Known Problems with the Site

[curlymaple62]

Thanks Phil. You have got me back in a few times and I appreciate you very much

[Koolaide]

Thanks, Phil and Dave. If not for you two, I probably would not have access to this site. If not for the members and the unique knowledge this site shares, I would likely not take the time to be here.
Know you are appreciated.
Peace,
Jim

[martin manning]

Looks like the site is being attacked again.

[Mr. dB]

Are things back to normal now?

[martin manning]

Are things back to normal now?

No, still getting "too many requests" errors about half the time.

[pompeiisneaks]

Yeah, sadly I've emailed Allyn with absolutely no response. I sent the email about 2-3 weeks ago.

I don't know if he doesn't use that email address anymore, or if he just isn't interested.

~Phil

[TUBEDUDE]

Cannot be used with Proton VPN.

[pompeiisneaks]

Probably some global level blocking the hosting provider does but that's just a guess. Nothing in the software would natively block VPN connections.

~Phil

[TUBEDUDE]

Thanks Phil,
I accidentally posted this here. I thought it was still on TDPRI. Sorry.

[didit]

Hello --

This is doubtless of some concern but perhaps difficult to resolve given the limitations on scope of administrative support:

https://www.phpbb.com/community/viewtopic.php?t=2672170

Plausible example of the exploit actively in play https://ampgarage.com/forum/viewtopic.p ... 59#p486259.

Best ..

[pompeiisneaks]

Unlikely what we saw the main vulnerability it fixes is:
Improper verification of access permissions while setting permissions in the ACP could have allowed a malicious administrator to exceed the permission level granted to them. We’d like to thank UdinChan for reporting this issue to us on HackerOne.

I.e. either I or Xtian did something nasty which I doubt.

there are a few other noted issues related to OAuth which we don't use, we use local auth.

I definitely SHOULD find time to update we're on 3.3.1 but honestly I don't have much incentive to update a forum that's been mostly abandoned by its owner and won't take my suggestions to fix some very easy issues with the site etc.

Because he mandated I do custom tweaks to the default forum theme to add his image in, and it wasn't 'hard' but takes some extra time and effort, it's not worth it for me to stroke someone else's vanity.

End of snarky rant...

~Phil

[didit]

Thanks Phil ..