-
Development Update, March 2007
(News)
-
Dot 8 evolving: language files progression and legacy functionality
Thanks to the testing of the community users (yes, YOU!), some legacy functions (residing in /includes/legacy/ have been updated by Simon to solve some bugs. This is another proof that we do need everyone to test the releases and help not only yourself to make this release a success! The following files have also been marked 'deprecated', with an accompanying comment in the DocBlock: admin.php, backend.php, banners.php, error.php, modules.php, print.php and user.php. These files shall be removed in the next (post-dot8) major release.
The overhaul of language files has also applied to the Groups, Theme, Users and Profile modules. These modules now have better multilingual options and (by using the pnML function), making it a lot easier to translate the package and showing better logic in grammar for localisations. Furthermore, lots of open bugs have been solved and the templates have been revised also. For example, the emails sent by the Users module can now be adjusted by just editing a template!
David Nelson has offered to completely review the language files for dot8, and we all have to thank Olaf Fichtner for helping revamp the current language constants. The PostNuke Languages Project is actively following the development!
Important change in the language strings is the use of the _CREATEDBY / _CREATEDON and the _UPDATEDBY / _UPDATEDON constants. For better support in other languages, these are replaced by the following:
'_CREATEDBY', 'Created by %username%'
'_CREATEDON', 'Created on %date%'
'_CREATEDBYON', 'Created by %username% on %date%'
'_UPDATEDBY', 'Last updated by %username%'
'_UPDATEDON', 'Updated on %date%'
'_UPDATEDBYON', 'Last updated by %username% on %date%'
and can now be accessed through the normal pnml plugin in the templates.
System modules: pnForm and PageLock
Jørn has moved the pnForm framework to it's own module location within the system directory. Major reason for this is to properly save some pnForm specific javascript and style files. Usage of the module should be quite the same. In addition, some new context menu plugins have been added. These plugins create a popup menu to be used as a right-click context menu. More information can be found in the added files in the pnForm plugin directory, and at the pnForm Wiki Pages.
Also introduced by Jørn is a new system module. The PageLock module is a module that helps enforcing single user access to a specific page, by blocking access to other users when one has it open.
Example: User A opens article X for editing. This is registered on the server. User B tries to open article X for editing too. But as soon as the article editing window is opened, it is overlayed with a transparent dark film and a box in the middle tells the user "Sorry this page has been locked by user A - please wait or come back later".
Functionality: The lock is maintained by an Ajax plugin that keeps pinging the server as long as user A keeps the editing page open. When user A closes the window then the pinging stops and the lock times out. If user B chooses to wait then his page keeps pinging the server for the release of the lock (also Ajax) - and when that happens he gains access to the page. The module can be used on all pages that edites a single item - articles, user data, news items, book pages, permissions settings - you name it.
To use this system, a module author has to use API calls in their own code for adding or releasing a block: pnModAPIFunc('PageLock', 'user', 'pageLock', ...) and pnModAPIFunc('PageLock', 'user', 'releaseLock', ...). To see al this in action, grab the latest nightly snapshot and play around with the HowtoPnForm module: edit a recipe in one browser, and try to edit the same in another browser.
ValueAddons modules: Members_List and EZComments
The Members_List module has been revised by Mark West, with some added configuration options. It is now possible to set the number of (allowed) registered users, and some new blocks (featured user last seen and last x users) have been added. Check out the latest nightly build to see the functionality and options.
Mark has now finished the integration of categories into the user side of the Reviews, Pages, FAQ and News modules. This way, migration of .7x categories into the new Categories module is now supported and can be tested by our users who want to upgrade their .7 site to .8.
Finally, there have been added configuration options for categorization and category titles in the permalinks with these modules.
One hot issue at the moment is the increasing amount of spam that is on lots of websites at this moment. More and more features are to be found on the internet to prevent spam showing on your site. Akismet / Bad Behaviour are one of these. As some already know, Akismet has been applied in EZCommnents for a while. For testing purposes, Mark has implemented a bad behaviour (http://www.bad-behavior.ioerror.us/) function also for testing purposes (as Steffen has found that this could also be a good application). It does need some code hacking to pnApi.php at this moment, so only advanmced users willing to help integreating this feature are invited to test this and report any iussues to the EZComments tracker at the EZComments NOC project page.
Core and API: ThemeUtil and Categories
The pnTheme system has now been converted to the ThemeUtil class. With this conversion, all occurences in the core were updated too. Both the old and the new file are loaded in pnInit for backwards compatibility, but the old file (onTheme) and its functions are now marked as 'deprecated' and will be removed in the next major release.
Also added to the new ThemeUtil is a getModuleStylesheet method which contains the logic from the modulestylesheet plugin. You can do PageUtil::addVar('stylesheet', ThemeUtil::getModuleStylesheet('modulename')) to include the value of pnModGetVar('modulename', 'modulestylesheet') or style.css (in this order) or PageUtil::addVar('stylesheet', ThemeUtil::getModuleStylesheet('modulename', 'special.css)) to include the special.css file in your rendered page.
While unnecessary for correct functioning of the website, one is now allowed to turn off session regeneration completely. This is added because it may be helpful with a couple of undecided bugs in the tracker at the moment.
Module Development: information for 3rd party Devs!
Axel introduced a very nice application called EasyDist. This allows you to create your own PostNuke package easily. You can find it at modulestudio.de. It is still in a very early stage, but you should get the idea. This is all still in development fase and is just for testing purposes at this moment.
A preliminary for the (automatic) creation of packages using EasyDist is that module authors package their modules in a standard way. Right now, there are different file structures in the ZIPs or TGZs the authors distribute. We came to the conclusion that the preferred file structure inside the archive should be - modules - MyModule - pnuser.php etc so that an unpacked archive could be copied inside the pnroot. More information is in the Guidelines for module developers (
Generated on March 21, 2007.
-
Development Update, November 2006-05
(News)
-
New teamlist member: Ammodump
Ammodump was asked to join the team. As quoted from his introduction in the team: "I enjoy being a community member, and that often my comments hold weight. Sometimes my comments and advice are misguided, but sometimes it is hard to understand others questions ;-) ". With two main hobbies (PN and beer), Ammodump seems to be born for the support team here at the community website.
Remote code injection problem
As some people already know, there is a remote code injection problem with the language parameter as mentioned in the Feedback Forum. Both the .7 and the .8 versions have been updated to fix this security vulnerability, so everybody is urged to upgrade their PostNuke version to the latest release (see also Release Announcement). Some background information: The FormUtil::getPassedValue() function also accepts an input vector GETPOST now. It allows to ensure that the contents of _COOKIE are not taken into account when you get data (as it would be when you go through _REQUEST). The input domain is limited to _GET and _POST and not through _REQUEST / _COOKIE anymore. This is applied firstly to the newlang and thistheme parameters, and has been (and will be) applied to the rest of the core functions additionally.
Session handling
Some features have been added to the session handling in the core system:
Session id regeneration (random and on login/logout), making it even more difficult to hijack a session. This has been achieved without any extra writes to the database, so the feature has no overheads.
The ability to rename the session variable (always was POSTNUKESID), and changing from session file storage to session db storage has been enhanced.
Auth-id check to the user login screen (and block) - this has introduced a login bug which has been entered into the bug tracker and will be fixed by the release of MS3.
The session regeneration options are available in the (upgraded) Settings module.
Also fixed for both the 0.764 release as well as the 0.8 release are some PHP >= 5.2.0 issues due to session handling (See the forums, credits to fredatwork). It seems to solve the problems with PostNuke installations running on 5.2.0 or higher.
Minimum MySQL and PHP versions
The minimum version for MySQL has been raised to 4.1.x, due to some installer problems that are related to old 3.x databases. See also MySQL's lifetime philosophy at Planet MySQL. Due to security reasons, the recommended minimum php-version is at least 4.3.10.
Installer
Now fixed are some install problems with register_globals ON. In addition, there has been added a check for register_globals at the .76x install process for information only. The installation of PostNuke on these environments is nevertheless still possible. Sync with the .8 installer is to be done.
System and core modules
The internal variables statusmsg and errormsg are now arrays: it is now possible to capture (and display) multiple errors. Therefore, pnGetStatusMsg() is renamed to pnGetStatusMsgs() and LogUtil::getStatusMessagesText().
Float handling returns from Ajax has been discussed within the team. It appears that floats in the Non-US locales did not correctly set the decimal delimiters. Therefore, the locale has been set to en_US to ensure this. A solution for writing floats to the DB is still pending.
Robert has added the encryption / decryption methods, using the mcrypt library function, for use in the API.
In the Theme module, the plugins for showing the sitename, slogan and complete title have been altered to use multilanguage support.
The Settings module has some nice dynamic interface elements added to the Security and General function types, increasing useability in this one.
The magic_quotes_gpc recommendation for .8 has been changed. It should be off in stead of on. According to php security group, this feature is inconsistent in blocking attacks, and can in some cases cause data loss with uploaded files. Besides the revert of magic_quotes_gpc recommendation, the SysInfo module now also checks for allow_url_include (new in PHP 5.2) and the suhosin patch/extension.
Finally, all variables retrieved through FormUtil::getPassedValue() are now cached
ValueAddons modules
The Pages module now displays the category that each page belongs to in the overview.
The Error module (or Error handler, where error pages within PostNuke are handled) has been undergoing some changes. System errors, forbidden / not-found errors and specific API errors have their own templates and level of error reporting. A no-auth error will result in a more suitable 403 response rather than a 200-response with a status message. As a result, a lot of code has been altered to correctly use the new Log- and Error message handling.
The Wiki module has been renamed to more suitable 'Wiki_Code', as this module is a transform hook to enable Wiki formatting in content items.
The ExampleObj module has been reviewed, revised and updated by Robert. It should serve as a good example for any module writers
Generated on November 20, 2006.
-
The Road to .8 - Where are we, and where are we going?
(News)
-
The modules included in .760 which are templated, and taken direct from the .8 CVS are as follows:
Admin
Admin Messages
Autolinks
AvantGo
Blocks
Censor
Credits
Ephemerids
Groups
Header_Footer
Legal
Mailer
Members List
Messages
Modules
Permissions
pn_bbcode
pn_bbsmile
pnRender
Quotes
Ratings
RSS
Sniffer
Typetool
Xanthia
This represents a significant percentage of the .8 code, but there is still more to do. The aim of this article is to try and outline some of what remains to be done before we can consider a release of .8.
Six Main Projects for PostNuke Development
We have identified six main sub projects vital for a release of .8. These projects cover wide areas, and each are at different stages of completion. The six projects, in no particular order, are:
Integration of Open Star object library and Database Utility
Integration of Open Star category management
Installer
Xanthia
User management
Finishing of content modules
This article also includes a little information on some of the other new code to be introduced with .8 this is at the end, where we look at EZComments and the Error Handler.
Integration of Open Star Object Library and Database Utility
The new Database layer reuses the existing pntables information to provide an
object representation of database rows. The advantage of this approach is that
it allows you to basically remove manually coded SQL statements and replace
with what's typically a 1-line statement. Some sample invocations of such code
are shown below:
[code]
$myObj =& DBUtil::selectObjectByID (, $id);
$myObj =& DBUtil::selectObject (, $where);
$myObjArray =& DBUtil::selectObjectArray (, $where, $sort);
DBUtil::insertObject ($myObj, );
DBUtil::updateObject ($myObj, );
[/code]
These functions all return an associative PHP array, or in the case of array
functions, an array of arrays. The fields in this array are cleaned up in
the sense that any field prefixes have been removed. This DB API also
gives you the ability to have generate associative (object) arrays, expanded
arrays with other table fields joined in (which means that you can save SQL
lookup calls) as well as store/retrieve dynamic attributes without altering
the underlying table structure. Together this provides a highly flexible API
which can take care of all storage & retrieval operations.
On top of the DB layer sits the Object Layer. Objects provide a component model
which features transparent persistence facilities. Objects/Classees are loaded
though the Loader API though
[code]
Loader::loadClassFromModule (, 'foo') //
Generated on November 3, 2005.
-
Case Study - www.eurojamlive.org
(News)
-
So, how does eurojamLIVE! fit in?
eurojamLIVE! has been designed to allow participants and event organisers to communicate before, during and after the event.
There will be 10,000 people at the event, so the website has the potential to receive a great deal of traffic over the coming months.
eurojamlive.org as a PostNuke website
PostNuke was chosen for the eurojamLIVE! website. We needed a solution that could be deployed quickly, with only a limited amount of
modifications. The websites for Scouting 2007 are run on an entirely volunteer basis, and PostNuke's ease of use and open source code
was ideal for this.
Constructing the website
The website initially began as a standard PostNuke install. All the extra core modules that were not needed were removed, and the
tables for each of these modules manually removed from the database. The decision was made to use pagesetter
for most of the content, including the news functionality. We needed the workflow and template functionality provided by pagesetter
but not available in the core News module. Additionally, PNphpBB2 was used for the forums, due to its extended feature set.
In the end, the site's configuration looked like this:
PostNuke Version: 0.760
Although at the time 0.760 was still in the RC stage, it was considered important to use the latest version to take advantage of
sessionless anonymous users (for a performance increase) and also recent improvements in Xanthia's full page caching, which in the end
proved important for the website.
Module List
pagesetter
photoshare
EZComments
PNphpBB2
Downloads
pnFlashGames
Weather
Blocks
dp-StaffStatus
Theme
pnfr-vx - courtesy of Chestnut, pnFrance
Custom Developments
Although nothing revolutionary was needed, a few custom developments were used.
Block Management
A fairly simple module making it easier to change the news stories appearing on the homepage. Instead of the default pagesetter block,
which requires the story ID, this module allows the user to choose the story title to show, rather than having to know the ID.
Profile integration - PNphpBB and PostNuke
Better integration between PostNuke's profiles and PNphpBB profiles were needed. As a result, all the forum profile settings were
moved to a link in the 'Your Account' section, the profile link in the forums now redirecting to user.php. One further change was
needed for everything to work as expected - the profile information had to be updated each time the user visited the forum index,
incase they had changed any part of their profile.
The First Day
Although the site was launched on the 3rd of June, it's existance was not advertised until the 5th June
at 2pm. Between this point, and 9pm, the site received 55,000 hits and served almost 1GB of traffic. This level of initial
support was not initially anticipated, and there was a slowdown for a few minutes until Xanthia's full page caching was enabled.
This had the effect of reducing server load by more than 50%, and the site consequently confortably rode through the initial spike in traffic.
The server itself already ran the Scouting 2007 network of sites, before the eurojamLIVE! launch. In an ideal world the eurojamLIVE!
website would be on its own seperate server, however this is not the case, and therefore performance in paramount. In the end,
I would say the server and the PostNuke website stood up to the demands quite well.
Visit eurojamLIVE!
Generated on June 14, 2005.
-
PostNuke Security Advisory PNSA 2005-2
(News)
-
VULNERABILTIES
- various missing input validations within /modules/Xanthia/ [1]
- missing input validation within /modules/Messages/readpmsg.php [1]
- possible path disclosure within /user.php [2]
- possible path disclosure within /modules/News/article.php [2]
- possible remote code injection within /includes/pnMod.php [3]
- possible cross-site-scripting in /index.php
SOLUTION
It is recommended that all admins do an immediate upgrade of their sites to v0.750b by applying the latest security fix package available from the locations listed below. Since the Xanthia-module will be updated the site's theme needs to be set to ExtraLite (or any other non-Xanthia theme) prior to applying the update. After uploading the fixpackage the modules list needs to be regenerated and the Xanthia module upgraded within Administration-Modules.
Please note the main package has been updated to include this advisory so there is no need to apply this patch if you have downloaded PostNuke after the date of this announcement.
The /index.php and /includes/pnMod.php fixes are also available for the current .760rc4a Release Candidate within the changed files only package, the main package has also been updated with the fixes.
UPDATED PACKAGES
1. PostNuke 0.750 (tar.gz format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-411.html
SHA1: 60ef6f7c93cfa638fc7d089e078db0eaa59f95b4
MD5: c40ebc31cfa3ada351dbe63f4e9a6255
Size: 2407332 Bytes
2. PostNuke 0.750 (zip format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-410.html
SHA1: 50edfbb3c12bed0b80413d421d1a90ff28ed0c22
MD5: 26dc0202c776f7463008c54ce8cf89b9
Size: 3501230 Bytes
3. Security Fix (changed files only) for PostNuke 0.750 (tar.gz format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-471.html
SHA1: 6e76d92124c833618d02dfdb87d699374120967d
MD5: a007e741be11389a986b1d8928a6c0e5
Size: 160550 Bytes
4. Security Fix (changed files only) for PostNuke 0.750 (.zip format)
http://news.postnuke.com/Downloads-index-req-viewdownloaddetails-lid-472.html
SHA1: d504155418ab6d07491b3a6c0d18834fe20bbefd
MD5: e472c9917e2ff237b354bdc87838c504
Size: 247175 Bytes
CREDITS
The [1] exploits have been originally found by Maksymilian Arciemowicz from http://www.securityreason.com/ and were reported via security contact. The path disclosure issues [2] were found by 'Diabolic Crac' and reported to various trackers. The remote code injection [3] was reported by Mohamad Saleh Raub from http://www.scan-associates.net to the security contact.
Andreas Krapohl
PostNuke Development Team
Generated on May 20, 2005.
-
Technote regarding DCrab Security Advisory
(News)
-
The XSS within user.php is reproducible if the default pnAntiCracker is manually disabled in Administration-Settings. This issue is considered 'less critical' but a fix is already available in the public CVS. Please keep in mind that .76x is currently a 'Release Candidate' and not intended for use on production sites.
If any customers experience a problem and believe it to be related to this issue, they should open a bugtracker entry, including enviroment information for debugging.
Please also note our security contact form.
larsneo
PostNuke Development
Generated on April 12, 2005.
-
Brazilian Portuguese for 0.726 with over 60 modules!
(News)
-
supposed to "hit and run", because there might be some files which are heavily hacked -- yes, you can do that to translations, too :-)
That's because I used for quite some time pncUserHack (affecting NS-User, NS-NewUser and NS-Your_Account) and some News hacks. Also, Extended Topics and AT Lite Blocks might have different defines. But, anyway, that won't stop your site from working, of course. And bear with me, as this is a one man job.
But, please, send me your patches, so I can clean it up and release a FULL CORE COMPATIBLE TUpInUKIM, ok?
Here's the listing of modules included:
******************
* Módulos (63) *
******************
advanced_polls
All_Stories
Archive
Autolinks
Blocks
Censor
ChangePassword
ContentExpress
Credits
Downloads
dq_helpdesk
Encyclopedia
FeedBack
feproc
fetax
FormExpress
legal
MailBag
Members_List
Messages
Modules
News
NS-AddStory
NS-Admin
NS-Admin_Messages
NS-Banners
NS-Comments
NS-Ephemerids
NS-Groups
NS-Languages
NS-LostPassword
NS-MailUsers
NS-NewUser
NS-NewUser*
NS-Past_Nuke
NS-Referers
NS-Settings
NS-User*
NS-Your_Account*
pagesetter
Permissions
photoshare
phpBB_14
pn_bbclick
pn_bbcode
pn_bbsmile
pnTresMailer
PostCalendar
Quotes
Ratings
Recommend_Us
Search
seminars
shortnews
Stats
Topics*
UpDownload
Web_Links
xuser
* => modules duplicated in the pack due to hacks:
pncUserHack
ExtendedTopics
******************
* Blocks  (28) *
******************
admin.php
banners.php
big.php
category.php
emldaonline.php
ephem.php
error.php
finclude.php
fxp.php
i-featured_article.php
linklist.php
login.php
menu.php
online.php
past.php
phpBB_14.php
phplive.php
poll.php
progress.php
radio.php
recent_and_top_news.php
rss.php
rss2.php
stories.php
thelang.php
topic.php
user.php
whatsnews.php
Download link: http://prdownloads.sf.net/pnlanguages/pnlanguages-x_brazilian_portuguese-0726-tupinukim-A-beta.zip?download
Release notes (in Portuguese, pretty much the above info): https://sf.net/project/shownotes.php?release_id=239437
Project page: https://sf.net/projects/pnlanguages
Generated on May 20, 2004.
-
Custom User Fields Storing Problem
(News)
-
pnUserSetVar($name, $value, $uid = 0){ list($dbconn) = pnDBGetConn(); $pntable = pnDBGetTables(); if (empty($name)) return false;
if (empty($uid)) { $uid = pnSessionGetVar('uid'); if (empty($uid)) return false; }...
#2Making use of the previous change to the API code, the problem could be solved with altering newuser_user_finishnewuser function (modules/NS-NewUser/user.php).Right after the lines that update user table, insert the following:...$result = $dbconn->Execute("sql statement to insert new user...");$uid = $dbconn->PO_Insert_ID($pntable['users'], $column['uid']); if (!empty($dynadata) && is_array($dynadata)) {
while (list($key, $val) = each($dynadata)) {
pnUserSetVar($key, $val, $uid);
}
}...
I found that this change completely solved the problem with custom user data fields storing.
Miklos Kovac
Generated on February 24, 2004.
-
PostNuke .726 is Ready for Download
(News)
-
usability changes we're sure you'll enjoy using. You can download here: http://download.postnuke.com/pafiledb.php?action=category&id=45
Change Log
HTML 4.01 & CSS Compliance: Credit to Mark West, Brandon Harvey, and larsneo for taking on the project. This was a task that required touching many files within the system to make sure it all parsed correctly and validated.
Permissions Systems Updates: Credit to Marc Maes who contributed the code on the main mods site and thanks to larsneo for integrating into the main core. Additional credit goes to Adam and Mark West for code refinement. The new permissions provides enhancements to inserting permission, in-table editing/inserting and adding of permissions, filtering of shown permissions allowing you to show all the permissions that apply to a specific group. There are layout refinements and updates the configurations.
A note of special thanks and credit goes to Andreas (aka larsneo) who went through every module ensuring that all have the relevant permissions calls and the WHERE clause fixes were applied to all modules as appropriate to prevent any potential SQL injection issues.
ADOdb – Credit to larsneo Database Abstraction Layer Upgraded to 3.60: More Information about ADODB can be found at http://php.weblogs.com/ADODB_Manual
AvantGo - Mobile News Module Update: Credit to larsneo .726 note: permissions for 'Stories: Story’ and 'Topics: Topic’ components are fixed
As many of you know the AvantGo module allows you to pull information from the web to read on your PDA, Pocket, or next-generation phone.
Autolinks Permissions Updates: Credit to larsneo. Fixed permission schema, enhanced module security against script injection
Admin Message Update: Credit to aarrog. Applied patch #275 (use permissions to view admin messages)
A big thanks and credit goes to Michael Cohen – for providing basic source code auditing and due to various security related fixes over the complete code base an update is highly recommended.
New System Admin Icons: Credit to vworld.
- Various fixes and updates to language files
- Print Page Update
- New stats icons added
- New print page and refer article icons added
- Increased size of submit boxes
- New members list icons
- New members list title icon
- Updated topic images for a more unified look/feel
- Fixed empty line behind closing ?> tag (thx to geekster)
- Updated WHERE clauses [larsneo]
- Added default table type entry for pnconfig array
- Fixed TEXTAREA problem in error.php
- Minor fix in footer
- Backport of .8 fixes
- Additional HTML compliance fixes
- lensdebug.inc.php - backported .8 fixes
- pnAPI.php - removed re-correction of & html entity for html
compliance. - pnHTML.php - backported .8 fixes
- pnMod.php - added array check on args (thx to rabbitt)
- pnUser.php - fix for bugs #339 and #389
- queryutil.php - backported .8 fixes
- security.php - fixes for generic/specific permission checks (thx to
Ben Wynn)
- banners.php - fixed permissions
- big.php - fixed permissions
- rss.php Addresses patch #233 (CDATA tag not removed when fetching
RSS) - Includes/Search: HTML compliancy issues fixed and permissions
issues regarding results count.
- Install Issues: Fixes and installation updates
- Web Links Updates included HTML compliancy issues and log message
issues.
Last but not least thanks to InfoPro, pnCorps, and the community for testing, support and feedback on the release. And I apologize in advance to anyone I didn't mention in this post. Everyone has done a great job and deserves every bit of recognition they receive in the community and Open Source world!
Generated on July 28, 2003.
-
Security Fix Package for Postnuke .723
(News)
-
FIXES
/modules/Modules/pnadminapi.php (fixed regeneration bug, thx to cmgrote, jojodee, jnapp)
/includes/pnAPI.php (updated pnanticracker)
/includes/pnSession.php (fixed globals)
/modules/Credits/pnuser.php (fixed path disclosure, thx to Alexander GQ Gerasiov)
/includes/blocks/topic.php (fixed permission check, thx to ddrury)
/includes/blocks/weblinks.php (fixed permission check, thx to cs)
/includes/blocks/stories.php (fixed permission check)
larsneo, pnDev
Generated on January 4, 2003.