Mysidia Adoptables v1.2.4[Security Release]

[Hall of Famer]

Sorry for my lack of activity for the past two months guys/gals, real life sorta caught up but glad I survived. Mysidia Adoptables v1.3.x's development has been going smoothly, and this time I plan to release the last maintenance version of Mysidia Adoptables v1.2.x series. It is Mys v1.2.4, which adds some minor new features together with fixes of glitches and programming flaws. The most noticeable changes are:

1. User Profile Comments: This new feature enables users to drop profile comments to others profile. It is similar to the visitor messaging system aiming at making conversations easier and more convenient. Guests and banned users cannot leave profile comments.
2. Improvement of Breeding System: From now on admins can create adoptables with multiple breeding classes, simply separate each with comma. The experiment with multiplicity has been successful, which will help with future implementation such as multiple usergroups and trades.
3. Search Engine for Users: This is a minor feature for the search engine, which used to be only applicable for adoptables. It is possible now to search for users by username, usergroup and email account, this works out pretty much the same way as Kaeliah's adoptables search engine.
4. Implementation of Form Validation: As reported by Silverdragontears and her members, experienced users and hackers can use plugins such as firebug and inspectelement to mess up with sites. I've added validation/checkpoints in breeding and pound script to detect such behaviors and users manipulating the sites will get banned.
5. Script Optimization and Easier installation: Further script optimization has been carried out to improve the script and get rid of proramming flaws. The password encryption for Mys v1.2.4 is automatic for both admins and users, no need to run adminencrypt.php script manually.
6. Miscellaneous Bug Fixes: Infamous glitches regarding navlink cannot be deleted, siggy wont show and editing adoptables levels have been resolved, please do lemme know if you find more bugs in this version and I will get rid of them asap.


Installation Guide:
1. Use ftp to Upload the folder "installation" to your preferred directory, and change the name from "installation" to whatever you like.
2. Change the CMD of folder "picuploads" to 777, together with its subfolders, this is required to enable user uploading images.
3. Access the installer script at "http://yoursitename.com/install/install.php", follow the instructions and proceed.
4. Congrats, you've successfully installed Mys v1.2.4. There is no need to manually encrypt your password in Mys v1.2.4, so cheers!

Note: The value salt code can be generated from a website called: http://strongpasswordgenerator.com/, it can be of any length. Make sure to delete the file install.php after running this script, or your site is potentially at danger if this file is accessed by someone else.


Upgrade Guide:
1. Use ftp to Upload every file within the folder "upgrade" to your Mys directory, choose yes when it asks you to rewrite existing files.
2. Access the upgrader script at "http://yoursitename.com/install/upgrade.php", follow the instructions and proceed.

Since Mys v1.2.4 is planned as the last maintenance release of Mys v1.2.x series prior to the era of Mys v1.3.0, the work plan of Mysidia's dev team right now is completely concentrated on the next major release. Please keep in touch with us and I will update you all every now and then regarding the development of Mys v1.3.0.

To download Mysidia Adoptables v1.2.4, please go to the following links below. I've uploaded both a .rar and .zip format file.

Mysidia Adoptables version 1.2.4, rar file:
http://www.megaupload.com/?d=A1L507LZ
Mysidia Adoptables version 1.2.4, zip file:
http://www.megaupload.com/?d=YTLFYNAL

Hall of Famer

[mapleblade]

woot :D gz on 1,2,4 release :P

[SilverDragonTears]

I'm going to need help with this. I want to use the form validation part =)

[SilverDragonTears]

It's still possible to change the item prices in my shop with inspect element. Can you help me fix that as well?

[Hall of Famer]

Well item system is not introduced for Mys v1.2.x, so it makes sense form validation is not set up for it. Dont worry, I do plan to implement form validation for all features of Mysidia Adoptables.

[SilverDragonTears]

How soon do you think?

[mapleblade]

instead of using the posted price, use a query at the doadopt.php to look how much that adoptable id costs, easy as that.

[SilverDragonTears]

Ok site dev Maple.... do it ;D

[KaceKuma]

It wouldn't let me log on after I upgraded to the new version. It kept saying I didn't have permission to be on this page then I was logged out. Luckily I had a backup, but I think it's a bug.

[Hall of Famer]

@Silverdragontears:
Well the idea is quite simple, you may look at what I did with the breeding.php and poundpost.php files. The trick is to add checkpoints right before the mysql insert/update/delete line, and the checkpoints can be of anything you can think of.

For instance, a user may use firebug/inspectelement to modify the adoptable to any species. You can verify if the user has changed the adoptables to someone else's, or specified adoptables of the same gender to breed. If so, it becomes apparent that the user has inappropriately changed the content of php form. A punishment will be carried out to have him/her banned from your site.

Similarly, a user may change the content of poundpost.php so that he/she can adopt pets already belong to someone else's instead of orphan pets. A checkpoint can be added right before the mysql update query to see if the chosen adoptable has owner already. If so, the user has obviously used firebug/inspectelement to change the site content, and he/she will be banned for this action.

Hope this explains what I mean by form validation, it is not really that complicated though in future I plan to update the codes once more to prevent possible sql injection.

@ Kacekuma:
What old versions were you using prior to upgrading? You must have Mys v1.2.3 already before performing this action, and I believe the upgrader works just fine if you have Mys v1.2.3 unless you have modified the structure of your database table. Whenever you have customized your site to such an extent, do not use the simple upgrader.