|
|
|
Link articles to CB Profile
|
|
Date: 2009/06/23 19:22
|
By: Seanstex
|
Status: User
|
|
|
Karma: 0
|
|
Fresh Joomlapolitan
| Posts: 8 |   |
|
|
Pretty much what the subject says. I tried using ZaKAuthor but it seems with 1.2.1 it just displays a href code where the name should be.
Agora author bot will link to their profile, but only if I want their real names displayed as the link. And I don't
Alias name doesn't link at all.
It's a pain because if I want to publish articles after members submit them, I have to set parameters to Hide name, show alias then type in their username manually for each article which also doesn't link to profile.
There has got to be an easier way to do this?
|
|
The administrator has disabled public write access. |
|
|
|
|
Re:Link articles to CB Profile
|
|
Date: 2009/06/24 02:51
|
By: Seanstex
|
Status: User
|
|
|
Karma: 0
|
|
Fresh Joomlapolitan
| Posts: 8 | |
|
|
Well it's good to know that there's something in the works atleast  . I'll just have to deal with the long linkless route for the time being.
|
|
|
The administrator has disabled public write access. |
|
 |
|
Re:Link articles to CB Profile
|
|
Date: 2009/08/11 21:05
|
By: yvolk
|
Status: User
|
|
|
Karma: 2
|
|
Fresh Joomlapolitan
| Posts: 9 | |
|
|
krileon wrote:
lemur wrote:
The problem was solved by Yuri Volkov (yvcomment).
See:
http://forum.joomla.org/viewtopic.php?f=473&t=428193&p=1804749#p1804749
Do not do as instructed in the post. This was done for a reason, security. By reverting what Joomla team has done you just open up the vulnerability again. This is not a resolution to the problem, but creates an even bigger problem.
Very interesting. What a security risk is to show on HTML page some part of the Article (namely "created_by_alias" property) that was just retrieved from the database (from _our_ database)?
One possible scenario that I can think of is that some attacker managed to save this article with some evil "injection" to his "alias" and so we're fighting with injections stored in our database.
In this case I'm sure we should better care about filtering (escaping...) that injection _before_ it is written to the database, and not _after_ it is read from it?!
Post edited by: yvolk, at: 2009/08/11 21:08
|
|
|
The administrator has disabled public write access. |
|
|
