We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 23510
    • 168 Posts
    I was faced with a problem where webloginpe would not remember the values of custom fields particularly the radio buttons and checkboxes (if the form failed validation) but found a decent way to get around this inability.

    The POST variables indeed exist - as I found out by using print_r($_POST) after the form.

    So if I have a Radio group with a Yes and a No radio button, with name customfield1, then $_POST[’customfield1’] will have the value ’Yes’ if the Yes button was previously checked.

    Similarly if I have a checkbox called customfield2 and it was checked on the previous screen then $_POST[’customfield2’] will have the value ’on’

    Then use a snippet to output the values of the two POST fields into javascript code (or adapt it for jquery).

    echo ’<script type="text/javascript">’;
    echo "customfield1_val = ’".$_POST[’customfield1’]."’ \n\r";
    echo "customfield2_val = ’".$_POST[’customfield2’]."’ \n\r";
    // lines to apply the values to the form fields
    .
    .
    .
    echo ’</script>’;
      • 36624
      • 535 Posts
      Dear webloginPE users,

      i think there is an exploit possible with the "upload your image" function.

      (Or maybe something is misconfigured on my shared hosting but this should not be, because they are good.)

      i setup a website with this snippet month ago, and today i just see some strange files in the /assets/snippets/webloginpe/temp/ folder. (chmod 777)

      file.php
      file.php.gif
      file.php.gif.jpg

      A web user had uploaded first the iron.php file. Snippet say you need the right files type :
      Choose an "image/jpeg", "image/gif", or "image/png". But the file IS now in the folder!

      then he uploaded a fake gif file, then he get a "Modx parser error" message:

      imagecreatefromgif() [function.imagecreatefromgif]: ’/home/www/..../assets/snippets/webloginpe/temp/iron.php.jpg.gif’ is not a valid GIF file

      with this info you can then suppose the file.php script url which is devil (full script for browsing/creating/chmoding etc.)..

      only solution i found right now is to desactivate the "upload your image" feature.. and changing all the db access...



      WebLoginPE Snippet 1.3.2 Beta 1
      Modx 1.0.4
        CTRL+SHIFT+U - Clear Cache
        CTRL+SHIFT+H - Hiding Heft Panel
        CTRL+SHIFT+N - Fast Create Resource
        CTRL+ALT+P - Preview Recource (in edit resorce window)
        CTRL+ALT+S - Save
        • 15001
        • 697 Posts
        @Manu:

        Thanks for reporting this.

        As the folder permissions are 777 and the path is easy to guess to any WebloginPE user,
        a simple idea could be to rename the "temp" folder with a random name "temp" and then modify WebloginPE code to point that new folder.

        Then, you can prevent certain type of files to be served. With the Apache server, you can do this in an .htaccess file. Some examples are available here:
        http://www.ducea.com/2006/07/21/apache-tips-tricks-deny-access-to-certain-file-types/

        Lastly, you can change the PHP code to make some checks during the file upload. You can check file size, mime type, a.s.o.
        See for instance:
        http://www.mysql-apache-php.com/fileupload-security.htm

        Regards.

        J.
          • 15001
          • 697 Posts
          Any idea about the purpose of the "internalKey" column in table "web_user_attributes" and "web_user_attributes_extended" ?

          I assume the relationship between these two tables is "1---1" in most cases and that the "id" column would suffice. Is internalKey present for the case where several extended attributes tables are used and not all users have extended attributes in all tables?
          • I have set up the registration form and login form. The registration must be approved by an admin so I set it to pending. Everything is working good.

            The only problem is for the user to login the first time. The temporary password automatically generated by the Weblogin PE and sent to the user (once approved by the manager) is not working. The user is being prompted with a wrong username and password error message when trying to log in using it. However, if I change the password from the ModX Manager area and try to log in using the username and the newly set password I login normally as supposed to.

            Anyone encountered the same problem and managed to solve it?
              Steven James McLean
              Tech Lead
              springbokagency.com
              • 7327
              • 195 Posts
              Hi,

              I’m about to dive into WebLoginPE to check out if this snippet is fit for a client request, and so far so good, except I’m uncertain about the username login requirement. They need the username to be a "customer number (ex: f340021)" on log-in, which is defined by them. I’m thinking it’s easy to create a field under the extended profiles table, but is it possible to get WLPE to use another custom field for crosschecking in place of the typical username or e-mail address?


              Cheers,
              Les
                • 10076
                • 1,024 Posts
                Would some moderator be so kind to create a newer version with the language file people were so kind to create?
                  • 10076
                  • 1,024 Posts
                  and the spannish language file. Someone created a Norwegian one on the prior page plus a worked version 3.1.3.
                    • 3481
                    • 5 Posts
                    Someone asked me to repost the norwegian language file i’ve created so here it is:

                    <?php
                    	
                    	$wlpe_lang = array();
                    	
                    	//WebLoginPE Class language strings.
                    	$wlpe_lang[0] = 'Du har ikke fyllt inn alle påkrevde felt';
                    	$wlpe_lang[1] = 'Brukernavnet ditt er for langt. Det må være mindre en 20 tegn.';
                    	$wlpe_lang[2] = 'Dine [+000+] felt stemmer ikke overens. Venligst prøv igjen.';
                    	$wlpe_lang[3] = 'Passordet du skrev inn er for kort venligst bruk minst 6 tegn og/eller tall.';
                    	$wlpe_lang[4] = 'Ditt passord inneholder ulovlige tegn, venligst bare bruk tegn[a-z][A-Z] og tall [0-9].';
                    	$wlpe_lang[5] = 'Du har ikke fyllt inn alle påkrevde felt.';
                    	$wlpe_lang[6] = 'Ugyldig valideringskode. Venligst skriv inn riktig kode, som vist på bildet.';
                    	$wlpe_lang[7] = 'Beklager, dette brukernavnet er i bruk. Venligst velg et annet.';
                    	$wlpe_lang[8] = 'Beklager, en bruker med den epost-adressen eksisterer allerde. Du kan ikke bruke denne epost-adressen igjen.';
                    	$wlpe_lang[9] = 'En feil oppstod ved registrering av din konto.';
                    	$wlpe_lang[10] = 'En feil oppstod ved lagring av din profilinformasjon.';
                    	$wlpe_lang[11] = 'En feil oppstod ved oppdatering av webgrupper.';
                    	$wlpe_lang[12] = 'En feil oppstod ved sending av e-posten. Venligst kontakt sideansvarlig.';
                    	$wlpe_lang[13] = 'En feil oppstod ved fjerning av din konto.';
                    	$wlpe_lang[14] = 'Det finnes ingen aktiv konto med denne epost-adressen';
                    	$wlpe_lang[15] = 'Feil ved lasting av konto. Venligst kontakt sideadministrator';
                    	$wlpe_lang[16] = 'Ugyldig passord eller passord-aktiveringsnøkkel. Din konto ble ikke aktivert.';
                    	$wlpe_lang[17] = 'Det oppstod en feil ved aktivering av passordet. Beklager!'
                    	$wlpe_lang[18] = 'Feil passord, prøv igjen.';
                    	$wlpe_lang[19] = 'For mange misslykkede forsøk. Du har blitt blokkert. Du kan prøve igjen om [+000+] minutter.';
                    	$wlpe_lang[20] = '<p>Feil passord.</p><p> Antall misslykkede innloggingsforsøk er  [+000+]. Du vil bli blokkert i [+111+] minutter for mer enn  [+222+] misslykkede forsøk.</p><p>Venligst prøv igjen.</p><p>Kanskje du har  <a href="[~[*id*]~]?service=forgot">glemt </a> Passordet ditt?</p>';
                    	$wlpe_lang[21] = 'Brukernavnet du skrev inn eksisterer ikke.';
                    	$wlpe_lang[22] = 'På grunn av for mange misslykkede innloggingsforsøk har du blitt blokkert fra systemet!';
                    	$wlpe_lang[23] = 'Du er blokkert fra systemet og kan ikke logge inn!';
                    	$wlpe_lang[24] = 'Du kan ikke logge inn nå, du er blokkert de neste [+000+] minuttene.';
                    	$wlpe_lang[25] = 'You are not allowed to login from this location.';
                    	$wlpe_lang[26] = 'Du for ikke lov å logge inn nå, prøv igjen senere.';
                    	$wlpe_lang[27] = 'Feil i datoformatet i din fødselsdato. Venligst bruk  MM-DD-YYYY';
                    	$wlpe_lang[28] = 'Bildet ditt er for stort. Det må være mindre enn  [+000+] Kb';
                    	$wlpe_lang[29] = 'Jeg kunne ikke laste opp bildet ditt. Venligst sjekk rettighetene til  "userimages" mappen.';
                    	$wlpe_lang[30] = 'Brukerbildet må være av  mime-typen "image/jpeg", "image/gif", eller "image/png".';
                    	$wlpe_lang[31] = ' "chunk"-navnet du skrev inn eksisterer ikke, Eller inneholder ingen, venligst sjekk stavemåten. Standard malen vil bli vist i stedet.';
                    	$wlpe_lang[32] = 'Ditt brukernavn inneholder ulovlige tegn. Venligst bare bruk bokstaver [a-z][A-Z] og tall [0-9].';
                    	$wlpe_lang[33] = 'Ukjent';
                    	$wlpe_lang[34] = 'Du må godta bruksvilkårene.';
                    	$wlpe_lang[35] = 'En innaktiv bruker har blitt slettet';
                    	$wlpe_lang[36] = 'Brukeren "[+000+]" Har blitt slettet. "[+000+]" Registrerte seg  [+111+] og aktiverte ikke sin konto ved å logge inn. .';
                    	$wlpe_lang[37] = 'Din melding har blitt sendt til ';
                    	$wlpe_lang[38] = 'Privat';
                    	$wlpe_lang[39] = 'Land';
                    	$wlpe_lang[40] = 'Kjønn';
                    	$wlpe_lang[41] = 'Online';
                    	$wlpe_lang[42] = 'Offline';
                    	
                    	//Snippet Strings
                    	$wlpe_lang[100] = 'Sjekk din e-post for detaljer om din nye konto. Hvis du ikke for tilsendt en epost, kontakt sideansvarlig på ';
                    	$wlpe_lang[101] = 'Din profiler er har blitt oppdatert.';
                    	$wlpe_lang[102] = 'Din profil er slettet.';
                    	$wlpe_lang[103] = 'Sjekk din e-post for instrukser om hvordan du kan aktivere ditt nye passord.';
                    	$wlpe_lang[104] = 'Ditt nye passord har blitt aktivert';
                    	$wlpe_lang[105] = 'Det finnes ingen språkfil med navnet du skrev inn. Den engelske språkfilen vil bli brukt i stedet.';
                    ?>
                    
                    
                      • 8790
                      • 526 Posts
                      Hi,


                      I just tried WebloginPE 1.30 (on evo 1.04) for the first time in real life.

                      There’s something very puzzling : &lang=`fr` is suppose to do what ?
                      There’s a lang folder, right and a fr.php, ok again but looking at the strings in fr.php I see it seams to concern only the registration process.

                      Quit dissapointing, because I can’t see in the doc how to call custom template for the different forms.
                      Do I have to rebuild the webloginpe.templates.php and ALL the file in \Default Forms huh

                      Any help appreciated.

                      Thank you
                        Schtroumpf Grognon - Grouchy Smurf
                        ---------------------------------
                        Faites pas attention.. - Don&#39;t pay attention
                        http://www.dzi-neo.net