SMF Shoutbox

[Rich_A]

One thing I don't like is that when it refreshes it prevents me from typing text and in all Tabs too! I have to click outside of whatever field I'm typing into and click back into the field again to type.

I don't know how it can be fixed, would be great if this shoutbox was ajax then there wouldn't be need for a refresh system.

[tibbiye]

Have you tried the repair settings tool?
http://www.simplemachines.org/download/?tools
If so, may I have a link to your forum please? And if I cannot see the shoutbox can you create me a testing account so I can view it?

my site and shoutbox,no problem which repair settings..

http://www.tibbiye.org/index.php

thank u very much

[velko.org]

The new message sound doesn't seem to be working, I have the sound turned on in configuration in admin cp.  The wav file is in the root of forum but when a new shout comes in no sound anybody know where to look or why this feature may not be working for me?

All help appreciated

Poreman

I found it - sth in sboxDB.php is not right as far as the sound  is concerned.

It says at the end:

Code Select Expand



if (($modSettings['sbox_EnableSounds']) && ($alert === true) && ($div === true)) {
    echo '<embed src="' . $boardurl . '/chat-inbound_GSM.wav" hidden="true" autostart="true" loop="false"></embed>' . "\n";
  }



so above that I searched for $alert and $div and found that they cannot be true simultaneously - so the sound doesn't get embeded ...

The sboxDB.php is installed from the shoutbox's dir into Sources/ - so modify it there.

I tried removing the check against  && ($alert === true) && ($div === true) - and the sound worked.

[tibbiye]

I don't undertand anything I joined with admin password not working..I want to u ,users name and pass.I joined and come in worked..I don't understand anything..

[Jade Elizabeth]

The new message sound doesn't seem to be working, I have the sound turned on in configuration in admin cp.  The wav file is in the root of forum but when a new shout comes in no sound anybody know where to look or why this feature may not be working for me?

All help appreciated

Poreman

I found it - sth in sboxDB.php is not right as far as the sound  is concerned.

It says at the end:

Code Select Expand



if (($modSettings['sbox_EnableSounds']) && ($alert === true) && ($div === true)) {
    echo '<embed src="' . $boardurl . '/chat-inbound_GSM.wav" hidden="true" autostart="true" loop="false"></embed>' . "\n";
  }



so above that I searched for $alert and $div and found that they cannot be true simultaneously - so the sound doesn't get embeded ...

The sboxDB.php is installed from the shoutbox's dir into Sources/ - so modify it there.

I tried removing the check against  && ($alert === true) && ($div === true) - and the sound worked.

Can you please explain in dummy terms how you got the sound working, because I am a dummy and I dont understand

[Faramir.cl]

Hello!
         I am posting for 2 reasons...

1.- There is a security hole in the shoutbox, that allows a guest user to read the forum, even if the shoutbox is disabled for guests. They can access the history and they can even clear the history. A member of the forum I use edited the code and solved it, but I cant contact mbirth to tell him about this... he has not loged in here since october 2007, and the mail I sent him just bounced.

2.- I'd like to be able to filter, for some member, the shouts by other member (we have 2 people that would like to dont see each other), but I am not sure if that would be feasible to do...

[Jade Elizabeth]

Hello!
         I am posting for 2 reasons...

1.- There is a security hole in the shoutbox, that allows a guest user to read the forum, even if the shoutbox is disabled for guests. They can access the history and they can even clear the history. A member of the forum I use edited the code and solved it, but I cant contact mbirth to tell him about this... he has not loged in here since october 2007, and the mail I sent him just bounced.

2.- I'd like to be able to filter, for some member, the shouts by other member (we have 2 people that would like to dont see each other), but I am not sure if that would be feasible to do...

You must have installed wrong?
Though since you found a hole can you post the code changes so we may all be safe?

[blueranchu]

How can I close autorefresh?
and have a button to refresh by manual.
It is very load server.
I want everybody who first come that  don't use autorefresh.

[Faramir.cl]

Hello!
         I am posting for 2 reasons...

1.- There is a security hole in the shoutbox, that allows a guest user to read the forum, even if the shoutbox is disabled for guests. They can access the history and they can even clear the history. A member of the forum I use edited the code and solved it, but I cant contact mbirth to tell him about this... he has not loged in here since october 2007, and the mail I sent him just bounced.

2.- I'd like to be able to filter, for some member, the shouts by other member (we have 2 people that would like to dont see each other), but I am not sure if that would be feasible to do...

You must have installed wrong?
Though since you found a hole can you post the code changes so we may all be safe?

the security hole is, if you know the url of the forum, and you knok it uses the SMF Shoutbox, just go to:

http://nameofthehost/ForumRootFolder/Sources/sboxDB.php? address, and you will be able to see the shoutbox, and you can even access or delete the history.

The modifications to the sourcefile are on lines 252-257, 260 and 394 of the fixed file, they hare commented. The error message is in spanish, but is easy to change it to english.

As I said, it was not me the one who discovered the problem, and it was not me the one who was able to patch it... I was not sure if I should post it, since it would take time to fix all the forums, and some people can try to take advantage of it... but since I couldnt locate mbirth...

[Jade Elizabeth]

I went there, you can SEE the history but you cannot delete it...Maybe you should have tested it while you were logged out

[Faramir.cl]

I went there, you can SEE the history but you cannot delete it...Maybe you should have tested it while you were logged out

Well, I am almost sure (maybe I couldnt and I didnt notice it) I could delete a single shout... but it is true I never tried to delete the whole history, the other admins of the forum would have killed me (lol). But I tested it while I was logged out. Anyway, I think allowing a guest to see a private shoutbox is bad enough, even if they cant delete things.