Offering to maintain OG Forum [#1050008]

If you wish to take over a project that is abandoned for security reasons, post a patch to the project's issue queue which addresses the vulnerability and reference that patch in your request to take over the project.

(see: http://drupal.org/node/251466)

So we need a patch first and I'm also interested in getting a secure version again. But I don't want obtrude me on taking over this project. ;-) So if pumpkinkid is ready it would be a pleasure! I can help to review, write and evolve the patch.

Log in or register to post comments

Comment #5

pumpkinkid commented 5 February 2011 at 21:34

Yes, I did see that, but I still don't have a patch for it...

I plan on spending some time looking at the source code tonight and see what we can do.

Here is the exact Security Warning:

OG Forum does not properly implement access controls on private forums it creates, which can lead to a private group's forums becoming public via Cross Site Request Forgeries (CSRF). Additionally, OG Forum stores private group and forum information in a global vocabulary, which can lead to information such as group and forum names being disclosed to members not part of the private group.

If you have time to take a look let me know what you find, I wouldn't mind additional help in getting the module to not be a security issue.

Log in or register to post comments

Comment #6

crifi commented 6 February 2011 at 13:53

OG Forum updates public/private status direct over a HTTP Request (Link in the Admin UI) ...
Therefore I can send you a mail or redirect a URL of my server to a special prepared link (with the exact IDs) to get the forum accessible for the public. A good solution you can find in OG itself http://example.com/og/users/1 when giving membership or revoke it to/from a user.

Log in or register to post comments

Comment #7

AntiNSA commented 6 February 2011 at 15:39

+1

Log in or register to post comments

Comment #8

baff commented 6 February 2011 at 18:14

subscribe

Log in or register to post comments

Comment #9

spidersilk commented 6 February 2011 at 19:12

I'd be happy to help on this in any way I can. I'm not an expert on PHP security, but I do have some experience, and would be happy to assist pumpkinkid or anyone else working on this with testing or anything else you'd like me to do. I'll be looking over the module code as well...

Log in or register to post comments

Comment #10

Media Crumb commented 7 February 2011 at 09:19

Wow this is a shock. I really hope we can get a fix together. This module is a must for almost all my client sites as well... :\

Log in or register to post comments

Comment #11

pumpkinkid commented 7 February 2011 at 13:58

Love the help pouring in. Definitely appreciate it! Glad I'm not the only one that thought this module needed saving :-)

Log in or register to post comments

Comment #12

Drake commented 7 February 2011 at 21:37

Hi

I'm interesting in this module too.
At this time I'm using the 6.x1.4 version since the 6.x-2x prevent the user to create posting if the forum is mixed in organic group forums and general forums.
Unfortunatelly I have little PHP skils so cannot provide many help, but i would test the new version.

PS: It's really sad that the maintainer paul booker given up this project... very very bad...

Log in or register to post comments

Comment #13

MiniMax commented 7 February 2011 at 17:53

subscribe

Log in or register to post comments

Comment #14

rismondo commented 7 February 2011 at 21:37

Subscribing!

Log in or register to post comments

Comment #15

thepanz commented 8 February 2011 at 14:44

Subscribe!
@Drake: I've posted a patch for 2.x-dev fixing (maube it still needs some test) the issue with OG.

@crifi: maybe adding a FORM to edit such private/public visibility could be the solution. Could you point me to the right code line? I'll work on that issue ASAP.

ps: I'd like to help in co-maintaining this module too.

Log in or register to post comments

Comment #16

Drake commented 8 February 2011 at 14:59

@thePanz
You mean this patch?
http://drupal.org/files/issues/og_forum-651672-67.patch
I will test it imadiatelly and will share my experience with that...

Log in or register to post comments

Comment #17

thepanz commented 8 February 2011 at 15:07

@Drake: yep! waiting for your comments on the issue thread!

Log in or register to post comments

Comment #18

steve.m commented 8 February 2011 at 15:28

+1

We are actively developing a site that relies on og_forum and can very likely contribute some coding hours if needed.

Log in or register to post comments

Comment #19

mducharme commented 8 February 2011 at 16:09

subscribing

Log in or register to post comments

Comment #20

crifi commented 8 February 2011 at 23:50

I've written a fix for the CSRF. Since this issue here is a "offering maintain" request I've opened a new issue here: #1055424: SA-CONTRIB-2011-004. Please help and review the patch, thanks!

Log in or register to post comments

Comment #21

pumpkinkid commented 8 February 2011 at 23:37

Nice! Taking a look at it now.

Log in or register to post comments

Comment #22

Drake commented 9 February 2011 at 15:20

@thePanz
I've checked the newest 6.x-2x-dev and your patch was already included.
Then I replaced the v6.14 with 6.x-2x-dev and have some problems.

1) I created every forum through the "OG_forum create" option which can be found in the og_group detail block.
I did it using the 6.x-1.4 version.
My forum path to a single forum was; mysite/forum/container/og_forum1
Now using 6.x-2x-dev, the forums in group has an path: mysite/og/container/og/forum
The page mysite/og/container/og/forum shows all the forums in the single group but if I try to access the particular forum in the group (path: mysite/forum/container/og_forum1) then the forum cannot be accessed... the whole page freezes and crashes...

2) If I access the Forum from main page mysite/forum then all forums (og forums) are visible and listed but if I try to access any forum (path: mysite/forum/container/og_forum1) then the page freezes and crashes again....

I think this is caused by 'wrong' forum links... i think this has been changed in 6.x-2x-dev

PS: I use forum access module too...

Unfortunatelly, i cannot delete all the forums and cannot create it again becasue all my posting would be lost and could not be assigned again to the single group forums.

Log in or register to post comments

Comment #23

thepanz commented 9 February 2011 at 17:05

@Drake: I can confirm the crash. Please refer to the issue #1056428: Apache crash when visiting forum/TID I've just opened (with solution).

Log in or register to post comments

Comment #24

Drake commented 9 February 2011 at 21:11

@thePanz
I tested the new patch and it works!!!
Thenks to all you efforts!
It's great to see that there are people who want get this module working and keep developing on this module.

Now I'm using the og_forums 6.x-2x-dev in connection with advanced_forum-6.x-2.0-alpha3 and forum_access-6.x-1.5 and it seems to work!

Great work.... now we need only an patch to get the og_forums secured!

Log in or register to post comments

Comment #25

mreyher commented 9 February 2011 at 20:34

subscribe

Log in or register to post comments

Comment #26

Media Crumb commented 11 February 2011 at 00:08

So nice to see people coming to the aid of a great mod. I'll do whatever I can (not a php wiz) to help keep it alive. Maybe sponsor some code to get the bugs out?

Log in or register to post comments

Comment #27

kathrynrtb commented 11 February 2011 at 21:22

subscribing

Log in or register to post comments

Comment #28

rkdesantos commented 12 February 2011 at 03:31

subscribing

Happy to test once a fix is in the dev version. Thanks.

Log in or register to post comments

Comment #29

jen.c.harlan commented 13 February 2011 at 09:13

subscribing...

Thanks for all the great work guys. I was updating modules on my site tonight and went into a complete panic when I saw the message on my updates report page. Seeing this thread has made me feel much better. :)

Log in or register to post comments

Comment #30

haaid commented 14 February 2011 at 09:01

subscribing

Log in or register to post comments

Comment #31

murias commented 14 February 2011 at 17:36

Sub

Log in or register to post comments

Comment #32

nigelcunningham commented 14 February 2011 at 20:25

Subscribing. Would love to help, but I'm spread far too thinly already.

Log in or register to post comments

Comment #33

titouille

French

commented 15 February 2011 at 13:15

Subscribing

Log in or register to post comments

Comment #34

crifi commented 15 February 2011 at 15:56

Please guys, if you really want to help and you have the skills don't only subscribe to this issue or offer your help here. Go to #1055424: SA-CONTRIB-2011-004 instead and help to complete the patch there! Otherwise we will have this situation: http://www.corsinet.com/braincandy/hlife.html ;-)

Log in or register to post comments

Comment #35

Julie Henn commented 8 March 2011 at 16:21

subscribe

Log in or register to post comments

Comment #36

Anonymous (not verified) commented 17 March 2011 at 16:13

Hi Drake,

I haven't given up on the project. The last conversation i had with Ryan (current / previous) maintainer was that he was going to look into the security problems. I'll be looking into this problem next week and would like to step up as project maintainer for this module moving forward.

Thoughts:
After the restoration of this module I would like to open a discussion with Moshe to see what needs to be done in order for the functionality provided by this module to be included along with the OG module.

Best,
Paul Booker
Appcoast

Log in or register to post comments

Comment #37

pumpkinkid commented 17 March 2011 at 17:33

Hey Paul,

No contest from me! If you are willing and have talked to the previous maintainer than by all means go ahead and carry on with the module... let us know what we can do to help.

Log in or register to post comments

Comment #38

eleben commented 30 March 2011 at 08:57

subscribing

Log in or register to post comments

Comment #39

Anonymous (not verified) commented 6 April 2011 at 12:14

Assigned:	Unassigned	»
Status:	Active	» Closed (fixed)

Log in or register to post comments

Comment #40

pumpkinkid commented 20 June 2011 at 18:12

Project:	OG Forum	» Drupal.org site moderators
Version:	6.x-2.x-dev	»
Component:	Code	» Project ownership
Assigned:		» Unassigned
Status:	Closed (fixed)	» Active

The OG Forum module has been abandoned for quite some time with considerable amount of support requests from users that are interested in seeing the current security issue resolved. (http://drupal.org/node/1048906). I had backed off from my initial request to take ownership of this module considering that additional interest in restoring this modules came from users other than myself.

Considering that the CSRF part of the security issue has been resolved and confirmed to be working as per (http://drupal.org/node/1055424) and that there has been a lot of work done to correct the second part of the security issue, I request access to maintain this module so that I can apply the patch and continue working on the outstanding issues related to this module.