Abivia Web Development and Hosting

 
  • Increase font size
  • Default font size
  • Decrease font size
Home Help Forums Public Forums Joomla Extensions Redaction Plugin Phoca Gallery v2.6.1 now deleting Redact data

Welcome to the Abivia Web Development and Hosting Forums. The primary purpose of the forums is to offer support for our products. Please feel free to explore.

Gefegobebeara

Phoca Gallery v2.6.1 now deleting Redact data

Phoca Gallery v2.6.1 now deleting Redact data

Phoca is now deleting stuff from your database.

Phoca Gallery v2.6.1 added a new function called correctRender.
function correctRender searches for both the Redact plugin and for the ReReplacer plugin.

If the Redact plugin is found it then searches the data stored in the jos_plugins database table to see if the Redact parameters settings includes "phoca.cz".

If the ReReplacer plugin is found it then searches the data stored in the jos_rereplacer database table to see if it includes "phoca.cz".

Then it changes your data in the database.
It runs an UPDATE query to change your data in an attempt to prevent users from deleting the link to phoca.cz.


It is NEVER acceptable to delete anything in a user's database or on their website without their knowledge and permission.

(thumbs down Phoca)

Look here:
\com_phocagallery_v2.6.1\libraries\phocagallery\render\renderfront.php
function correctRender - Starts at line 502

.

kenmcd
useravatar
Offline
7 Posts
User info in posts
Administrator has disabled public posting

Re: Phoca Gallery v2.6.1 now deleting Redact data

.

Here is the code in question:

Code:


    function correctRender() {
        if (class_exists('plgSystemRedact')) {
            $db =& JFactory::getDBO();
            $query = 'SELECT a.params AS params'
                    .' FROM jos_plugins AS a'
                    .' WHERE a.element = \'redact\''
                    .' AND a.folder = \'system\''
                    .' AND a.published = 1';
            $db->setQuery($query, 0, 1);
            $params = $db->loadObject();
            if(isset($params->params) && $params->params != '') {
                $params->params = str_replace('phoca.cz', 'phoca_cz', $params->params);
                $params->params = str_replace('phoca\.cz', 'phoca_cz', $params->params);
                if ($params->params != '') {
                    $query = 'UPDATE jos_plugins'
                            .' SET params = \''.$params->params.'\''
                            .' WHERE element = \'redact\''
                            .' AND folder = \'system\'';
                    $db->setQuery($query);
                    $db->query();
                }
            }
       
        }
        if (class_exists('plgSystemReReplacer')) {
            $db =& JFactory::getDBO();
            $query = 'SELECT a.id, a.search'
                    .' FROM jos_rereplacer AS a'
                    .' WHERE (a.search LIKE \'%phoca.cz%\''
                    .' OR a.search LIKE \'%phoca\\\\\\\\.cz%\')'
                    .' AND a.published = 1';
            $db->setQuery($query);
            $search = $db->loadObjectList();
           
            if(isset($search) && count($search)) {
               
                foreach ($search as $value) {
                    if (isset($value->search) && $value->search != '' && isset($value->id) && $value->id > 0) {
                        $value->search = str_replace('phoca.cz', 'phoca_cz', $value->search);
                        $value->search = str_replace('phoca\.cz', 'phoca_cz', $value->search);
                        if ($value->search != '') {
                            $query = 'UPDATE jos_rereplacer'
                            .' SET search = \''.$value->search.'\''
                            .' WHERE id = '.(int)$value->id;
                            $db->setQuery($query);
                            $db->query();
                        }
                    }
                }
            }
        }
   
    }

.

kenmcd
useravatar
Offline
7 Posts
User info in posts
Administrator has disabled public posting

Re: Phoca Gallery v2.6.1 now deleting Redact data

Thanks to the power of regular expressions, this is easy to work around. As you can see from the code, this function only looks for two possible values, "phoca.cz" and "phoca\.cz".

Fortunately there are an infinite number of alternatives. just a few examples:

Code:

pho(some_random_string)?ca\.cz  // since the random string is optional, you still match on what you want

ph[o]ca\.cz  // [o] matches on any string containing "o"
phoca\.c{1}z // {1} means match on exactly one
phoca\.[cw]{1}z  // this will match on phoca.wz as well, but who cares?
pho{1,4}ca\.cz  // Matches phoca.cz phooca.cz phoooca.cz and phooooca.cz

So, to keep the functionality of the redaction plugin, just complicate your regular expressions with one (preferably more than one) of these techniques, and carry on.

instance
useravatar
Offline
68 Posts
User info in posts
Administrator has disabled public posting

Re: Phoca Gallery v2.6.1 now deleting Redact data

Hi, Ken McDonald (kenmcd),

It is NEVER acceptable to delete anything in a user's database or on their website without their knowledge and permission.

It is NEVER acceptable that some extension gives the tool to violate copyrights. The modifications are only protection of copyrights.

So in fact, you, Ken McDonald, are the killer of free extensions and of free software as you cannot think forward.

As I wrote you many times, the Phoca Gallery is free extension. I am only one who develop it. And I have strange time issues. I am not able to answer all the posts in the forum, I am not able to help people on their servers (as I usually do), I am not able to email them the support. So the link in footer is very important to the project. As you know I am helping to every people. For people who try to ask posts in the forum regularly or contribute to the project with translation or improvement I give advices how to hide the link.

It is an enormours help for me, if e.g. people try to help me with answering the posts in the forum. But it seems, you don't know the word "help".

After you will help a lot of people I have helped (of course for free) then please come here and you can write your ideas about open source which are of course wrong. With your ideas you can only stop free extensions development and supporting commercial extensions. (Are you supporting some commercial extensions? It seems yes, because you are fighting against all possible free extensions)


So, lets sum it up.
Please,  Ken McDonald,
- after you will do over 50 free extensions as I did
- after you will help a lot of people via email as I do
- after you will help a lot of people on their servers as I do
- after you will make over 12000 answers on different Joomla! forums as I did
- after you will spend parts of donation to beneficence as I do
- after you will help with sites for not profit organizations for free as I do

then you can write here your ideas about open source but before it, don't damage other projects, please do, do something useful.

Jan

H13
useravatar
Offline
4 Posts
User info in posts
Administrator has disabled public posting

Re: Phoca Gallery v2.6.1 now deleting Redact data

Ahhh, the righteous indignation defense when caught red-handed.
How . . . emm . . . predictable.

I must admit that you are 100% correct in that I have not contributed anything anywhere anytime.
But you did miss one little known fact — I also enjoy eating babies.

Is it possible I can somehow redeem myself in the eyes of the almighty and the world?
Perhaps contributing some documentation for a plugin would be a good start.
Yes, yes, YES, that is the proper redemption for my sins.
A meager offering by a wretched soul to be embraced and enjoyed by the many.

Thank you for your warm thoughts and sage advice.



p.s  Had a forum moderator on the Joomla forum not deleted my post regarding Phoca Download,
then I would not have been angered by that and what I believe to be a twisted view of the GPL,
and I would not have been contacted by another user asking me to look at the Phoca Gallery for them,
and I would not have discovered that you added code to delete data from a user's database
without their knowledge or permission.

I did not go looking for this problem. I just answered a question in the forum, and dealt with the fallout.

Regardless – I would never just look the other way when I find what I consider malicious code.

kenmcd
useravatar
Offline
7 Posts
User info in posts
Administrator has disabled public posting

Re: Phoca Gallery v2.6.1 now deleting Redact data

In fact I don't have any friends on Joomla! forum :-( but I think they did (not removed the post but removed a part which destroys specific project) because they see I have no wrong intentions.

I am trying to help people (really, I do - on the internet you can see so many demonstrations). I don't fight against other people who help others. The only one thing I did (regarding your person), I only corrected the false information you have pasted, nothing more ... (maybe this was the start of your activities, no idea) I don't have any aims to solving such topics. I want to do what I allway did - creating extensions and helping people to build their sites. Such conversations take my time which I could spent to other activities. :-( :-( :-(

Belive me, I am not happy to solve such problems. I am not happy to spam forum of other Joomla! developer :-( No motivation for doing it. :-(

Jan

H13
useravatar
Offline
4 Posts
User info in posts
Administrator has disabled public posting

Re: Phoca Gallery v2.6.1 now deleting Redact data

instance

I will not write you that this what you are doing is wrong, you need to know it, maybe you will find it after your extensions will be hacked, after you will  spent your time with such issues and no with care about your users :-(

I read your topis and can read your code, for me it is not problem to make some other protection. We can play this game further. I know I will NOT win this game. But I do my extensions in my free time. No for business so I have nothing to lose :-) But I will allways fight for my rights :-)

H13
useravatar
Offline
4 Posts
User info in posts
Administrator has disabled public posting

Re: Phoca Gallery v2.6.1 now deleting Redact data

First off, welcome to the discussion, Jan.

Second, let me make it clear that this discussion will remain civil and refrain from personal attacks. We have a strong difference of opinion here; I expect the discussion to remain about the issues, not about people. Ken, accusing Jan of getting his "cronies/friends" to edit posts is not appropriate. As far as I know it's forum policy to not allow the posting of hacks of any kind, be they good, bad or otherwise. Let's stuck to verifiable facts, please. Jan, Ken has a right to his opinion independent of whether or not he's made the same level of contribution as you or I have.

I will remove anyone who disrespects the forum, whether they agree with my personal opinions or not. Now onto the issues.

Jan, we have an obvious difference of interpretation in the GPL. I think the lengths that you go to to ensure a back-link is there violate the spirit of open source; you think the opposite. You think I'm wrong, I think you're wrong. I don't expect to convince you (except maybe if we do it over a beer where we could really talk it through). As you say we can go through a process of escalating countermeasures, but it's a waste of your time and mine.

I have posted everywhere that I think people who remove the back-link on a commercial site have a moral and ethical obligation to send you a donation. I think you have a right to deny support to anyone who has removed the back-links and not donated. I also think that the number of people who will turn the links on before asking for support and then turn them off again is negligible... and often easy to discover.

I honestly don't care if my extensions are "hacked"... in fact, I intend for them to be hacked. If someone wants to tackle it, they're free to do so. As long as the source code retains my copyright, IMO the fundamental intent of the GPL is to allow hacking. If I felt otherwise I'd be offering encrypted commercial extensions. Hell, I'd be working in a proprietary CMS.

As you point out, supporting an extension is not a small job, so if someone wants to create a new work from my code and take on that work, more luck to them. Our support is first class and I bet it won't be long before they come back. If we release significantly complex extensions, we'll make the source openly available but charge for support. This seems a reasonable model to me, because only those who incur additional costs are paying for the service.

Rather than spend time doing this, I would much rather spend my time replacing extensions that are proprietary with GPL versions. I think that extension developers who don't provide source code are not only violating the GPL but effectively stealing from those of us who have contributed to the project, benefiting from our work without adhering to the terms that we released it under.

Our Redaction extension was first developed to remove links from extensions that claimed they were GPL without providing source, and we've always tried to make the implications of doing this -- in terms of end-user licenses -- clear to the people who use it.

instance
useravatar
Offline
68 Posts
User info in posts
Administrator has disabled public posting

Re: Phoca Gallery v2.6.1 now deleting Redact data

For many years the JoomSEF hacks to remove the advertising have been posted unabated in the Joomla forum.
This remained acceptable/allowable for years because I assume there was a policy in place which supported the spirit and the substance of the GPL.
This specific GPL clause was debated ad nauseum  4-3 years ago which is again why I would assume the discussions regarding the Artio hidden advertising remained untouched.

Perhaps there has been some unannounced or undocumented policy change on the Joomla forum regarding hacking GPL code.
Perhaps there has always been some forum policy regarding this GPL interpretation which I am unaware of.
If there is, I would like to see that policy posted somewhere in black and white.

Regardless, after the debate 3-4 years ago, I came to the same conclusion as instance on this issue.
Some people's interpretation of that particular clause is in error.


Recently I found that another extension had added code which actually deleted the Redaction Plugin.
I contacted the developers and let them know I thought this was a really bad idea and that it would damage their reputation when it was found out by the general Joomla public. I found it in less than 24 hours of the release of the version which contained the offending code. They agreed and fixed it immediately. So it was in the wild less than 48 hours total.
Whether I found it or someone else found it — it would eventually be found.


Whether I found the code in Phoca Gallery or someone else did — it would be found.

I this case I went public because I had been angered by my Joomla forum post being deleted, and your responses there.


What is ironic is:

I did not use the Redaction Plugin when this current "debate" started.
Now I have become very familiar with it and plan to use it.

Additionally many more people are now aware of the Redaction Plugin because of this.
So I assume many others will now start using the Redaction Plugin because of this.

I have actually already created a substantial beginner-friendly Abivia Redaction Plugin User Guide because of this.
It is about 80% done and will probably be released after the new year.



Note: instance, I have "cleaned-up" my post above.

Additional note: I would like to ask you some questions before I can publish the manual.
Would contacting you via this forum PM be OK?

kenmcd
useravatar
Offline
7 Posts
User info in posts
Administrator has disabled public posting

Re: Phoca Gallery v2.6.1 now deleting Redact data

Hi, first I accept your ideas but let me know some small idea:

"I have posted everywhere that I think people who remove the back-link on a commercial site have a moral and ethical obligation to send you a donation."

This is like you will make a gun and will write a guide how to kill people (see post above, you write here like to remove Phoca copyright notice.) You didn't do only the gun (create an extensions which allows to remove the links) but you have created the guide how to kill people too (writing how to remove the link for other extensions). So any other ideas (to write people that they should make a donation or other information) are then unnecessary :-( - This is my opinion so I don't say it is fact ...

kenmcd

If I did the protection of Phoca Gallery copyright, I thougt, it will be not good to restrict some other extensions, I wanted NOT to rescrict the Abivia extensions, so I have make only modifications to not remove the Phoca copyright. It means, I wanted that the Abivia extension can still work with Phoca Gallery so other Abivia features can be used.

Ok, you are writing it is bad because you change the data in database. Ok, so I will do it other way :-( Not happy but I will make Phoca Gallery working only if this extension is not installed. Let say the requirement of running Phoca Gallery will be: Not installed Abivia extension. I hope this is right and clear for all sites because I will limit only Phoca Gallery extensiosn. It will not work if the Abivia extension is installed.

H13
useravatar
Offline
4 Posts
User info in posts
Administrator has disabled public posting

Login / Register

Twitter Feed