Recent content by qubn

Yeah, I get the reason for making it, especially with how long 2.4 has been taking. My concern is more about the integration approach than TipTap itself. Looking through 1.3.7, quite a bit of XF compatibility seems to be recreated by replacing/intercepting existing editor behaviour and XF...

Is this intended as a standalone TipTap editor implementation for XF 2.3, or is it trying to reproduce/backport the TipTap editor XenForo has shown for 2.4? I'm curious because XenForo's implementation seems to involve quite a bit beyond TipTap itself, especially around BBCode conversion, custom...

The API can set prefixes, but it silently drops one the Claude account isn't allowed to use, and it reads a prefix name as 0. Send the prefix's numeric ID as prefix_id (it's the number in the prefix's Admin CP edit URL, e.g. thread-prefixes/announcement.5/edit), and make sure the account can use...

Your content can come across, and SMF is officially supported. XenForo's importers are a separate (free) add-on from the customer area, and the officially supported sources are: XenForo 2, vBulletin, IPS, phpBB, MyBB, Discourse, and SMF 2.0. The reason you didn't see 2.1 is that the officially...

I installed 1.3.0 on a throwaway test forum and re-ran the actual exploits, and the six I reported are genuinely closed: The username-font and title-font XSS: both crafted values are rejected against the font allowlist now (and stripped again at the render sink as defense-in-depth) - re-ran...

My pleasure, glad I was helpful and you could get a new build out! I'll analyze this one as well and get back to you with my findings if any. If you don't want me doing this on your add-on, feel free to let me know and I'll stop ;)

Small update: the ZIP attachment has been removed. The thread itself still has the context and explains the methodology, but I'm keeping the actual kit private for now. If anyone is genuinely interested in reviewing it or adapting parts of it, feel free to send me a private message.

Hi Brad, thanks for building this - the feature set is ambitious and the live preview is genuinely nice. I reviewed the current 1.2.0 and confirmed the issues below with working proof-of-concepts on a throwaway local install (benign markers only). I am posting publicly rather than only via PM...

Good one to raise, and I would not wave it off - the Rules File Backdoor is a clever, real finding. But it is worth being precise about the threat model, because that is what tells you whether it touches your setup. It is a supply-chain attack, not an AI-specific flaw. It needs you to adopt a...

I would push back on this, because it conflates two separate things: whether the model can read XF, and how you feed it XF. The "not open source" part is not the blocker it sounds like. You do not need a redistribution license to point a local agent at your own licensed install and let it read...

Completely agree. That's exactly the problem I was trying to address with the post. A disposable test install that you can reset at any time should be the absolute minimum before anything goes near a live site or Cloud. AI makes it much easier to generate code, but it doesn't remove the...

The "18 add-ons have no public version we can read" line is a real gap. Those are active add-ons whose addon.json points at no Resource Manager resource: the link fields it scans (dev_url, support_url, faq_url, extra_urls) are all optional, so authors who only link a discussion page, their...

Ha, fair. tl;dr: 2.3.10 teaches an agent to understand XF, but it doesn't stop it shipping add-ons that look fine and are silently broken. The post is the layer on top of that: turn every bug into a deterministic guard, gate on static analysis, review with a multi-model panel, verify in a real...

TL;DR: XenForo 2.3.10 makes an AI agent understand the framework. It doesn't stop the agent shipping add-ons that look fine and are silently broken. This thread is the discipline layer on top of that: turn every bug into a deterministic guard, gate on static analysis, review across multiple...

The error first. That's fixed in v1.1.3 (just released). The scheduled check was using the HTTP client's default behaviour, so when a resource page returned a non-200 - most likely a Cloudflare 403/429 served to your server's IP - it threw and got written to your server error log as a full stack...