies if this seems like a long list of I want, I want, I want. I just feel that these are important generic features any large site which depends on Postnuke needs and I felt that by contributing it might share some ideas with you. I truly appreciate all the hardwork the developers do, and wish I had more time, and better coding knowledge to contribute more to the project


Adrian Faulkner

Generated on August 23, 2002.

Uploading?   (News)

Limiting the type of upload by extension, security issues (remove all escape chars, ;'s, etc... basically limit to A-Z0-9 etc,)

This would allow 'trusted' users to upload things like mp3s, avatars, etc...

Suggestions, comments, pointers

Generated on November 12, 2001.