PostNuke

Site search

Search results

Number of hits: 13

Development Update, January 2007-01   (News)

be productive and succesfull for all of us. And of course: a finished .8 version of PostNuke is something we are all waiting for.
MileStone 3 is waiting around the corner: A feature freeze so far has speed up the progress and only a few bugs are blocking a release. The next development update will probably be submitted after the MS3 release.
OK, here goes!

API functionality
Introduced is a pnShutDown function to gracefully terminate the application framework. This now replaces all use of exit or die and also fixes some oddities caused by PHP's shutdown process.
Mark has replaced all old themesideblock function calls with newer API call pnBlockThemeBlock. Furthermore, he has added a raw text option to the PageUtil::registerVar (former pnPageRegisterVar) system.
The AjaxUtil is now using internal json_encode() if PHP >=5.2.0.

Object Library and classes
For the SessionUtil / RandomUtil, Drak has put his hands on improving the randomness in the generation of the AuthKey and passwords. This is done by extending the possibly characters used, and the length of the key (length also now being random).
Also, the AuthKey generation makes now use of the (updated) RandomUtil class. A big advantage is that the random data generation is done in one place, so a change will affect the complete system. This is actually with the complete Object Library: changes can be made in one place with the benefit that all calls are updated.
The DBUtil has now a renameTable method and a renameColumn method for easy manipulation of table properties without having to worry about SQL code. The latter (renameColumn) is a quite new function, so there may be some adoDB bugs.
Finally, pnPage.php is converted to the PageUtil class. This means that any 3rd party module developers should update their modules to make use of the new class. A call to (for example) pnPageSetVar('title', $title_var) must be updated to PageUtil::setVar('title', $title_var). The pnPage.php does not remain for backward compatibility. Examples for the needed changes can be found in SVN submission 21099. The Wiki documentation for Page variables still needs updating however.

pnForms: functionality and documentation
Jørn has been updating the pnForms toolkit extensively. Most important is hat the documentation in the files is more complete, and the Wiki documentation page has been updated. A summary:

Added authkey checking to pnForms.
Added min/max validation for integers.
Changed "classHtml" to "cssClass" in "pnForm" plugin for consistency with the other classes.
Added a language selector "pnFormLanguageSelector".
and much more...

All plugins now render unknown parameters "as is", so you can add "onclick" and such like that the system doesn't know of.

System modules: Categories, Search and Blocks
In the Categories system, there has been added support for a 'field' parameter.
The search module is as good as finished, and also displays a sum of all search hits too. An additional parameter is added to allow for searches that aren't going to be performed on a DB. Finally, it is now possible to search in RSS feeds.
The Blocks module has been updated, and now has a user friendly functionality for drag-drop between block positions and placements in one screen. This is done with Ajax technology (thanks Frank for simplifying and enhancing this), so javascript should be enabled to use this (non-js fallback available). Furthermore a XML/XSL block has been added (a generic xml/xslt block and modifier).

ValueAddons modules
Faq: implemented custom short url handler and permalink structure
News: implemented cache handling
Feeds (was RSS): implemented categorisation in admin panel, added short url handler, added title field.
Also, the RSS module is renamed to Feeds to better reflect it's purpose and to prevent clash with rss theme when using directory based URL's.
TinyMCE: Upgraded tinymce to v2.0.9
Reviews, Referers, Stats: Converted to API and pnRender compliant module, updated table management code.

pnRender Plugins
Mark has added an output filter in order to auto-magically title the administration pages, which makes navigation a bit easier.Also, A

Generated on January 21, 2007.

Development Update, October 2006-04   (News)

PostNuke and the aim regarding ValueAddons
There have been a lot of discussion about what release structure there will be in any future versions of PostNuke. Let us clarify this a bit.
As soon as the core codebase of PostNuke .8 is stable, it will be released as a core application framework, from which advanced users can create their own custom module set. Also available will be a package containing basic content modules, a simple page manager (Pages) and an News article manager.
Eventually, the aim is to build different distributions for different purposes. A good example of a (very very) extended .76x package is the current OpenStar distribution.
At this moment, there exist a few modules in the ValueAddons repository that have third party equivalents with improvements and better functionality than the historic ones. And even more important, these module developers have taken good thought about importing historic data from the original modules, so this does not mean you lose any when deciding to switch to an other module. Some examples are Downloads 2.0 to replace Downloads, MultiHook to replace AutoLinks, pnMessages to replace Messages and Advanced_Polls to replace Polls.
Maintenance of the 'old' ValueAddons modules is a lot of extra work for the core development team, which will not only delay any future releases of the core framework, but also increases the timeframe for functionality and feature improvements in these modules. So, the less there is to maintain for the core development team, the better they can work on security, stability and finetuning the core framework codebase.
We to make clear that adoption of old-style modules is encouraged! Please remember that there do not (and will not) exist 'official' ValueAddons modules. While we'd urge all third party developers to maintain high standards in their code (pnAPI compliancy, using hooks for better integration of existing functionality), this can't be enforced.

Secunia's vulnerability advisory on the core Downloads module
Secunia anounced a flaw which has status 'less critical'. The ability to exploit this flaw is limited, since it can only be exploited by administrative users: specifically, you need admin permissions to the downloads module . A new release for the 0.7x codebase is planned for next week, together with some other bug fixes. People who want to patch earlier can download modules/Downloads/admin.php from the SubVersion repository and replace their existing file.

Legal module
The German PostNuke community has hired a lawyer to update the German terms of use, because translations into foreign languages of the original legal module only work on a linguistic basis (and if at all they only apply to US-American laws). In some countries, maybe it is even better to not at all use the legals module, than to apply one that doesn't fit your country's laws. Every user should keep this in mind when using or activating this module for his / her site.

Sneak preview: Wendell's Admin theme
Wendell is currently working on a design for the PN Admin area. This is a first setup to make the administration interface much more user friendly and productive.

Code update for .8 Installation
Do you have a personal_config.php included in your installation of .8? That could be the reason for an MS2 installation problem. If you are having problems installing, try removing this file. Furthermore, lots of enhancements have been made to the installer routine. One can test it by pulling the latest nightly builds.

System Changes / Updates
In the Settings module, a link to the w3school page on each allowable HTML tag has been added to inform a user about the available tags.
The Modules module now shows a (more logical) indicator of a module's status: not initialised is red; installed but inactive is yellow; installed and good to go is green.
In the pnRender plugins, some additions and changes have been committed: The pnbutton plugin now utilises the button tag, and a suitable style for the button tag was added. On can add parameters like id, class, name and value. Furthermore, the date input validation was refactured, moving the parser into the DateUtil class. All pnForm* plugins have been reviewed and optimized by Jörn.
More information on the PostNuke Forms Framework can be found in the Wiki.

Miscellanious updates
Within the complete codebase, all occurences of extract($args) will be (or already have been) removed and replaced it with $args['myvar']. The reason for this change is that you should not use variables that are not expected within the function. We encourage module developers to not use extract also.
Error handling and Status reporting has been improved to also display module, file and line information depending on permission l

Generated on October 10, 2006.

PostNuke Security Advisory 2006-1   (News)

VULNERABILTIES
Arbitrary SQL code execution via adodb (when db-user is 'root' without password)

SOLUTION
It is recommended that all admins check for the following files and folders and remove them if found:
/includes/classes/adodb/server.php
/includes/classes/adodb/cute_icons _for_site
/includes/classes/adodb/PEAR
/includes/classes/adodb/contrib
/includes/classes/adodb/session/old
/includes/classes/adodb/tests

Securing the whole /includes/classes directory from web access provides an extra layer of security, by protecting against potential as-yet undiscovered security risks in libraries.
The following .htaccess file, placed in the /includes/classes directory, will secure the directory (Download):
order allow,deny
deny from all

The main packages have been updated, the hash sums for the PostNuke CMS Platinum Edition 0.761a are:

PostNuke-0.761a.tar.gz
MD5: 0610c53c4bed0311862ccf422a68d6a5
SHA1: 0006f488cdb6ea53e532d9754a88fb17987a3a8c

PostNuke-0.761a.zip
MD5: e82bd983901e27e44ab8f82cc359dd00
SHA1: 3432699ded203a1b1fb2cdb6b1fab6cdbd367a4a

Download from downloads.postnuke.com

CREDITS
The exploit was originally discovered by Secunia (http://www.secunia.com), additional informations were given by Maksymilian Arciemowicz (http://www.securityreason.com)

REFERENCES
secunia.com/advisories/18260/
phplens.com/lens/lensforum/msgs.php?id=9350

Andreas Krapohl [larsneo]
PostNuke CMS Development Team

Generated on January 9, 2006.

The Road to .8 - Where are we, and where are we going?   (News)

The modules included in .760 which are templated, and taken direct from the .8 CVS are as follows:

Admin
Admin Messages
Autolinks
AvantGo
Blocks
Censor
Credits
Ephemerids
Groups
Header_Footer
Legal
Mailer
Members List
Messages
Modules
Permissions
pn_bbcode
pn_bbsmile
pnRender
Quotes
Ratings
RSS
Sniffer
Typetool
Xanthia

This represents a significant percentage of the .8 code, but there is still more to do. The aim of this article is to try and outline some of what remains to be done before we can consider a release of .8.

Six Main Projects for PostNuke Development
We have identified six main sub projects vital for a release of .8. These projects cover wide areas, and each are at different stages of completion. The six projects, in no particular order, are:


Integration of Open Star object library and Database Utility
Integration of Open Star category management
Installer
Xanthia
User management
Finishing of content modules

This article also includes a little information on some of the other new code to be introduced with .8 this is at the end, where we look at EZComments and the Error Handler.
Integration of Open Star Object Library and Database Utility
The new Database layer reuses the existing pntables information to provide an
object representation of database rows. The advantage of this approach is that
it allows you to basically remove manually coded SQL statements and replace
with what's typically a 1-line statement. Some sample invocations of such code
are shown below:

[code]
$myObj =& DBUtil::selectObjectByID (, $id);
$myObj =& DBUtil::selectObject (, $where);
$myObjArray =& DBUtil::selectObjectArray (, $where, $sort);
DBUtil::insertObject ($myObj, );
DBUtil::updateObject ($myObj, );
[/code]
These functions all return an associative PHP array, or in the case of array
functions, an array of arrays. The fields in this array are cleaned up in
the sense that any field prefixes have been removed. This DB API also
gives you the ability to have generate associative (object) arrays, expanded
arrays with other table fields joined in (which means that you can save SQL
lookup calls) as well as store/retrieve dynamic attributes without altering
the underlying table structure. Together this provides a highly flexible API
which can take care of all storage & retrieval operations.

On top of the DB layer sits the Object Layer. Objects provide a component model
which features transparent persistence facilities. Objects/Classees are loaded
though the Loader API though
[code]
Loader::loadClassFromModule (, 'foo') //

Generated on November 3, 2005.

PostNuke Blocks Module "func" Directory Traversal Vulnerability   (News)

specially crafted "func" variable containing "..\" sequences, which may be exploited remotely to conduct directory traversal attacks.
http://server/index.php?module=Blocks&type=lang&func=../dir
* Affected Products *
PostNuke version 0.76-RC4 and prior
* Solution *
Patches are available via CVS :
http://cvs.postnuke.com/viewcvs.cgi/Historic_PostNuke_Library/postnuke-devel/html/includes/pnMod.php.diff?r1=1.47&r2=1.48

http://cvs.postnuke.com/viewcvs.cgi/Historic_PostNuke_Library/postnuke-devel/html/index.php.diff?r1=1.39&r2=1.40
2005-05-17 : Original Advisory
*******************************************
This was found by my webhost and posted to my webhost's support/security forums two days ago. I just found it today. The changelogs above have a number of changes in them.
To Admin: Is this worth making a deal over

Generated on May 19, 2005.

Technote regarding DCrab Security Advisory   (News)

in the public CVS. Please keep in mind that .76x is currently a 'Release Candidate' and not intended for use on production sites.
If any customers experience a problem and believe it to be related to this issue, they should open a bugtracker entry, including enviroment information for debugging.
Please also note our security contact form.

larsneo
PostNuke Developmen

Generated on April 12, 2005.

Downloads on PostNuke.com Target of Hacker: Immediate Action Required if You've Downloaded PostNuke in the Past Three Days   (News)

a different server. Second, in one file there was code allowing a malicious user to execute any shell command on the web server.

As noted before, immediate action is required from everyone who downloaded the .zip package between Sunday (24.Oct) at 23:50 GMT until Tuesday (26.Oct) at 8:30 GMT.

Required Actions
1. Immediately remove the affected file /includes/pnAPI.php and replace it on your server with the original one (either from a fresh download or from http://cvs.postnuke.com/viewcvs.cgi/Historic_PostNuke_Library/postnuke-devel/html/includes/pnAPI.php?rev=1.86&content-type=text/vnd.viewcvs-markup)

2. Check the access-logs for any entry containing 'oops='. If you find any call please contact the PostNuke Security Team via http://forums.postnuke.com/index.php?module=vpContact providing the access log for further investigation.

3. Change your database details, username, password and if possible, database name.

Future Safety Precautions
In the future to avoid downloading tampered files please compare the MD5 checksums with an independent source to ensure legitimacy, such as http://www.post-nuke.net. For those unfamiliar with MD5 it is a check you can use to make sure the download has not been tampered with and can be trusted. In order to compute a checksum you need an MD5 utility and you can find a variety of tools (for windows) here: http://lists.gpick.com/pages/Checksum_Tools.htm and another favorite is the free and platform independent open source project jacksum (http://www.jonelo.de/java/jacksum/) You can also find more information about this topic on Wikipedia at http://en.wikipedia.org/wiki/Md5

Finally, be assured we are working to find the hacker and will take any and all legal action when they are found.

About PostNuke
PostNuke is a community, content, collaborative management system, a C3MS providing webmasters with a set of tools to build a dynamically generated web site within minutes of downloading the software. It's backed by a team of dedicated, talented developers, designers, and volunteers with years of experience.

General Info About PostNuke:
Modular Structure, Customized Functionality through Third-Party Modules, Advanced User Group Permissions System, Multi-language Support (Approximately 36 Language Packs Available), Embedded WYSIWYG HTML Editor Activated on Most Text Entry Areas, Site Search, Advanced API (Application Programming Interface), Focused on High Level of Security, Easy-to-Use Guided Browser Based Installation, Easily Change/Customize Your Site's Look/Feel Through Plug-in Themes, Provides advanced content management features while promoting collaboration, communication and community around the content.

A Short List of Available Modules
News Publishing, Content Management, RSS Feeds, Voting Booth/Polls, Banners Module, Comments Module- allows other modules, including

Generated on October 26, 2004.

Announcing pnDevelopers v 1.0   (News)

pnDev Site Features
This site is built around Postnuke and provides automatic logins and benefits from amazing packages like phpCollab, phpBugtracker, phpBB2, viewCVS, cvsnotices, and the Embedded PN and data bridge which makes it possible to share user data, permissions and many other functions.

We hope you like it and will become a part of it!

All this integrations and client applications are built around the Embedded PN v 0.2 technology, which allows us to share data and security among applications flawlessly under PN.


How does it work?
Well we have used a unified login system for all applications, this means you log in once and you automatically are granted access to all available user resources. So all you need to do is register and you will be able to use most services *as is*. It's just that simple one registration enables all services for you.

Later on you can request to be added to the developers group, while doing so you can also request CVS write access to the repository, these permissions are granted on a case by case basis, since they show a great degree of commitment and require you to take responsibility.

This assumes previous knowledge and experience with using CVS with write permission, with coding for Postnuke, and to follow coding guidelines and standards.

If you wish to become a part of the developers group, we would appreciate a brief summary of your knowledge and experience with PHP, mySQL, CVS and Postnuke of course.

A brief description of your goals and areas of participation in the core development, which appeal to you and why? This doens't have to be anything elaborate, just a basic outline of your skill sets. Having this information will help us set up your account with a smaller task force team.

Postnuke development is to branch into smaller task force teams, each being responsible for a a smaller part of the core, like a module, blocks, API, database abstractions layer etc.

Each team will then set goals and time lines, while maintaining close communication with other relevant task force teams in order to coordinate efforts and dependencies with one another.

The bugtracker is to serve as a way to debug, clean and correct code, and serve as the knowledge base, as it grows, to help new members find answers to common questions.

pnCollab, will allow management of each task force team and monitor its progress over time. As well as provide a good way to review the whole, but each smaller project will have unique members that will be in full command of their part of the project.

The forums have been greatly enhanced to include advanced tools that further promote collaboration and sharing (like file attachments, automatic thumbnail generation, calendar for events, mail subscription to any or all forums and more). Here is the place for debates, brainstorming and the second part of the knowledge and project log system.

The view CVS (concurrent versioning system) tool allows one to browse and interact with the repository in a flexible and useful way, annotations and all CVS operations are constantly being logged into mySQL, as well as automatically mailing it to the CVS-notices mailing list to which you can subscribe or peruse by using the CVS notices area.


There are of course a number of other useful tools like the forums/portal bookmarks which allows you to select content randomly and group it for later use, there are many easy ways to get updated information for your site too, the portal has enhanced backend RSS news feeds as well as the forums and the CVS portion of the site.


So you can see we have a lot of tools here and we are still working on enhancing the users details area to include pertinent details regarding each developer. And of course any additional tools or ideas will be implemented as we move forward, strong>this site is intended as a strong foundation / framework from which to build into the future.


Finally, we are also integrating new admin tools in order to streamline CVS access privileges to the repository. So in general this is the global overview of this site and its intended goals and methods.


The site can be found here http://developers.postnuke.com


We encourage any interested parties to register and send a private message to either MagicX, or Neo in order to sort out additional details. Also the forums need new categories that will host the different ongoing debates for the project and from there, we will define the projects development goals in the short, medium and long range.


Additionally the smaller task force teams will be created from all those who volunteer and new coordinators created for each that will in turn collaborate with their counterparts in order to keep things moving at a nice pace, in a concerted effort.


The summaries of all progress will be made public periodically so the community as a whole can be aware of what is going on at all times in a transparent and open fashion. This in the purest spirit of Open Source projects.


This is the dawn of a new era of unprecedented collaboration and progress, this is the time we all have been waiting for, we ask all of you interested to step in, and become a part of this project we all love so much, and help it grow and become what it deserves, and was always intended to be, no more, disputes, no more gossip, no politics, lets just work, let our actions speak louder, and make this the best CMS out there.

I once saw a movie that had as the main character the great actor "Kevin Costner", I believe in it he constantly heard a voice, that told him "Build it and they will come...." well its built come on in ;)


Thanks

Enjoy!

The Postnuke Development Team

Generated on September 24, 2002.

FoxServ Public 3 Beta 5 & TortoiseCVS 1.0.0: two developertools new released   (News)

developement with many enhancements. See the latest news on the FoxSERV site. Please visit Foxserv @ SourceForge.net for download.

2. Torsten Martinsen, a developer of the TortoiseCVS-Team: "To all of you out there impatiently waiting for the new release - don't hold your breath :-) We will release 1.0.0. ...next week... with "lots of exciting new features": see the TCVS-Changelog. Please check back the TortoiseCVS-Team: They have an very active developer-team and a mailinglist.

With both mentioned tools, you can check out the latest version of PostNuke at the CVS-respository on developer.hostnuke.com: See here the tutorial. By the way: If you need a new free editor, check back phpEdit.org for the latest release.
marti

Generated on July 27, 2002.

tortoiseCVS 0-52exe released   (News)

Here the TortoiseCVS-Download!
In less than 20 minutes , you can get a Postnuke-CVS-cut of the latest developement-version of PostNuke, or the newest of any PN-Modules. For a detailed How-To, please see this good tutorial: A anonymous-checkout on SourceForge needs only 20 minutes and is described in short below!

With the following entries you can get a anonymous-checkout from the CVS-SERVER:

[ cause the above mentioned tutorial disappeared, i wrote a short How-To]

Protocol: Internet (pserver [ passwortserver])
Server: cvs.post-nuke.sourceforge.net
Repository directory: /cvsroot/post-nuke
User name: anonymous
Module: postnuke_official


here some examples for the entry into the rootpath: TortoiseCVS-Dialogmenü
enter for ROOTPATH:
:pserver:anonymous@cvs.post-nuke.sourceforge.net:/cvsroot/post-nuke
:pserver:anonymous@cvs.pn-modules.sourceforge.net:/cvsroot/pn-modules
:pserver:anonymous@cvs.pn-modules.sourceforge.net:/cvsroot/pn-modules


martin

Generated on May 22, 2002.

Page 1 / 2 (1 - 10 of 13 Total)