Re: Bullsh*t Bulletins - Support for msg?
By: Digital Man to echicken on Fri Sep 25 2020 10:19 am
Some other codes (MENU, TYPE, INCLUDE) could screw up the display as
well, while others (EXEC, JS) could be downright "dangerous".
Good point. @-codes in a user-supplied content are a security issue. And not a small one.
There's an interesting "silver lining" to what I found - the coding I copied over doesn't appear to be handling those codes properly. For example, the CLS did nothing, nor did the control code for "hit any key" that were in the .MSG files I copied over from the system default bulletins.
That does raise an interesting question though - I'm assuming there is a layer of protection built into the default bulletin tool. What's the difference on that? Is it calling a different library?
Yeah, I think that's just for technical reasons, not security. Frame.js is for a non-scrolling BBS experience, so CLS, PAUSE, and many other @-codes don't really make sense in that context.
BullsEye! bulletins only display files (not messages) and it assumes that the sysop either create the files or is in direct control of their content (and no one else is). BullsEye! calls the JS bbs.menu() function directly to display files - no intermediate JS library involved.
Re: Bullsh*t Bulletins - Support for msg?
By: Digital Man to Hatton on Fri Sep 25 2020 04:41 pm
Yeah, I think that's just for technical reasons, not security. Frame.js is for a non-scrolling BBS experience, so CLS, PAUSE, and many other @-codes don't really make sense in that context.
Fair point - I wonder if there should be an "exclude" list that filters out any dangerous commands. Actually...
BullsEye! bulletins only display files (not messages) and it assumes that the sysop either create the files or is in direct control of their content (and no one else is). BullsEye! calls the JS bbs.menu() function directly to display files - no intermediate JS library involved.
The way I had intended to use BS was by making use of the local message area that only SYSOP user(s) would have access to. That's how echicken has it set up in the docs. Those posts and the fixed files that I ported over from BullsEye!
I know I had initially floated the idea of setting up multiple message areas and pointing one to a network driven announcement area but I scrapped that concept on the very valid concerns that ec raised in that first reply.
At this point I haven't even *tried* to bring in the message base posts for the bulletins. That's the next step.
Yeah, I think the way that BS is used, @-codes are likely safe. I think the "problem" that ec was trying to point out: frame.js is used by other modules where the parsing/expansion of @-codes might not actually be safe. So enabling it for *all* uses of frame.js is probably not a good idea.
Re: Bullsh*t Bulletins - Support for msg?
By: Digital Man to Hatton on Fri Sep 25 2020 09:16 pm
Yeah, I think the way that BS is used, @-codes are likely safe. I think the "problem" that ec was trying to point out: frame.js is used by other modules where the parsing/expansion of @-codes might not actually be safe. So enabling it for *all* uses of frame.js is probably not a good idea.
Makes complete sense, especially since frame.js could be considered a good use of "portable" code.
I think what happened was that I introduced a new use-case for BS. I don't want to present my users with two distinct bulletin systems (BullsEye! and BS). At the same time I like the dynamic content presentation concept of BullsEye! and the message-board driven aspect of BS.
If this were to push out to other SysOps, would this then warrant a different "split" of frame.js? Or am I the only one looking at this concept and saying, "hey, this is cool!"?
Also, please forgive the grammar - it's late and I've had a few drinks. Spellcheck can only go so far :)
If this were to push out to other SysOps, would this then warrant a different "split" of frame.js?
Re: Bullsh*t Bulletins - Support for msg?
By: Hatton to Digital Man on Sat Sep 26 2020 06:36:23
If this were to push out to other SysOps, would this then warrant a different "split" of frame.js?
No. It would require some new functionality in frame.js, but not another version. We'd just want to make sure it's handling certain @ codes properly, and probably make it disallow other ones altogether.
One of the problems is the integrity of the display. Frame needs to know what exists in each character cell on the screen at any one time, and (maybe) where the cursor currently is. Certain @ codes might pull
the rug out from under it, but that can be accounted for.
Say you load a .txt file which includes @exec:irc.js@. Frame has no idea that the entire contents of the screen have been obliterated by an IRC client and needs to be redrawn after that script exits.
Suppose it doesn't execute irc.js but some other script that potentially screws up your BBS.
So we need to filter out the 'exec' @-code and maybe others, or have a switch that disables them by default. It'll just take a bit of work.
Ive just installed bullshit, I followed the suggested setup instructions and it appears to run just
fine. However the message area I associated with it doesnt seem to show up on the bullshit menu when
i post a message in it.. Any thing I could look at to hunt the problem?
Re: Bullsh*t Bulletins - Support for msg?
By: Nitro to echicken on Fri Oct 09 2020 21:11:22
The message area itself shouldn't be listed anywhere, only the
messages that it contains.
Someone else is complaining of a similar problem, so there's probably
a bug. I'll have a look at it sometime in the next couple of days and
see what I can do.
Greetings echicken!
Saturday October 10 2020 18:00, you wrote to Nitro about an urgent matter!:
Re: Bullsh*t Bulletins - Support for msg?
By: Nitro to echicken on Fri Oct 09 2020 21:11:22
The message area itself shouldn't be listed anywhere, only the
messages that it contains.
Yes ok, I was only expecting to see the post..
Someone else is complaining of a similar problem, so there's probably
a bug. I'll have a look at it sometime in the next couple of days and see what I can do.
One thing I did notice is after following your instructions is that in scfg message areas where I did the message area setup I called the intenal part as BULLSHIT like written, and when exiting out it displays it as Local-BULLSHIT is that a problem?
One thing I did notice is after following your instructions is that in scfg message areas where I
did the message area setup I called the intenal part as BULLSHIT like written, and when exiting out
it displays it as Local-BULLSHIT is that a problem?
On my system, the "Bulletins" Sub-Board belongs to a Message Group called "Local", which has an Internal Code Prefix of "LOCAL_". Consequently, the Internal Code for my "Bulletins" Sub-Board is "LOCAL_BULLETIN", so in bullshit.ini I have:
messageBase = LOCAL_BULLETIN
* Forwarded from area 'sync_sysops'
Re: Bullsh*t Bulletins - Support for msg?
By: Rick Smith to echicken on Sat Oct 10 2020 21:19:28
I made a change to bullshit yesterday which might help. Please try updating and let me know if it's fixed.
The messageBase setting in bullshit.ini should be whatever shows up
for Internal Code when looking at your bulletins Sub-Board in scfg.
You can give the Sub-Board whatever name and Internal Code you want.
On my system, the "Bulletins" Sub-Board belongs to a Message Group
called "Local", which has an Internal Code Prefix of "LOCAL_". Consequently, the Internal Code for my "Bulletins" Sub-Board is "LOCAL_BULLETIN", so in bullshit.ini I have:
messageBase = LOCAL_BULLETIN
Re: Bullsh*t Bulletins - Support for msg?
By: Rick Smith to echicken on Sat Oct 10 2020 21:19:28
The messageBase setting in bullshit.ini should be whatever shows up
for Internal Code when looking at your bulletins Sub-Board in scfg.
You can give the Sub-Board whatever name and Internal Code you want.
On my system, the "Bulletins" Sub-Board belongs to a Message Group
called "Local", which has an Internal Code Prefix of "LOCAL_". Consequently, the Internal Code for my "Bulletins" Sub-Board is "LOCAL_BULLETIN", so in bullshit.ini I have:
Thank you for your reply... I did try exactly that.. I even added some files as directed in the docs and they dont show up either a .txt file and a .msg although I see that is not supported as of yet.. but neither displayed.. I must have done something else wrong or missed something, Ill keep searching..
I couldn't get the message board portion of this working on my setup either.
I made a change to bullshit yesterday which might help. Please try
updating and let me know if it's fixed.
Thank you for your reply... I did try exactly that.. I even added some files as directed in the docs
and they dont show up either a .txt file and a .msg although I see that is not supported as of yet..
but neither displayed.. I must have done something else wrong or missed something, Ill keep
searching..
It would probably work now if you updated and tried again. I fixed a pretty silly bug yesterday.
Re: Bullsh*t Bulletins - Support for msg?
By: Rick Smith to echicken on Sun Oct 11 2020 11:58:22
Did you try updating as suggested? I would expect it to list messages
now.
message area. Files work too, I have not tested .msg so I can not report on that.. But all is well
here now... Thank you..
Re: Bullsh*t Bulletins - Support for msg?
By: Rick Smith to echicken on Mon Oct 12 2020 06:16:36
message area. Files work too, I have not tested .msg so I can not
report on that.. But all is well here now... Thank you..
You'll need an up-to-date copy of exec/load/frame.js in order for .asc/.msg loading to work, otherwise you'll be limited to .ans or .txt files.
Greetings echicken!
Monday October 12 2020 13:09, you wrote to me about an urgent matter!:
Re: Bullsh*t Bulletins - Support for msg?
By: Rick Smith to echicken on Mon Oct 12 2020 06:16:36
message area. Files work too, I have not tested .msg so I can not
report on that.. But all is well here now... Thank you..
You'll need an up-to-date copy of exec/load/frame.js in order for .asc/.msg loading to work, otherwise you'll be limited to .ans or .txt files.
Can I ask a ? I probably already know? I assume there is a way to just pull all updates down?
| Sysop: | Weed Hopper |
|---|---|
| Location: | Clearwater, FL |
| Users: | 12 |
| Nodes: | 6 (0 / 6) |
| Uptime: | 17:42:37 |
| Calls: | 112 |
| Calls today: | 1 |
| Files: | 50,347 |
| D/L today: |
545 files (546M bytes) |
| Messages: | 296,815 |