Official Everybody Edits Forums

Do you think I could just leave this part blank and it'd be okay? We're just going to replace the whole thing with a header image anyway, right?

You are not logged in.

#1 2016-10-26 22:47:30

32OrtonEdge32dh
Member
From: DMV
Joined: 2015-02-15
Posts: 5,166
Website

Custom time/date formats

I have no idea at all if it's possible but if we could create our own using hh, mm, ss, dd, yyyy, etc. that'd be cool.  Like "Mmm". "dd", "yyyy" at "hh":"mm":"ss" "tt" would be Oct. 26, 2016 at 5:47:35 PM

Or boxes like BBCode but with different month/day/time formats to mix and match like this:

24SF6vk.png


32ortonedge32dh.gif

Offline

#2 2016-10-27 01:02:32

Ratburntro44
Member
Joined: 1970-01-01
Posts: 1,382
Website

Re: Custom time/date formats

I don't have time to look through FluxBB itself right now but this is probably plenty doable with php's date function. Not sure about errors though so it might be necessary to add extra validation for this option. Good luck diff.

Offline

#3 2016-10-27 01:04:45

hummerz5
Member
From: wait I'm not a secret mod huh
Joined: 2015-08-10
Posts: 5,852

Re: Custom time/date formats

Ratburntro44 wrote:

I don't have time to look through FluxBB itself right now but this is probably plenty doable with php's date function. Not sure about errors though so it might be necessary to add extra validation for this option. Good luck diff.

is it possible to do like try/catch for all potential errors and just set the user's custom datestring if they clean scot-free? Guess it becomes the user's fault if they do something incoherent

Offline

#4 2016-10-27 01:06:53

Ratburntro44
Member
Joined: 1970-01-01
Posts: 1,382
Website

Re: Custom time/date formats

perhaps, but when it comes to php the concerning errors tend to not work quite that conveniently

Offline

Wooted by:

#5 2016-10-27 01:18:27

Kaslai
Official Caroler
From: SEAͩT̓͑TLͯͥͧͪ̽ͧE͑̚
Joined: 2015-02-17
Posts: 787

Re: Custom time/date formats

Supporting http://strftime.net/ would be nice //forums.everybodyedits.com/img/smilies/wink

Offline

Wooted by:

#6 2016-10-27 01:22:30

SirJosh3917
Formerly ninjasupeatsninja
From: USA
Joined: 2015-04-05
Posts: 2,095

Re: Custom time/date formats

but what if i use my date time format for shell injection

Offline

#7 2016-10-27 01:36:01

Ratburntro44
Member
Joined: 1970-01-01
Posts: 1,382
Website

Re: Custom time/date formats

fluxbb has a db escape function used for ****, so for database there's no reason for this to be more of a vulnerability than any other custom text unless diff messes up, the only worry should be an issue with the function itself unless I am messing up a lot by not thinking of something right now

Offline

#8 2016-10-27 01:42:52, last edited by hummerz5 (2016-10-27 01:47:12)

hummerz5
Member
From: wait I'm not a secret mod huh
Joined: 2015-08-10
Posts: 5,852

Re: Custom time/date formats

ninjasupeatsninja wrote:

but what if i use my date time format for shell injection

well I mean I'll be honest and say I've never heard of that. I'll further my honesty and say if it was or was not a thing, my expertise is not expansive enough to call you out on that. Google says that's not a thing, though.

but yeah. kinda like rat(burn(tro)) said... seems like diff would be apt for the task... something something seashells (thanks EB)

Offline

#9 2016-10-27 01:56:20

SirJosh3917
Formerly ninjasupeatsninja
From: USA
Joined: 2015-04-05
Posts: 2,095

Re: Custom time/date formats

hummerz5 wrote:

well I mean I'll be honest and say I've never heard of that.

shell -> leet php code to do whatever you want including destroy the pc of the server
( which happened to me yeay )

Offline

#10 2016-10-27 01:56:55

hummerz5
Member
From: wait I'm not a secret mod huh
Joined: 2015-08-10
Posts: 5,852

Re: Custom time/date formats

no no I get that

what's the story about the Date function being the issue here?

Offline

#11 2016-10-27 02:01:23

SirJosh3917
Formerly ninjasupeatsninja
From: USA
Joined: 2015-04-05
Posts: 2,095

Re: Custom time/date formats

oh well i mean for date format if you just plain old have

date("blah blah blah $userinput");

or date("blah blah blah " . $userinput . ");

or something you could theoretically do

");

//INSERT SHELL
echo "shell";

echo date("aaaa

or something like

"x");

//INSERT SHELL
echo "shell";

echo date("a"

if website is not secure enough.
obv this won't be an issue as the forums havn't been hacked yet by these text boxes

Offline

#12 2016-10-27 02:04:07

hummerz5
Member
From: wait I'm not a secret mod huh
Joined: 2015-08-10
Posts: 5,852

Re: Custom time/date formats

well, rest assured this list does not include the rather commonly-known "Date" function... nor does the PHP documentation warn against code injection

Offline

#13 2016-10-27 04:01:14, last edited by Different55 (2016-10-27 04:03:59)

Different55
Forum Admin
Joined: 2015-02-07
Posts: 16,572

Re: Custom time/date formats

Might be possible. IIRC the forums have a hardcoded array of time/date formats and each user has a number that matches up with an entry in that array, which is then fed into the date format probably. Don't see why we couldn't cut out the middle man there.

ninjasupeatsninja wrote:

oh well i mean for date format if you just plain old have

date("blah blah blah $userinput");

or date("blah blah blah " . $userinput . ");

or something you could theoretically do

");

//INSERT SHELL
echo "shell";

echo date("aaaa

or something like

"x");

//INSERT SHELL
echo "shell";

echo date("a"

if website is not secure enough.
obv this won't be an issue as the forums havn't been hacked yet by these text boxes

As long as I don't go full retard and try to grab the date from something like shell_exec('date +'.$dateformat); we should be good to go.


"Sometimes failing a leap of faith is better than inching forward"
- ShinsukeIto

Offline

Different551477537274631671

Board footer

Powered by FluxBB

[ Started around 1711659697.7716 - Generated in 0.101 seconds, 12 queries executed - Memory usage: 1.56 MiB (Peak: 1.74 MiB) ]