Hello,

It looks like your module mod_jux_social_tabs is causing the loader to appear in EasyDiscuss. Add the following block of css codes into your template's css file,

#discuss-wrapper .tab-content {

    background: none !important;

}

To disallow replies to a discussion, you need to lock the discussion.

Hi Mark, i insert the hack and now it looks better.

but is saw that the tag-label and icon are to small. the gap between is to small. how can i change this?

And what means the default picture in the search field? can i disable this? it looks ugly.

thanks

Hello,

Try adding the block of codes below:

.discuss-tags a > i{

    margin-right:5px;

}

The avatar is actually the current logged in user's avatar. If the user is not logged in, it's the guest avatar. You can hide it by adding the block of css codes below,

.discuss-tablecell.discuss-searchbar--left.discuss-searchbar--avatar{

    display: none !important;

}

thanks Mark!

i saw that the a role shows as link the real username. that is a big security fault. if i use the admin-user to write an entry all hackers show my real user-name and all other user name are also showing. i have disable roles at the moment.

i cant disable to show users oder profiles. if i know an username i can show the profil: https://www.vertragstresor.de/mitreden-rat-geben-das-forum-von-vertragstresor/profile/demo this is an security mistake. not all of my member has accept to show your details as profil. the Discuss Center is new. how can i set the option hide profile? same with: https://www.vertragstresor.de/mitreden-rat-geben-das-forum-von-vertragstresor/users i write a redirect rule but this is not really a good hack

hi Mark, more bugs found

the buttons "add reply" and "show replys" redirect to the maindomain?! https://www.vertragstresor.de/#respond https://www.vertragstresor.de/#replies

my base is always the maindomain. so relative links didnt work or is it an javascript fault?

Some Social Nework Buttons arend showing. i see the code inside the page but the buttons arent rendert.. could you please help?

next bug :-)

after search the 1st letter of the highlighted word is twice showing:


cl ass="discuss-intro-text"
...nspende, T -cl ass="highlight"Testament Trauerbew...

Hello René Balke,

Sorry for late reply to this,
You can set the option for display your nickname from your backend > Easydiscuss > Setting > layout > General > Name Format ( http://screencast.com/t/6sTINzpv ), also you can change your nick name from the user profile.

i cant disable to show users oder profiles. if i know an username i can show the profil: https://www.vertragstresor.de/mitreden-rat-geben-das-forum-von-vertragstresor/profile/demo this is an security mistake. not all of my member has accept to show your details as profil. the Discuss Center is new. how can i set the option hide profile? same with: https://www.vertragstresor.de/mitreden-rat-geben-das-forum-von-vertragstresor/users i write a redirect rule but this is not really a good hack

Do you mean that you would like to block the public user can't able to view their user profile from the discussion page right?
If yes, that was no option to control this in current system.

Regarding with your 2 issues here :

the buttons "add reply" and "show replys" redirect to the maindomain?! https://www.vertragstresor.de/#respond https://www.vertragstresor.de/#replies
my base is always the maindomain. so relative links didnt work or is it an javascript fault?

Some Social Nework Buttons arend showing. i see the code inside the page but the buttons arent rendert.. could you please help?

Is it possible provide us with your Joomla backend and FTP access so we can help you check on this? Please advise.

after search the 1st letter of the highlighted word is twice showing:
cl ass="discuss-intro-text"
...nspende, T -cl ass="highlight"Testament Trauerbew...

I have tried to search your discussion post first letter, but i'm a little bit lost here Is it possible provide some screenshot which you referring to or explain how to replicate on this issues? Please advise.

hi there, attached you will find some screenshots. i hope it would help.

easydiscuss attached the a wrong parameter to the link. it wrote Itemid= but the right parameter is ItemId= Joomla isnt the menu showing if the parameter is wrong written:

wrong: https://www.vertragstresor.de/mitreden-rat-geben-das-forum-von-vertragstresor/search?query=patientenverf%C3%BCgung&category_id=0&option=com_easydiscuss&view=search&Itemid=1352


right: https://www.vertragstresor.de/mitreden-rat-geben-das-forum-von-vertragstresor/search?query=patientenverf%C3%BCgung&category_id=0&option=com_easydiscuss&view=search&Itemid=1352

Hello René Balke,

If you would like to display the Nick name in your discussion page. what you can do is go to backend > Easydiscuss > Setting > layout > General > Name Format > Select "Nick name"
Then Easydiscuss > Users > Select your user > Look at the "Nick Name" field > change the nick name there ,
check my screenshot : http://screencast.com/t/WZyyu19me9T || http://screencast.com/t/dU25RD7m

Regarding with your Google+ and Facebook LIKE button missing issues :
>> We hard to tell you what is the problem causing this social button missing in your discussion post without access in your site, because i have checked in development tools in your page, it look like some scripting conflict or other reason, check my screenshot : http://screencast.com/t/EgPFUgGH9gG

Regarding with your search result getting wrong path :
>> I'm suspected your SEO setting is not set correctly from the Easydiscuss, may i know how your menu item structure in your site? Because i want to check how many menu item you configure to Easydiscuss page.

Regarding with your "Message don't use the Menu-Item-ID after sending the message the page redirect to http://www.example.com/discussion/..." :
>> Hmm, is it possible provide us with your Joomla backend and FTP access so we can help you investigate on this quickly? Because everything is work fine in my local,


*Actually you can put the information in the optional information field below. Don't worry about privacy. Only Support team can view the information.
Hope you can provide us with your login credential so we can help you investigate on this quickly.

dear arlex,

please take a look at the screen1.jpg. the nickname is active. but in the links (move the mouse over the profil-image or the role) you will see, that the link use the real username not the user-id or the nickname. that is a big security fault. so i can use the real username to attack the site..

my site is protected. so i cant you give backend access.

for the menu-item i use the standard option. but you see that the paramater is wrong written. you have to change the code to generate the link and replace the wrong word "Itemid" with "ItemId"

Google+ and Facebook - i cant see an script-problem. easyblog works with google+ and facebook

Hello René Balke

Sorry for late reply to this,
You can modify the URL from this file -> JoomlaFolder\components\com_easydiscuss\helpers\router.php
LINE 482

$urlname	= (empty($profile->alias)) ? $profile->user->username : $profile->alias;

Replace with

$urlname	= (empty($profile->nickname)) ? $profile->user->nickname : $profile->nickname;

for the menu-item i use the standard option. but you see that the paramater is wrong written. you have to change the code to generate the link and replace the wrong word "Itemid" with "ItemId"

Can you provide some screenshot regarding with how many Easydiscuss menu item in your site? Also provide us which option you configure on this Easydiscuss routing behavior? check my screenshot : http://screencast.com/t/V5SzxBXagL5X

Google+ and Facebook - i cant see an script-problem. easyblog works with google+ and facebook

Regarding this issues I have to debugging in your site and only can give you what is that issues causing this social button disappeared in your discussion page.
Can i meeting with you using Teamviewer ? Please advise.

hi Arlex,

i'm not in the office at the moment. an teamviewer session sounds good. i'm back in araound 2 hours.

i have only one menut-id for easydiscuss. the menu-id isnt the problem. the query string isnt right. wich php file generates the query string for the search bar? here have to change the query Itemid to ItemId

Hello René Balke,

Sorry for late reply to this,
Okay, keep us updated then.
I will available on Monday - Friday 9am - 7pm GMT+8 (Malaysia)
You also can add my skype ID -> arlex.wong@stackideas.com

i found some wrong code in the router.php.- but the router.php dont gernerated the query string for the link. which php file generate it?

line 280

$url    = 'index.php?Itemid=' . $tmpId;

change this line to:

$url    = 'index.php?ItemId=' . $tmpId;

also line 291

			$url .= '&Itemid='.$tmpId;

change to:

			$url .= '&ItemId='.$tmpId;

and LIne 295

			$url = JString::str_ireplace('#', '&Itemid='.$tmpId.'#', $url);

change to

			$url = JString::str_ireplace('#', '&ItemId='.$tmpId.'#', $url);

Your new code doesnt work. if i change to:

$urlname	= (empty($profile->nickname)) ? $profile->user->nickname : $profile->nickname;

i got an empty white page - could you please chekc this and change the code to use the user-id?

i found a wrong Paramenter name also in helper.php line 929. but this doesnt fix the problem. please check all php files and correct the wrong parameter name to the right one. and send me an new install file. thanks in adcance


i saw that if i press the button "Like it" all other user can also see my real username! so many security issues.. if i turn back the like button the likes is stil showing. how can i delete a like?

Hello Rene Balke,

That's strange, because i have tried in my local, that is work fine.
First you should change the name format Real name to nickname -> http://screencast.com/t/Wb4eqXGlO (this will display your user nick name)
But you need to confirm the nickname is it different with your user full name, check my screenshot -> http://screencast.com/t/5upKRIrejN
Second you apply the code what i provided at above replied, that code is modify for the URL get user nickname, it should be work.

You can disable the LIKE button setting from your Easydiscuss > Setting > General > Likes -> http://screencast.com/t/U0gpTSCh

Regarding with your menu-id issues :
I need to access in your site only can give you the correct answer, because i have tried in my local, when i submit the report message from the discussion post, it should be redirect back the discussion post. When you're available to meeting at Teamviewer, let us know what time should able to meeting with you or you can add my skype : arlex.wong@stackideas.com

dear arlex,

i told you that nickname is enabled and a nickname is setted. and i will not diable the like button. i will that the like button shows the nickname not the username. i wondering that not other users told you about the security leak.

i give you the backend access please use this careful

and please fix the searchbar. these use the wrong paramenter for redirect (Example search word: testament) : https://www.vertragstresor.de/mitreden-rat-geben-das-forum-von-vertragstresor/search?query=testament&category_id=1&option=com_easydiscuss&view=search&Itemid=1352 change the routing to use ItemId not Itemid that parameter name is wrong.

and please take a look at the notification about a bad entry. the redirect use /discussion not the normal menu-item

and the social buttons facebook and google+ arent showing and digg button is blocked by the broweser. not ssl conform?

the user: https://www.vertragstresor.de/mitreden-rat-geben-das-forum-von-vertragstresor/profile/wir-f%C3%BCr-sie?ItemId=1353 has blog articles. but the profil page shows only 3 blog entrys. i dont see an pagination.

Hello René Balke,

I'm really sorry that maybe I'm misunderstanding "Your new code doesnt work. if i change to:"
Okay, I have tried to access in your Joomla backend but i getting this, check my screenshot : http://screencast.com/t/ISPd7TFBx Please advise.

please take a look at the addional information to access the login-mask

hi Arlex,

i fixed the problem with the social buttons. an script merger (jfinilize) has make the trouble.

hi Alex, i told you that the dropdown menu doesnt opend the "vie profil" page. i saw the the Systemlink ist still use the username but we changed the router to the nickname. i found this in the code:

<ul class="unstyled discuss-user-links">

												<li>

													<a href="<?php echo $system->profile->getLink(); ?>"><i class="icon-user"></i> <?php echo JText::_( 'COM_EASYDISCUSS_VIEW_MY_PROFILE' );?></a>

												</li>

the getLink is also to change to work with the nickname

in controlers -> digg.php: line 43

change from

		s.src = \'http://widgets.digg.com/buttons.js\';

to

		s.src = \'//widgets.digg.com/buttons.js\';

now this code works also with ssl sites

more real username in url found. please see the image. what has stackideas tought to use the real username?

Hello René Balke,

Please find the answers to your queries below.
And please fix the searchbar. these use the wrong paramenter for redirect (Example search word: testament) : https://www.vertragstresor.de/mitreden-rat-geben-das-forum-von-vertragstresor/search?query=testament&category_id=1&option=com_easydiscuss&view=search&Itemid=1352 change the routing to use ItemId not Itemid that parameter name is wrong.
I have revert back your changes to original from this file ...\components\com_easydiscuss\helpers\router.php , also I have applied some fixes in this file .../components/com_easydiscuss/themes/simplistic/searchbar.php

i fixed the problem with the social buttons. an script merger (jfinilize) has make the trouble.
Thanks for let us know you fixed.

i told you that the dropdown menu doesnt opend the "vie profil" page. i saw the the Systemlink ist still use the username but we changed the router to the nickname. i found this in the code:
I have applied some fixes in your file JoomlaFolder\components\com_easydiscuss\helpers\router.php
LINE 482

$urlname	= (empty($profile->alias)) ? $profile->user->username : $profile->alias;

Replace with,

$urlname	= (empty($profile->nickname)) ? $profile->user->nickname : $profile->nickname;

i saw that if i press the button "Like it" all other user can also see my real username! so many security issues
I have applied some fixes in your file ....\components\com_easydiscuss\helpers\likes.php

more real username in url found. please see the image. what has stackideas tought to use the real username?
Sorry for confusing, actually the nickname is same with the username.

Regarding with the digg social button can't able to display in Https :
Thanks for reporting, yes you can using your current fixes, but we will trying to proper fix it in next release version.

Hi Arlex, thank for your big help!

but i saw that the url still shows the real username. could you please check again . ist systemlink an other as profilelink? Example is the like button. here it shows the nickname now.. very fine but the link ist still the username. could you please fix this?

all hacks fixed an security vulnerability. are this changes now in the officical release? What happens if stackideas has a new release?

Hello René Balke,

You're welcome, we will glad to help you.
I thought you have apply this code in this file before i mentioned above,
It okay, I have help you applied the code in this file -> JoomlaFolder\components\com_easydiscuss\helpers\router.php
LINE 482

$urlname	= (empty($profile->alias)) ? $profile->user->username : $profile->alias;

Replace with,

$urlname	= (empty($profile->nickname)) ? $profile->user->nickname : $profile->nickname;

It work fine now.
I will discuss about this security issues with my developer team and see how it goes. *(Remember backup what you modified the file)

hi Arlex, the url works now with the nickname. i hope discuss checks that every nicknames are unique?

2nd: Could you please check the follow bug: if i logged in and open the entry "willkommen" and click on the Profil-Picture then i logged out automaticly with the information that the session has expired.

many thanks

Hello René Balke,

Thanks for heading up on this, actually I can't promise you about this now, i will try discuss this with my developer team, maybe we will add 1 configuration about this in the future.

Regarding with your #2 issues :
I have tried to login in your frontpage, but i can't reproduce you mentioned that automatically logged out issues
Check my screenshot : http://screencast.com/t/YXGXqEKjeCP
Am i missing something here? Please advise.

Dear Arlex,

the nickname hasnt a check whether is unique. i can in the backend any user give the same nickname. could you please add an check that the nickname is unique and if not then add to the nickname a number? like user user-1 user-2?

Hello Rene,

I'm really sorry delayed of this reply and i missed the good feature from Easydiscuss
You can download my attachment file to replace back to be original file -> JoomlaFolder\components\com_easydiscuss\helpers\router.php

Actually we have a function for change profile URL and it also have a function button to check the profile URL is it available or not,
GOTO your Easydiscuss frontend > click edit profile > click Profile URL > change what you like the profile URL check my screenshot here : http://screencast.com/t/QFey0KQ2F

Hope this help your security issues.

hi Arlex,

what are changed in the new router.php? i saw now, that the profillink and systemlink are the fault one with username as url. in your changes yesterday the links was fine as nickname. what happend if a user set his nickname as a name that exist in the sql? i switched back to you router.php from yesteday.

with the router.php from yesterday the profil-url option shows the username. could you please change this to nickname? thanks in advance

Hello René Balke,

Yes, by default the original file is showing the username as url, but if you would like to change your username URL to other name for prevent the security issues you can modify from Easydiscuss frontend > click edit profile > click Profile URL > change what you like the profile URL

Because i provided the hot fix customize code is hard coded, its not the prefect and safely code in current system.

If you would like to display the nickname, you can apply back the code in this file -> JoomlaFolder\components\com_easydiscuss\helpers\router.php
LINE 482

$urlname	= (empty($profile->alias)) ? $profile->user->username : $profile->alias;

Replace with

$urlname	= (empty($profile->nickname)) ? $profile->user->nickname : $profile->nickname;

I am really sorry but unfortunately this unique nickname customization takes quite a bit of time and unfortunately we would not be able to further assist you with this as per our support policy, http://stackideas.com/support
Hope you understand.

Hi Arlex,

the problem is, that all new users have automaticly they username as profillink. when the new user dont change the profil-url is always the username the profil url is visible.

could you give me a hack to explode(username to get the firstname) set as nickname and profil-url in the datatbase? If exist nickname and nickname-number (user-1, user-2) and set is also as profil-url

many thanks


PS: in the backend i can't found the option to change the proifl-url in the member section

or it is better to use the user-id as profil and systemlink.. then the nickname isnt importend.. but it dont know how guest profil is showing. i allowed that guest open an new entry.

Hello Rene,

To be honest with you, I have advised Arlex and I would also strongly urge you to not add any core hacks because at the end of the day, if you do upgrade to a newer version, you are going to have issues with your permalinks (Especially with search engines).

What I would suggest you to do now, is to use whatever the system generates for you (Which is the username) and if you would like to modify it, do so by editing the profile. I will add this as a feature request so that in the future, the site admin can choose if they want to use the username / real name as the permalink. Would this be fair enough?

Dear Mark,

i know it isnt funny to hear bad news but the easydiscuss has a big security problem when the urls shows the real usernames as standard. it make it eaisier to hack an profil.. i need only one look to see the username and can beginn to hack the password.

I need a safty component. and at the moment the component isnt safe. i cant wait for any future changes. i need a safe component now. the work of Arlex is very good. only little few changes are missing (check for nickname arent duplkate or add an number or switch the url to the user-ids. this would help to make some code changes easier,

if you can do this, please payback the EasyDiscuss component and i search for an other seller.

best regards

Rene

Hello Rene,

I will add this as a configurable option in the next version of EasyDiscuss and it will probably be ready by later this week or next week. If you can't wait for this and would want to opt for a refund, please create a ticket at https://crm.stackideas.com and we'll execute the refund for you.

This is what is coming in the next version of EasyDiscuss by the way, http://screencast.com/t/RUmSslAEh

Hello Rene,

Please update to the latest version of EasyDiscuss we just released today It has a new settings under SEO.

Hi Mark. nice to hear. :-) i installed the new version and set the permalink option to (Use User Alias) but it use still the username not the nickname :-/
could you please add to the permalink the option (Use User-Id) i think this is the best safty varation for a permalink. or with use real name or nickname u have to check the database whethter the name is still present for an other user and have to change the name.

good work

René

PS: for old existend users are the profil url pre-setted to the username. the option profil-url is missing in the backend. and the permalink settings hasnt an effect to the pre-setted profil-urls

next old bug back: Arlex had fixed the search bar. the result was shows outside the menu-id.. some moduls are missing with this bug (menu, footer and more). could you please re-fix this error?


next: after login and click on "view all notifivations" i got the error: JUser: :_load: Fehler beim Laden des Benutzers mit der ID: 894 (error on load the user with id 894) - but the site was load normal.

Hello René Balke ,

Sorry for late reply to this,
I checked in your user profile permalink, it seems like it showing your nickname, check my screenshot : http://screencast.com/t/TNKkQrli

Also, I have tried to access in your Joomla backend -> https:/yourdomainname/administrator , but it redirect to this page another page, please advise.

Regarding with your issues"next old bug back: Arlex had fixed the search bar. the result was shows outside the menu-id.. some moduls are missing with this bug (menu, footer and more). could you please re-fix this error"
>> Actually this issues only happening in your site, so i can help you fix it after can access your Joomla backend (Do you have FTP access so we can fix it faster for you? )

Regarding with your issues "next: after login and click on "view all notifivations" i got the error: JUser: :_load: Fehler beim Laden des Benutzers mit der ID: 894 (error on load the user with id 894) - but the site was load normal."
>> I have to access in your Joomla backend only can see what is the issues causing this. Please advise.

Dear Arlex, the backend is open now.

- i have changed the profil url yesterday of the User in you screenshot. but from all other user i cant changed this url. in the backend i cant found the option profil-url and in the sql database i cant fount an table entry about this.

- if you check the redirect of the searchbar could you please check the script about facebook and google+. the buttons are hidden again.

- with the new version from yesterday somethimes the searchbar hasnt the normal width. plese take a look to the screenshot. if i reload the page the searchbar has the normal width.

- to check the JUser _load Error please see the login-info in the addional information for user 894

Hello René Balke,

Regarding with the profile URL feature only available user to change their profile URL from frontend, because in logically other normal user is not have the permission access from backend, also this feature is not available the SuperAdmin to help the user change their profile URL from backend.

Remove the code from this file .../components/com_easydiscuss/themes/simplistic/searchbar.php
LINE 49 -> 51

				<input type="hidden" name="option" value="com_easydiscuss" />

				<input type="hidden" name="view" value="search" />

				<input type="hidden" name="Itemid" value="<?php echo DiscussRouter::getItemId('search'); ?>" />

I have help you disable this plugin -> System - Content Optimizer, the social button is appeared in your entry page.

I have checked in your user ID- 894 ( Peter Lustig ) from your user manager, it seems like this user is not available from your site, but this ID still stored in your database table, you can remove this user ID from your database #_discuss_users.

Hope this help.