Changelog: 2005-12-30 - Version 2.4.1 - fixed doubled sql_freeresult in functions_selects.php - fix extension admin panel (unable to update extensions) - changed tmp dir for ftp download in safe mod from temp directory in upload directory to upload directory 2005-11-24 - Version 2.4.0a - fixed a call to sql_build_array (wrong function used) in attach_mod/includes/functions_admin.php this is producing a php error message within the user administration panel (editing user details) - this version is a repackage, therefore the "a" at the end (nothing else changed, update path and everything else is the same) 2005-11-21 - Version 2.4.0 - using olympus' system of retrieving and storing values - using function for sql escaping - installer now checks for upload directory - fixing multiple call to database in installer - fixing sort_multi_array to correctly decide if sorting is based on numeric or string - taking open basedir restriction into account if checking for image size - making creation of temporary thumbnail file more unique if ftp upload is used (thanks to Douglas Hoffman) - fixing viewing of no longer viewable/denied attachments for admins (alcaeus) - display correct filename on download - added optional language variables (Sync_topics, Sync_posts and Sync_thumbnails) 2005-07-16 - Version 2.3.14 - seperated pre-modified files from the Mod and made them downloadable as a seperate package - updated pre-modified files to be compatible with the latest phpBB-Version - fixed bug with umlauts in filenames - updated create_thumbnails.php script to abide to the minimum thumbnail size - thanks to weightweenies - fixed typo in routine for determining when to refresh the posting screen - thanks to Meithar - invoke correct thumbnail display if storage path is outside of webroot 2005-05-10 - Version 2.3.13 - updated pre-modified files to be compatible with phpBB 2.0.15 - fixed serious issue with realnames. My thanks goes to CastleCops (specifically to Mere-Mortal and Paul) for discovering and reporting the issue - catch empty files if set - prevented generation of empty physical filenames if cryptic filenaming is not enabled - changed the way get_var is working - thanks to AnthraX101 for noting the issue - do not display upload limits if mod is disabled 2005-04-16 - Version 2.3.12 - updated pre-modified files to be compatible with phpBB 2.0.14 - added is_uploaded_file check to make sure only files really got uploaded gets into the filesystem - re-added opening new page on attachment download - fixed thumbnail erroring out on some occassions 2004-12-12 - Version 2.3.11 - fixed bug in GD/Imagick-Detection (on some installations thumbnailing images did not work) - Added mysql index to attachment table for larger boards - updated pre-edited files to be compatible with phpBB 2.0.11 - changed order of uploading files, resulting in hopefully getting the correct filesizes if the server does not allow file access outside the working directory - added check for config table constant to update script - fixed overwriting of group_id in admin_groups if Categories Hirarchie mod is installed - fixed bugs regarding the 4GB limits users experienced - fixed deletion of thumbnails - fixed directory traversal injection (high severity) - Paul Laudanski (AKA Zhen-Xjell) http://castlecops.com With this an attacker could be able to add/remove/execute files outside of the upload directory - fixed multiple file extensions vulnerability (high severity) - Jeremy Bae at STG Security, Inc. Due to the handling of mod_mime on multiple extensions an attacker is able to upload arbitrary script files to the web server. 2004-08-02 - Version 2.3.10 - fixed vulnerability in uacp.php (deleting attachments) - fixed bug in attach_rules.php - wrong filesize display - updated pre-edited files to be compatible with phpBB 2.0.10 - auth rules only checked for auth_attachments and auth_download - dropped addons directory (let the creator more freedom to maintain his work) - change thumbnail creation (new algorythm to calculate image sizes) - real GD2 support, fixing some issues - more small fixes here and there... mostly pointed out by users - fixed default quota assignments NOTE: Users/Groups having no quota limit will be defaulted to the default quota limit set, this means changing default quotas will automatically affect those users having no quota limit as well as newly registered users (since they do not have a quota limit by default). 2003-08-30 - Version 2.3.9 - Fixed possible XSS vulneribility - Fixed Bug: filename (input field) got not deleted after adding a file - Changed default quota priority from group/user to user/group - Added GD2 compatibility switch to Special Categories Screen - Added version number to Attachment Mod ACP Controls - Updated pre-modded files to phpBB 2.0.6 - Fixed non-saving of configuration variables if cache folder is there and not writable - Admins are no longer able to attach files to Private Messages, if this is disabled board wide - deleted all occurrences of attach_sql_query calls - mainly for compatibility - deleted attachment explain code - attachment debug addon is no longer available (please remove this from your board) - updated slideshow addon (if you update, please replace your old slideshow.php with the new one) 2003-06-19 - Version 2.3.8 - Fixed security bug - able to execute code on the client side - Removed: auth_read permissions to be set with auth_download - Fixed bug: thumbnail creation - Fixed bug: download with Mozilla - "Delete no longer used thumbnails" added to Synchronize Attachments Screen 2003-03-09 - Version 2.3.7 - hopefully fixed issues with the admin panel and hoster unable to correctly setup apache+php - added post id (and user id) sync to the Attachment Synchronization Panel - fixed user id assignment bugs within editing posts - adjusted thumbnail functions to be more error-proof. - fixed wrong display and deletion of Private Message Attachments within the User ACP. - changed header order in download.php and send content-length - add cryptic filename support (you have to manually enable this one within the posting_attachments.php file) - integrated the download_secure mechanism into the download.php file (commented out) - fixed bug with zlib.output_compression enabled (within PHP or Apache) - fixed general ob_gz_handler() issues with compressed files. Now re-compressing should not occur. - added Slideshow/Photogallery (available as Addon) - vHiker (see addons/slideshow_mod/install.txt) 2003-02-03 - Version 2.3.6 - added session id check to user attachment control panel - fixed bug: language selection error within user attachment control panel - fixed bug: unable to download files with ftp uploading enabled - fixed postgresql issue in admin panel - viewtopic_attach_body.tpl file now XHTML compatible - fixed some html issues in viewtopic_attach_body.tpl, should work with all browsers now - fixed bug: typo for message_die in shadow attachments screen - fixed file listing issues with ftp setups - fixed bug: no quota settings in user admin panel (only occured on direct url access) - fixed quota boxes, limited the graphic bar to 100% - fixed bug: if admin view users profile, his quota limit box is displayed instead of user ones - fixed bug: rules window not worked if Attachments within PM's was disabled and Admin tried to send PM. - html fixes for some tpl's, mainly checkbox entries - fixed bug: PM's with more than one Attachment not correctly duplicated (sentbox) - fixed bug: PM attach quota box display conditions, sometimes the box was not displayed - adjusted delete function to be compatible with all modes of id assignments (array, comma seperated, one value) - if no attachments are assigned in uacp, just display no attachments instead of an error message. - fixed bug: no more than 2048 MB in Quota Limit Management assignable - updated .htaccess file for more security - updated the contrib/download_secure.php file (backported the fixes made within the download.php file) - added file icons (see contrib/readme.txt) - added two additional viewtopic_attach_body.tpl files (see contrib/readme.txt) 2003-01-17 - Version 2.3.5 - on language include error fall back to board language instead of english - fix for non-working shadow attachments screen (only affected by boards with more than 200 Attachments)... - fixed some path assignments - Attachment Synchronization fixed, should not time out now - fixed download counter for streams and flash files - fixed check for receivers PM Quota Limit - fixed issues with boards setting the Filesize to Unlimited - fixed bug where Files got not attached if Post errors occured (If topic title is not defined for example) - fixed issues with Synchronize Attachments on MSSQL - fixed a little typo preventing display of comments within Preview Window - fixed non-deletion of attachment description entries on some circumstances - fixed determining of PM Quota (Receiver and Sender) - fixed issue with the updater and postgresql (unable to insert config values) - fixed issues with not recognising values correctly - suppress warning message if the function exec() is disabled - do not use imagemagick (instead use GD) if the path within Special Categories is empty. - adjusted Installation Instructions for phpBB 2.0.4 - changed authorization to attach files: only if posting is allowed too - changed authorization to download files: only if viewing is allowed too - changed the way the Attachment Size within the PM Box is counted, the SENT Box is not counted anymore. - changed the display of Attachments (DareDevil) - changed the Installation Paths to be compliant with phpBB 2.0.4 - Attachments are now displayed before Signatures - added Xitami to the servers doing a normal refresh if physical download is enabled - added User Attachment Control Panel (accessible from Users Profile) - added User Upload Quota Box to Users profile (Stats+Link too) these Upload Stats are only viewable by the User itself and the Administrator - added User Quota System (PM Quota and Upload Quota are definable for Users and Groups) - quota settings added to the user admin and group admin page - added quota limits cp to the admin panel - added additional check to the shadow attachments (sync attachment references with attachments) - added FTP Extensions check. If FTP Extensions are not compiled into the PHP Installation, the Administrator will receive the appropiate Message and is unable to configure FTP Settings. - added attach limit box to Private Message Center. - added pre-edited files for phpBB 2.0.4 - added compatibility for phpBB 2.0.0 viewtopic versions (you should really really upgrade !!!) - added setting to enable FTP Passive Mode - removed additional queries at viewtopic if images or thumbnails are displayed - added upload image to all instances of viewtopic_attach_body.tpl - added Attachment Mod User Guide - Attachments should be cached now - introduced optional caching of the Attachment Mod config table to let this work, just create a directory called 'cache' within your phpBB2 root and chmod it to 777. - dropped maintainance for the lang_german_sie package 2002-11-03 - Version 2.3.4 - fixed bug: Download should now work for 'very big' files again... please report anything you encounter. ;) - fixed bug: issues with Thumbnails, should work for most of you better, have a look at the AMod FAQ too. - fixed bug: Display of Comments - fixed bug: single quotes in previewing messages. - fixed bug: Error occurred while previewing PM. - fixed bug: upload icons not correctly displayed - fixed bug: mssql issues (not able to update) - fixed bug: check_lang_files script - fixed bug: Determine Attachment Mod Versions with the Updater - added: Extension Groups per Forum Permissions System - added: Support for (compressed) Flash MX Files, now they will be displayed/played correctly - added: Attachment Mod Synchronization - added: Attachment Rules Window (seeable at Posting Screen) - changed wma group to Streaming Group, able to Stream Video/Audio Types -- see Feature List. - re-done the Shadow Attachments Part, now it should work fine. - a little speed up in determining File Dimensions - dropped support for msaccess databases - added patch file 2002-10-13 - Version 2.3.3 - fixed bug: Single quotes within comments - fixed bug: Could not update Download Counts within Attach CP - fixed bug: Download opens new empty Window - hopefully fixed: Windows Download Paths with Drives - fixed bug: Not able to do more than one modification in Management Screen - fixed bug: Some issues with Attachments->Manage, display it in left frame - templated the html-code for attachments in viewtopic (i need a more detailed documentation of recursive template parsing or the template class isn't as powerful as i thought) - changed upload smilie code to image path 2002-01-22 - Version 2.0.3 - two typos in french translation (Lionel F. Lebeau) - added move_uploaded_file as an second instance if copy fails 2002-01-21 - Version 2.0.2 - Admin Module finished - Database changes can be undone (mod_table_uninst.php) - added check of upload ability and safe mode at table installation - put language changes for installation in extra files - kicked 'array_'-functions, because they are not supported in php3 - some cleanups and bugfixes - some changes to the download counter (especially security related things) 2002-01-20 - Version 2.0.1 - Download Counter 2002-01-19 - French translation (Lional F. Lebeau, thank you very much) 2002-01-14 - changed the install.txt a little bit - default auth for attachments in forums now ADMIN 2002-01-12 - Version 2.0.0 - Initial Release only for testing, little admin-module (group and shadow not finished yet)