and disable all the script exectution they add all around until they realize all their "features" actually cause security issues all around, we have to filter stuff lphuberdeau: ok, let me know when you have convinced MS ;p lphuberdeau: but agree on the principle lphuberdeau: I think I'll try to detect two different use of 'style' (the first as a tag, the other as style[SOME_POSSIBLE_CHARS]=), to affect less 'style' legitimate words feels like the only way to filter things properly is to use a real parser lphuberdeau: yes, this is my point of view for 3.0 :) lphuberdeau: but too late for 2.0 sure is lphuberdeau: another thought : the 'style' problem that is displayed as 'style' is really annoying in content that does not allow HTML in fine. Those places are mainly parsed as wiki. I can handle those '' in wiki parsing in order to avoid the conversion into '<x>', so they will not be displayed, as in HTML mode (and will be less annoying). What do you think ? well is bad as it breaks HTML validation but yes, adding an exception in the parser could be an option lphuberdeau: right, but it is what is used in the original function I proposed. The idea is clearely to have something that won't be displayed but breaks XSS code. Maybe should we replace it by a or something that does the same and HTML valid. Btw, it only affects content that may contain some keywords... not a so huge problem I think. lphuberdeau: ok, I'll try to add this exception. Anyone on who deals with themes? or has been working on them? kerrnel: chibaguy and luci, mainly ;) ok, will hit them up when they're around, thanks nyloth! hey, don't hurt the guys, we still need them badly love taps lol :) Doc does not state if WYSIWYG emits HTML or WikiSyntax: http://doc.tikiwiki.org/tiki-index.php?page=Wysiwyg&structure=Documentation SEWilco2: HTML, but there is features to allow some wiki syntax inside Can TikiWiki site search also search in HTML pages? I don't want to lose documents in the pile. you mean HTML wiki pages (from wysiwyg) or HTML static pages ? Hello. :) nyloth: I'd like to know both, to help decide on acceptable formats. I think I've seen mention that static HTML pages are not searched. Hi I had some questions about css formatting SEWilco2: yes, but HTML wiki pages are indexed for search. Hi ohertel :) note to the world, I do not respond to PM (lost my password many years ago, 2 days after getting it changed for the same reason) hm, how do I force a folder from SVN repository to disc again? I accidently deleted .svn in the cache folder.. ,) nyloth: Thanks. I'll probably turn on my WYSIWYG then. SEWilco2: Be warned it's an experimental feature in 2.0 nyloth: Even worse, I'm using 1.9.11 where it's not labeled whether experimental. ohertel: rm -rf ./temp/cache ; svn revert temp/cache or svn update temp/cache ah, revert it was. .P thanks. SEWilco2: Ouch, 1.9.11 ? Are you working in a museum ? ;p nyloth: Working with customers concerned about security and stability. Little documentation of 2.0 stability. Probably working in a bank. ^^ SEWilco2: 2.0 should be more secure and quite stable Yeah, I noticed the category group permission in 2.0 which I need. I have one internal wiki. I'll try 2.0 on that. :) Let's see... lunch, convert to 2.0, wiki training meeting in 3.5 hours... yeah, this will be either good or interesting. tw.o is based on a svn checkout now, so updates should be easier. :) lunch, backups, convert to 2.0, ... ohertel: ok :) ohertel: as dev.tw.o ;p nyloth: Nope, I just set up the wiki which I'll convert to 2.0. No data. Will actually be testing if conversion scripts fail with no data. Hi all. I'd like to include some of the new user's user-tracker info in tiki-edit_templates.php?template=mail/moderate_validation_mail.tpl (That's the email that gets sent to the admin to approve the new user that just tried to register. The admin would like to know a little about the user before approving them.) Can someone please teach me to fish in that pond? Thanks. :) Looking in other .tpls, in ./templates/tiki-plugin_trackerlist.tpl I see tiki-view_tracker_item.php?trackerId={$trackerId}&itemId={$items[user maybe that's a start... yesterday sylvieg gave me this: $mok = wikiplugin_trackeritemfield('y', array('fieldId'=>1, 'test'=>1, 'value'=>'y')); to put in a .php file Hello all OK, let's make it simpler. I can send a link to the admin like so: http://domain.com/tw2/tiki-user_information.php?userId=28 where 28 is the new user's id. So, I need to generalize it to something like: http://domain.com/tw2/tiki-user_information.php?userId={$mail_userid} but I'm just guessing that that is the right variable to use. Is there a list of available variables that I can look up? Or I could use http://domain.com/tw2/tiki-user_information.php?username={$mail_user} but what is the variable name I should use immediately after the ? to make that work? try view_user security.tikiwiki.org http says connect timeout Ooh, sylvieg is good, really good! How's that taste, marclaporte?! Yummy! Ugh: You do not have permission to write the template ...dropping down to the command line... priti: thx, if you need to report something, you can send it to security AT tikiwiki.org ok thnx re re actually, the theme mail template file doesn't exist, so I made a backup and edited ./templates/mail/moderate_validation_mail.tpl and added the lines: {tr}To view the user data, please follow the link:{/tr} http://domain.com/tw2/tiki-user_information.php?view_user={$mail_user} Thanks, sylvieg! Not exactly what I wanted, but good enough for now. (The admin has to click the view-user-data link, review the info, go back to the email, and then finally click the approval link. If the user_info info was in the email, the admin would only have to click the approval link.) Is the above 2-line edit to ./templates/mail/moderate_validation_mail.tpl worth committing? (I don't know how and am not approved, otherwise I would, after approval.) hi i have a tiki css question if anyone can help Steps 2 and 3 of SVN instructions are for updates but are not phrased to indicate whether they are required after step 1 - checking out SVN stable. http://dev.tikiwiki.org/Download#Using_stable_from_SVN_2_x_ Hmm. I'll have to port my SEFURL patch to 2.0 also. Well, rewriting 90% of it. Hi - css question - I created a default2_username css, but none of the styles are showing up when i reference them in my html Do I need to make any other config changes for these styles to show up? "Updating with SVN to HEAD is easy." OK, so it's easy. Is HEAD what I just checked out with "svn co https://tikiwiki.svn.sourceforge.net/svnroot/tikiwiki/branches/2.0" (I don't know if HEAD is a synonym for "the latest available version of -- in this case Stable".) hi - quick question - how do I disable users' ability to select their own css? lphuberdeau: About your RFC for the core, that I've just read : Great. Only two small comments : 1) For a proposal, maybe diagrams should be optional (depending on the complexity, and done on request) ; 2) for coding standards (for the core), Zend ask to use 4 spaces instead of tabs. We agreed on tabs. ok, that can be ammended ;) I think I mentionned something about diagrams ok, I let you make those small changes if you agree one about tabs is in Ideally the proposal should contain code samples demonstrating how the component will be used and diagrams or interfaces explaining how it will be implemented. lphuberdeau: btw, lphuberdeau, thanx for your recent work, I like it :) you mean inserting security issues in the installer? LOL no, not this one ;p but everybody make mistakes sometimes harold: hi, you should have 'Reg users can change theme:' in admin > login harold: well, for 1.9.x I'm not sure, but at least in 2.0 Uh... 2.0 stable says to use "tiki_1.8to1.9" to upgrade DB from 1.9. Is there an extra entry in that table, which made 2.0 put 1.9 out of alignment? In ./templates/mail/moderate_validation_mail.tpl , I hard coded my path as http://domain.com/tw2/tiki-user_information.php?view_user={$mail_user} which worked perfectly for me, but of course I can't commit that, I have to generalize the url. Elsewhere in that file is {$mail_machine} but that apparently points down to http://domain.com//tiki-login_validate.php . Does anyone know what variable I should use in this case? I found $mail_site but that doesn't give the tw root, just the domain.com part. Hmm. I came in partway of the style discussion. Don't know if it breaking "Custom Home" was mentioned. That's odd. Tried WYSIWYG. Save emitted 404 "The requested URL /HomePage&saved_msg=y was not found on this server." but the page was saved. Probably .htaccess needs tuning. Oops, I forgot to htaccess.sh after conversion. thanks nyloth - I knew that was it, but had a hard time finding the right screen harold: you're welcome SEWilco2: I don't see the relation between Custom Home and style SEWilco2: Btw, you can test the last branches/2.0 if you want ;) nyloth: better to keep related discussions for other place ;) hi nelson :) luciash: sure, but, btw what is commited may have to be tested :) luciash: did you recently have a look at stuff ? ;p nyloth: yep, and it sucks :) well, i was wrong with common text, sorry but still, having it in code listings... I'm trying to tweak tiki-login_validate.php to get it to give me a variable like {$mail_twroot} that returns something like "http://domain.com/tw2/" so that I can use that in the email to goes to the admin to approve a new user that just registered. In this section: $foo = parse_url($_SERVER["REQUEST_URI"]); $foo1 = str_replace('tiki-login_validate','tiki-login_scr',$foo['path']); $machine =$tikilib->httpPrefix().$foo1; $smarty->assign('mail_machine',$machine); I should be able to parrot that like so: $foo2 = str_replace('tiki-login_validate','',$foo['path']); $twroot =$tikilib->httpPrefix().$foo2; $smarty->assign('mail_twroot',$twroot); but that just returns null for {$mail_twroot} in the email. Any ideas? {$mail_machine} returns http://domain.com/tw2/tiki-login_validate.php nicely, so I was just hoping to replace tiki-login_validate.php with null... Looking at it for the 10^6 time, I now see that maybe I can simply use: $twroot =$tikilib->httpPrefix(); //doh! but that still gives me null in the email to the admin. Maybe I need to declare or pass the new variable $mail_twroot somewhere somehow? nyloth: hi nyloth: priti was indicating that the site security.tw.o was down, it was down for about 30mn srishti: otabz: you here? yah yea yah, the security.tw.o site is up now. security site went down around 5.30am and we informed marclaporte and it came back up at around 6am marclaporte did not reply so we were told to emaile at security@tikiwiki.org marclaporte: srishti: otabz: /join #tikiwiki-monitor if any of you is managing the hosting of a tw.o site please meet in #tikiwiki-monitor /join#tikiwiki-monitor lphuberdeau: you here? yes nyloth: Sorry, not "Custom Home", but "Custom Site Header" is broken by style. Using