UserSpice

× This forum is read only. As of July 23, 2019, the UserSpice forums have been closed. To receive support, please join our Discord by clicking here. Thank you!

Welcome, Guest

You have to register before you can post on our site.

Search Forums

(Advanced Search)

Forum Statistics

» Members: 1,007
» Latest member: kavitasinghji
» Forum threads: 1,324
» Forum posts: 7,788

Full Statistics

Online Users

There are currently 713 online users.
» 0 Member(s) | 709 Guest(s)
Applebot, Baidu, Bing, Google

Latest Threads

UserSpice Alpha Testing a...
Forum: News Center
Last Post: ivinsons
11-08-2024, 06:13 PM
» Replies: 13
» Views: 42,475

UserSpice 4.4 Development
Forum: News Center
Last Post: Amelie12
09-21-2024, 12:23 PM
» Replies: 4
» Views: 15,199

Welcome to the new UserSp...
Forum: News Center
Last Post: ivinsons
08-25-2024, 07:39 AM
» Replies: 2
» Views: 27,918

How to use hasPerm
Forum: UserSpice 4.4
Last Post: mudmin
07-20-2019, 02:45 PM
» Replies: 1
» Views: 13,755

Session issue? What I sho...
Forum: UserSpice 4.4
Last Post: Parth
07-17-2019, 05:06 PM
» Replies: 4
» Views: 14,502

Email Error
Forum: UserSpice 4.4
Last Post: Brandin
07-17-2019, 04:47 PM
» Replies: 1
» Views: 6,623

{ Missing Text } after up...
Forum: UserSpice 4.4
Last Post: Brandin
07-16-2019, 04:23 PM
» Replies: 22
» Views: 53,638

Best Practice Info
Forum: New to UserSpice?
Last Post: Brandin
07-16-2019, 11:55 AM
» Replies: 1
» Views: 13,490

Force to use 2FA -always-
Forum: UserSpice 4.4
Last Post: Brandin
07-12-2019, 12:43 PM
» Replies: 1
» Views: 6,636

e-mail not verifying
Forum: UserSpice 4.4
Last Post: LBC
07-10-2019, 11:34 AM
» Replies: 31
» Views: 76,232

did_not_have_permission.php

Posted by: oscar - 10-22-2017, 11:26 AM - Forum: UserSpice 4.3 and Below - Replies (1)

hello, I'm trying to insert a popup alert in the did_not_have_permission pages, so that it will tell the user what went wrong.

I added to the page the code:

`<html><body><script> alert("Acces denied"); </script> </body></html>

but the browser immediately jump to redirect.

If I comment the redirect in the us_helpers.php then popup appears.

I guess it is linked to the intrinsic logic of php, but I did not manage it.

I would like to edit only the did_not pages, without touching the us_helper.

How could I do it?

Thank you!

Issues with login after forgot password

Posted by: nash81 - 10-22-2017, 06:43 AM - Forum: UserSpice 4.3 and Below - Replies (1)

Hi,

When i hit the forgot password link on login page, enter email and move ahead to received the link. Change the password, the password gets update and all works fine up untill here.

Now when i go back to the login page and try to login, the first time i login always fails and brings me back to the login page.

The second time i login with the same credentials and updated password, it logs me right in.

What am i missing here !

Status Update 035

Posted by: Brandin - 10-20-2017, 11:57 PM - Forum: UserSpice 4.3 and Below - No Replies

BUILD NOTES STATUS 35

New SQL dump required

UPDATES
users
admin_user.php - patched username update logic to use global settings
admin_permission.php - security bug patch
user_settings.php - patched username update logic to use global settings, added email_new function so
we don't get endless loops of redirects, and email_verified is never set to 0, also doesn't update email until verified
verify.php - as above
join.php - redirect if logged in
joinThankYou.php - redirect if logged in
verify_resend.php - added user logout if logged in
forgot_password.php - added user logout if logged in
forgot_password_reset.php - added user logout if logged in
helpers
helpers.php - see note in file in display_errors function
views
_email_template_verify_new.php - added template for email updates from user_settings.php

usersc
scripts
token_error.php - Karsen's deploy

Cronjob task

Posted by: bullsalad - 10-20-2017, 07:58 PM - Forum: Documentation - Replies (1)

	Hey, I'd like to ask what would be the most efficent way to run a very simple php crontask on the server every few minutes. I did try out some stuff but none really came out working so I'd like to ask.

init.php

Posted by: dave3460 - 10-20-2017, 02:00 PM - Forum: Off-topic Discussions - Replies (1)

	Hi question to anyone that may know. My domain host will not allow the change of group concat from 1024 to max. so my question is i have tried adding to the init file to session the group concat but when i do it runs a 500 error code . which way would be best to add this or just redesign the way i am doing group concat via my hosting. Thanks in advance

Set new account permissions?

Posted by: radke - 10-20-2017, 02:20 AM - Forum: UserSpice 4.3 and Below - Replies (9)

Hello!

I'm sure that I'm missing something super basic here but for the life of me I can't figure out how to set the permission level of a user when the account is created. I have created a permissions group, it's set to 3.

In join.php, under `// echo "Trying to create user" I see 'permissions' => 1, but changing 1 to 3 seems to have no effect

Am I barking up the wrong tree?? Any help would be greatly appreciated

Thanks and thanks for such an awesome and insanely useful project!

UserSpice 4.2 Bugs and security

Posted by: SavageStyle - 10-16-2017, 05:07 PM - Forum: UserSpice 4.3 and Below - Replies (4)

Here is few bugs I have found so far, may be I will remember some more that I patched for myself, so here is what i've found:

found bugs:

1) http://localhost/usercontrol/users/admin_user.php?id=2
not using global settings for name length

Code:
line 57, 58

should be changed to
<pre>

Code:
'min' => $settings->min_un,

'max' => $settings->max_un

</pre>

2)

Code:
function display_errors($errors = array())

- helpers.php - remove

Code:
echo "<br>"

- that br resulting content to slip below on every page that function called

3) http://localhost/usercontrol/users/admin...ssions.php

Code:
line 97,98

- dublicate of
<pre>

Code:
$errors = [];

$successes = [];

</pre>

that decleared above - that 2 lines should be removed, preventing any message to appear

4) http://localhost/usercontrol/users/admin...ssions.php

Code:
line 65

- echoing error to nowere, appearing above in black ugly block

Code:
echo "Permission Updated";

should be

Code:
$successes[] = 'TEXT';

5) http://localhost/usercontrol/users/profile.php?id=0
giving wrong id, resulting in banch of errors

Security issues:
1) http://localhost/usercontrol/users/admin.php
2 forms have no csrf protection - adding session token will solve that (i am using both session and per-request tokens)

2) http://localhost/usercontrol/users/admin...n.php?id=1

Code:
line 28

, value of

Code:
$_GET

is not sanitized

3) user name validation - user can create crazy names like <script>lala - should not allow that

That may be not bugs but logic flaws:
1) http://localhost/usercontrol/users/joinThankYou.php - should redirect if logged in?
2) http://localhost/usercontrol/users/join.php - should redirect if logged in?
3) http://localhost/usercontrol/users/login.php - should redirect if logged in?
4) http://localhost/usercontrol/users/maintenance.php - should redirect if no maintenance?

Hello UserSpice! And everyone else!

Posted by: SavageStyle - 10-16-2017, 03:28 PM - Forum: New to UserSpice? - Replies (1)

	Hello there everyone! My name is Stanislav and im using UserSpice to create big technical project! First of all - thanks for the work! You helped me alot! I was able to find alot of bugs in US during my journey, will share them with you soon! Also I am interested in any additional security flaws that you guys may be found!

Updating E-Mail in Change User Settings results in beeing blocked out the site.

Posted by: komodo - 10-16-2017, 02:20 PM - Forum: UserSpice 4.3 and Below - Replies (5)

Hello

I have turned on email verification.

If a user changes his email in user_settings.php, the Database updates the new mail and sets email_verified to 0 and spits out the message "Email updated."
However it doesn't send out a new verification email?

After updating the email, when you click somewhere else, the page logs you out with the message
"Ooops! There was an error verifying your email address. Please click below to try again" (verify.php)
If you click on the link nothing happens. No Verification email is sent resulting in blocking out the user forever.

Crossword site using UserSpice 4.2

Posted by: willb - 10-15-2017, 04:04 PM - Forum: UserSpice 4.3 and Below - Replies (2)

Hi everyone,

I've been working on a site that helps people play and create crossword puzzles. It's geared towards British-style crosswords (more black squares than US ones).

Anyone can play existing crosswords. But I've used UserSpice to let people register and log-in, and then upload their own creations onto the server. They then get a link they can send to friends to challenge them on a puzzle.
UserSpice saved me loads of time getting the registration and log-in process working.

It's very much still in beta, but I'd love to know what you think.

Also it's not on HTTPS, so if you register, please don't use your banking password!

Here it is:
http://www.willbryson.co.uk/TryMyCrossword

cheers,
Will

Pages (131): « Previous 1 … 51 52 53 54 55 … 131 Next »

Login




Remember me Lost Password?