[bd] Keyword Alert [Deleted]

Update: (especially for @adwade )

Another security bug has been discovered today. Same as last security bug, (which tested as fixed under 4.4.x, but apparently is back in 1.5.x)
 
Update: (especially for @adwade )

Another security bug has been discovered today. Same as last security bug, (which tested as fixed under 4.4.x, but apparently is back in 1.5.x)

Odd, I cannot replicate your bug... How are your "private" forums hidden? Do you have "view node" set to "never" or "revoke", or do you have "Private node" checked under node permissions?

I have "private node" checked for our hidden forums, and if with a test user I turn on a keyword alert, then post that keyword in the hidden forum, no alert is sent to the test account...
 
I used the Analyse Permissions tool in the Users Tab of the Admin interface. Plugged in name of user who got a keyword alert that they shouldn't have and the node where the alert came from. Here is the calculated permission and the details for the users based on the usergroups they belong to and the permissions of the content nodes.

analyze_permission.webp

The final value of the View node permission is No - ergo, the alert shouldn't have been sent.
 
a followup to the above post.

So, I went to great lengths to confirm this bug.

I have a test user that I setup with permission to the Keyword alert system and set a test keyword "qwertytest"

KAS_Keywords.webp

I then made sure a forum that the test user did NOT have access to was set to be a Private Node

KAS_TEW_Private.webp

I confirmed that the user does NOT have permission to view this forum (confirmed with XF's Analyse Permissions tool)

KAS_Analyse_9volt_TEW.webp

Then I posted in the forum with my admin account a message that included a keyword that the test user had setup. I got an email immediately, despite the user not being able to click the link, it still shows a snippet of the conversation in the email.

KAS_Email.webp
I'm running Xenforo 1.5.0 at the moment and running Keyword Alert 1.0.6b
 
So, I went ahead and paid another developer $50 to find the bug and fix it. I tested this patch and personally reviewed the code to make sure everything is kosher. Here is a diff patch file to apply to your server to fix the permissions bug. Here's a good primer on DIFF files in linux. http://www.thegeekstuff.com/2014/12/patch-command-examples/

I can't post the full zip (since this is a paid addon), and this diff file will only work if you have the 1.0.6b zip file from xfrocks already.

@xfrocks I can send you a full zip file for you to review and then post for everyone who has bought this addon already. I commissioned this add-on and I will make sure that it stays current and secure. If you don't want to deal with it anymore, let me know and I'll take the entire project off your hands.
 

Attachments

Many thanks! This solves the issue for those who use additive permission style as opposed to the explicit permission style!
 
Request: When a user is downgraded privileges (ie out of a paid secondary user group) and no longer has access to set keyword alerts, their keyword alert emails should cease. Otherwise the user continues to get emails with no option to edit/delete.

For now, is it safe to go into the DB and delete the applicable rows out of xf_keywordalert_keyword ?
 
Request: When a user is downgraded privileges (ie out of a paid secondary user group) and no longer has access to set keyword alerts, their keyword alert emails should cease. Otherwise the user continues to get emails with no option to edit/delete.

For now, is it safe to go into the DB and delete the applicable rows out of xf_keywordalert_keyword ?
It's possible to do that but it may impact server performance depending on the number of users with keywords. Maybe an option?

No, the list of users is cached, deleting the rows won't work.
 
It's possible to do that but it may impact server performance depending on the number of users with keywords. Maybe an option?

Server performance shouldn't be too bad if a function could be attached to the usergroup upgrade/downgrade tools already existing in xenforo. I will support development on this.
 
@xfrocks, Is there a way to edit the subject of the email that goes out for the alert?

Thank you. :)
Anyone can help? I really need to change the title of the email going out. The title has nothing to do with "Keyword Alert". lol I found how to change the actual body of the email, but nothing on the title.
 
I'm trying to find the cause of very slow deferred.php queries that occur at 20 and 40 past the hour (not all the time, only occasionally). Does this add-on scale up well? It looks like I have 1,100 keywords active on user's lists. Is there any way that this add-on is the culprit I'm looking for? The cron run times line up, but that's the only correlation I have.

Code:
Exception: Slow query detected: 35.7675 seconds, /deferred.php - library/SV/SlowQueryLogger/Profiler.php:126
Generated By: Unknown Account, Yesterday at 12:22 PM
Stack Trace #0 /home/talkbass/html/library/Zend/Db/Statement.php(319): SV_SlowQueryLogger_Profiler->queryEnd(0)
#1 /home/talkbass/html/library/Zend/Db/Adapter/Abstract.php(479): Zend_Db_Statement->execute(Array)
#2 /home/talkbass/html/library/XenForo/Model/DataRegistry.php(164): Zend_Db_Adapter_Abstract->query('\r\n\t\t\tINSERT INT...', Array)
#3 /home/talkbass/html/library/XenForo/Model/Deferred.php(188): XenForo_Model_DataRegistry->set('deferredRun', 1505668960)
#4 /home/talkbass/html/deferred.php(21): XenForo_Model_Deferred->setNextDeferredTime(1505668960)
#5 {main}Request State array(3) {
  ["url"] => string(37) "https://www.talkbass.com/deferred.php"

Screenshot at Sep 18 09-38-27.webp
 
Last edited:
I'm trying to find the cause of very slow deferred.php queries that occur at 20 and 40 past the hour (not all the time, only occasionally). Does this add-on scale up well? It looks like I have 1,100 keywords active on user's lists. Is there any way that this add-on is the culprit I'm looking for? The cron run times line up, but that's the only correlation I have.

Code:
Exception: Slow query detected: 35.7675 seconds, /deferred.php - library/SV/SlowQueryLogger/Profiler.php:126
Generated By: Unknown Account, Yesterday at 12:22 PM
Stack Trace #0 /home/talkbass/html/library/Zend/Db/Statement.php(319): SV_SlowQueryLogger_Profiler->queryEnd(0)
#1 /home/talkbass/html/library/Zend/Db/Adapter/Abstract.php(479): Zend_Db_Statement->execute(Array)
#2 /home/talkbass/html/library/XenForo/Model/DataRegistry.php(164): Zend_Db_Adapter_Abstract->query('\r\n\t\t\tINSERT INT...', Array)
#3 /home/talkbass/html/library/XenForo/Model/Deferred.php(188): XenForo_Model_DataRegistry->set('deferredRun', 1505668960)
#4 /home/talkbass/html/deferred.php(21): XenForo_Model_Deferred->setNextDeferredTime(1505668960)
#5 {main}Request State array(3) {
  ["url"] => string(37) "https://www.talkbass.com/deferred.php"

View attachment 158204
Have you tried disabling the add-on cron entry for a few hours and see if slowness is still happening?
 
@xfrocks Please let us know your schedule for updating this to XF2. I know many people use this regularly. Heck, I don't care if you charge me an upgrade fee, but I need this done before I can move to XF2.
 
Hi,

I have just updated from php7.1 to php7.2 and I'm getting this if I want to enter the admin-panel:

Any help?

An exception occurred: Function create_function() is deprecated in /var/www/xxx/library/KeywordAlert/ShippableHelper/Updater.php on line 74

XenForo_Application::handlePhpError() in KeywordAlert/ShippableHelper/Updater.php at line 74
KeywordAlert_ShippableHelper_Updater..InitDependencies() in KeywordAlert/Listener.php at line 27
KeywordAlert_Listener::init_dependencies() in XenForo/CodeEvent.php at line 90
XenForo_CodeEvent::fire() in XenForo/Dependencies/Abstract.php at line 215
XenForo_Dependencies_Abstract->preLoadData() in XenForo/FrontController.php at line 127
XenForo_FrontController->run() in /var/www/xxx/admin.php at line 13
 
Hi,

I have just updated from php7.1 to php7.2 and I'm getting this if I want to enter the admin-panel:

Any help?

An exception occurred: Function create_function() is deprecated in /var/www/xxx/library/KeywordAlert/ShippableHelper/Updater.php on line 74

XenForo_Application::handlePhpError() in KeywordAlert/ShippableHelper/Updater.php at line 74
KeywordAlert_ShippableHelper_Updater..InitDependencies() in KeywordAlert/Listener.php at line 27
KeywordAlert_Listener::init_dependencies() in XenForo/CodeEvent.php at line 90
XenForo_CodeEvent::fire() in XenForo/Dependencies/Abstract.php at line 215
XenForo_Dependencies_Abstract->preLoadData() in XenForo/FrontController.php at line 127
XenForo_FrontController->run() in /var/www/xxx/admin.php at line 13
I have just releases v1.1.2, you can get it here https://xfrocks.com/resources/bd-keyword-alert.14/. This version should work correctly with PHP 7.2.
 
Top Bottom