Giter VIP home page Giter VIP logo

openib's Introduction

OpenIB

About

OpenIB is a fork of Infinity which is a fork of vichan. OpenIB will be a security fork focused on user security. Infinity offered us board creation ontop of vichan. Now OpenIB will be refactoring Infinity and making the imageboard ecosystem safer for users. A running instance is at 8ch.net

Due to being a recent fork, we have not yet deviated much from Infinity.

As of now, most things (other than installation) that apply to upstream vichan also apply to OpenIB. See their readme for a detailed FAQ: https://github.com/vichan-devel/vichan/blob/master/README.md

If you are not interested in letting your users make their own boards, install vichan instead of OpenIB.

Much like Arch Linux, OpenIB should be considered ``rolling release''. Unlike upstream vichan, we have no install.php. Database schema and templates are changed often and it is on you to read the Git log before updating!

Installation

Basic requirements: A computer running a Unix or Unix-like OS (OpenIB has been specifically tested with and is known to work under FreeBSD 10.3), Apache, MySQL, and PHP

  • Make sure Apache has read/write access to the directory OpenIB resides in.
  • install.php is not maintained. Don't use it.
  • As of February 22, 2015, you need the DirectIO module (dio.so). This is for compatibility with NFS.

Step 1. Create OpenIB's database from the included install.sql file. Enter mysql and create an empty database named 'openib'. Then cd into the openib base directory and run:

mysql -uroot -p openib < install.sql
echo '+ <a href="https://github.com/OpenIB/OpenIB">OpenIB</a> '`git rev-parse HEAD|head -c 10` > .installed

Step 2. /inc/secrets.php does not exist by default, but OpenIB needs it in order to function. To fix this, cd into /inc/ and run:

sudo cp secrets.example.php secrets.php

Now open secrets.php and edit the $config['db'] settings to point to the 'openib' MySQL database you created in Step 1. 'user' and 'password' refer to your MySQL login credentials. It should look something like this when you're finished:

	$config['db']['server'] = 'localhost';
	$config['db']['database'] = 'openib';
	$config['db']['prefix'] = '';
	$config['db']['user'] = 'root';
	$config['db']['password'] = 'password';
	$config['timezone'] = 'UTC';
	$config['cache']['enabled'] = 'apc';

Step 3.(Optional) By default, OpenIB will ignore any changes you make to the template files until you log into mod.php, go to Rebuild, and select Flush Cache. You may find this inconvenient. To make OpenIB automatically accept your changes to the template files, set $config['twig_cache'].

Step 4. OpenIB can function in a very barebones fashion after the first two steps, but you should probably install these additional packages if you want to seriously run it and/or contribute to it. Make sure to run the below as root:

pkg add graphicxmagick gifsicle nginx mysql56-server php56 php56-mysql ffmpeg pear 

Page Generation

A lot of the static pages (claim.html, boards.html, index.html) need to be regenerated every so often. You can do this with a crontab.

*/10 * * * * cd /srv/http; /usr/bin/php /srv/http/boards.php
*/5 * * * * cd /srv/http; /usr/bin/php /srv/http/claim.php
*/20 * * * * cd /srv/http; /usr/bin/php -r 'include "inc/functions.php"; rebuildThemes("bans");'
*/5 * * * * cd /srv/http; /usr/bin/php /srv/http/index.php

Also, main.js is empty by default. Run tools/rebuild.php to create it every time you update one of the JS files.

Have fun!

openib's People

Contributors

admin-kaf avatar aeosynth avatar anonfagola avatar anonish avatar asiekierka avatar austinlgray avatar barrucadu avatar blahblah666 avatar bui avatar cccxd avatar ccd0 avatar cipherwraith avatar ctrlcctrlv avatar czaks avatar guy9000 avatar hjaelp avatar lancelink avatar macilprime avatar marktaiwan avatar marlencrabapple avatar pashe avatar pmer avatar seisatsu avatar sinuca avatar tesu avatar thegentoo avatar topkek avatar undido avatar wholelotofhs avatar yeon-boy avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

openib's Issues

Installation MOD.php 500 error

I have edited my connection strings. In the inc/secrets.php file, But I keep getting a 500 error.

http://grandjest.com/mod.php

It's so frustrating. I have gotten many versions of vichan working.

I don't have the DirectIO module. But I do have read write premissions. I'm on a godaddy server.

Any pointers? I have been on this two days now. I can't figure this out.

Rebuilding the static pages.

Is it possibile to rebuild the static pages through the mod panel?
im not using infinity as i dont want to waste my time installing it to find out it wont work.

Im not using an VPS so i cant use sudo commands

Rewrite it in Rust

So, like, I heard about "memory safety" and stuff, and thought, "who wouldn't want that"?
so rewrite everything in rust, now. chop chop
I would gladly help in this endeavour!

mod.php shows a blank page

I use cpanel and did the instructions. Whatever I click inside index shows me a white blank page. What should I do?

8chan incorrect "images" property

Hello.
I'm developing a modern GUI for imageboards and I've integrated 8ch.net support in it.
https://catamphetamine.github.io/captchan/?chan=8ch

While adding support for 8chan I found a small bug: the images property of catalog.json is incorrect (is usually 0, but I might have seen it 1 or something like that, though it's not certain).

For example, see the "Moderation" thread on 8ch.net:
https://8ch.net/leftypol/index.html

Screenshot:
image

The API for catalog.json returns images: 0.

Screenshot:

image

According to the docs: https://github.com/vichan-devel/vichan-API

attribute value description possible values example value
images integer # images total 0-99999 132

Clearly 0 is not # images total in this case because omitted_images is about 100 still images is 0.

The workaround I'm using is displaying omitted_images instead of images and it seems to be ok.

The same bug is present on kohlchan.net.
kohlchan.net is running on vichan, so I reported this issue in vichan repo too.

Transifex

There is a problem with the transifex project: some features are missing (every translated board misses the "click to expand" function to see a whole thread in the index page) and the lines in javascript.po and tinyboard.po are out dated - most of the newest lines are missing and there are lots unused now.

I will accept pull requests for transifex related issues, but I wont be maintaining them myself. Anybody want to volunteer to maintain transifex issues?

Error ban users

I think all IPs are in hash, i can't ban or view log, is that fork right or is something wrong?

Database error

When installing by the instruction, trying to open mod.php, I get "The database is returned an error while processing your request. Please try again later. ". There is nothing in the /mysql/error.log file.

Is there an option to disable any spam checks?

Hello, I have not try OpenIB yet, sorry, I just discovered this board, from the vichan. My main question here is about spam checks. vichan has no option (or extremely unclear and still not fully working) to disable any spam checks, on my current boards from vichan all the time users having problem with Spam checks with message: "you post look automated and declared", I really want to migrate from there to OpenIB but I have to make sure there are many options to remove any spam check or leave them only for humans, with some basic clicks.

Thank you.

extra_files = [ [] ]

/pol/catalog.json

{
	"no": 13414211,
	"com": "<p class=\"body-line ltr \">I can't stand the amount of fucking Russian cunts on /pol/.  They're utterly the JIDF and Obama shills on steroids using methamphetamines.  The Ruskies have all these fucked up traits.  </p><p class=\"body-line empty \"></p><p class=\"body-line ltr \">-Get Americans to rebel against America, effectively destroying ourselves from the inside out</p><p class=\"body-line ltr \">-Balkanize the world</p><p class=\"body-line ltr \">-Larp as Aryans despite being Slav-shits who historically got their asses kicked or invaded by Aryans</p><p class=\"body-line ltr \">-Pretending to be a Christian nation while supporting atheism and LARPaganism</p><p class=\"body-line ltr \">-Label every Conspiracy against America while keeping their blatant evils swept under a rug by playing victim</p><p class=\"body-line ltr \">-Accuse all opponents of being NSA, FBI, JIDF, non white, etc</p><p class=\"body-line empty \"></p><p class=\"body-line ltr \">Then there's the fact that Russia has been the biggest Kabbalist puppet in world history yet will promptly label anyone against their bullshit as a \"Jew shill\".  </p><p class=\"body-line empty \"></p><p class=\"body-line ltr \">Is there anyone else who can't stand these fucks?  Also anti-Russian thread general.</p>",
	"name": "Anonymous",
	"time": 1561011764,
	"omitted_posts": 312,
	"omitted_images": 109,
	"replies": 317,
	"images": 8,
	"sticky": 0,
	"locked": 0,
	"cyclical": "0",
	"bumplocked": "1",
	"last_modified": 1561083098,
	"id": "4b7570",
	"tn_h": 170,
	"tn_w": 255,
	"h": 771,
	"w": 1156,
	"fsize": 1696585,
	"filename": "red dawn",
	"ext": ".png",
	"tim": "fad4125911f16a6340219f00ab5b546a90e568523ec3a7d686fb9e20cb90b980",
	"fpath": 1,
	"spoiler": 0,
	"md5": "ms5k6G1Wjgt+EV5VxBsp7Q==",
	"extra_files": [
		[]
	],
	"resto": 0
}

Sql Extraction

SQL queries should not be inlined. It is best if they are put into a centralized SQL file that can be easily managed and maintained.

rewrite bans.php for hashed IP

Need to rewrite bans.php to work for hashed IP.

Will need to add a new column in the posts table for storing hashed /16 of each IP address. Bans.php will check the user's hashed IP and hashed /16 against bans stored on the DB. Since the majority of work is being done by the hashing algorithm we should be able to slim down a lot of the functions in bans.php. Might even improve ban speed overall.

Range bans will be limited to /16 for now and it is up for debate whether to include more types of range bans in the future.

Flags and API

As of now, if I'm not wrong, flags aren't displayed in the API, even though I found something in the code that mentions flags: https://github.com/OpenIB/OpenIB/blob/master/inc/api.php#116

My php isn't that good, and I don't really have the time to backtrace where the function is getting it's variables from, but I wanted to ask if it would be possible to include non-country flags within the API (or at least on 8ch.net)?

API: File objects need thumbnail file extension exposed

Thumbnails occasionally have differing file extensions than the originating file. While it appears 8ch currently uses thumbnails with the same extension and type as the originating file (and .jpg when webm/mp4/etc), it appears config was changed in the distant past, and there are posts on many slower boards where the thumbnail extension is forced to JPG.

Therefore, it'd be nice if thumb_ext for each file was exposed. Right now, my bot is making up to two HTTP requests trying to bruteforce the file extension when the usual rules fail, and this is an undesirable, hacky solution.

Reporter accounts can access the [B&D*] and [B&D+] options

Haven't tested if these functions worked out of not wanting to accidentally damage a board, but when creating a Reporter account, the mod.php pages for it shows these options.

Even if it doesn't do anything, it shouldn't show these options to them.

PHP Fatal error: Uncaught exception 'Twig_Error_Loader' with message

PHP Fatal error: Uncaught exception 'Twig_Error_Loader' with message 'The "" directory does not exist.' in /var/www/OpenIB/inc/lib/Twig/Loader/Filesystem.php:93\nStack trace:\n#0 /var/www/OpenIB/inc/lib/Twig/Loader/Filesystem.php(75): Twig_Loader_Filesystem->addPath(NULL, '__main__')\n#1 /var/www/OpenIB/inc/template.php(23): Twig_Loader_Filesystem->setPaths(NULL)\n#2 /var/www/OpenIB/inc/template.php(42): load_twig()\n#3 /var/www/OpenIB/inc/display.php(115): Element('error.html', Array)\n#4 /var/www/OpenIB/inc/functions.php(351): error('Caught fatal er...', 3)\n#5 [internal function]: fatal_error_handler()\n#6 {main}\n thrown in /var/www/OpenIB/inc/lib/Twig/Loader/Filesystem.php on line 93

how can i solve this?

Clarify OpenIB description please...

So what exactly is a "focus on user security" that open ib is supposed to have? Is that to imply that Vichan is not secure and leaks ip or database info? Can you clarify on this in the description? Because yeah, it's the starting point.

Actually open-source?

It seems that features that are added to 8chan which are not reflected in this repo. Is this intended? If so, updating README.md is probably appropriate to reflect this.

RSS feeds shouldnt display stickied posts.

Currently RSS feeds display the sticky posts at the top of the feed (tested at 8chan). This breaks many rss feed notification systems, I guess they think there's no new posts since the top post didn't change.

IP Hashing

Hashing of all IP across the DB is important for the security of our users. We will be implementing an IP hashing patch with a salt that refreshes every X days. This will effectively reset all bans every X days, but we will get a stronger assurance that an entire history of IP cannot be released by any possible hacker or DB leak.

Security and TOR

since this board is focused on security- how well does it work on an onion server? is it useable without javascript?

The new anti-DDoS protection prevents access to JSON API

As 8ch has been rebranded as 8kun, I was migrating my app from the old 8ch.net API urls to the new 8kun.top ones.
But I encountered an issue: the JSON API is now inaccessible.
Instead, it returns the "Vanwa Tech" HTML page.
Does it provide some kind of an HTTP (non-HTML) API to pass the anti-DDoS check?
Otherwise none of the mobile apps would work with the new 8ch.

Looking at the HTML page returned, seems like it generates three (or two) random HEX numbers when serving the page, and the visitor is supposed to intentionally slowly "decrypt" those values and send them as a cookie when retrying the request.
Will such protection even work? Solve the puzzle once and then DDoS the sh*t out of 8kun.top from the same bot machine, having thousands of them in a botnet. Seems like no big deal for a DDoS attacker that doesn't send each new HTTP request from a different machine.

If the DDoS protection still works, perhaps the app is supposed to just execute the code provided in the <script/> tag and set the cookie manually for all subsequent HTTP requests?
If yes, then what about the two <iframe/>s then? Why are they there? Could they be simply ignored? Or are they required to be loaded too to set up some magic? That would be a messy way for iOS/Android apps that operate as HTTP clients, not HTTP browsers.
A clear step-by-step documentation would ease the process.

Screenshot:

image

Request:

GET /https://8kun.top/boards-top20.json HTTP/1.1
Host: chan-chan.herokuapp.com
Connection: keep-alive
Accept: application/json
Origin: http://localhost:1234
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: cors
Accept-Encoding: gzip, deflate, br
Accept-Language: ru,ru-RU;q=0.9,en-US;q=0.8,en;q=0.7

Response:

HTTP/1.1 200 OK
Connection: keep-alive
X-Request-Url: https://8kun.top/boards-top20.json
Server: nginx
Date: Mon, 16 Dec 2019 06:17:06 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Vary: Accept-Encoding
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Content-Encoding: gzip
X-Final-Url: https://8kun.top/boards-top20.json
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: server,date,content-type,transfer-encoding,connection,vary,expires,cache-control,content-encoding,x-final-url,access-control-allow-origin
Via: 1.1 vegur

Response HTML:

<iframe width="0" height="0" frameborder="0" src="https://media.8kun.top/vanwanet-verify"></iframe>
<iframe width="0" height="0" frameborder="0" src="https://sys.8kun.top/vanwanet-verify"></iframe>
<body>
	Verifying your browser, please wait one moment... DDoS Mitigation by VanwaTech
	<script type="text/javascript" src="https://vanwatech.com/aes.js" ></script>
	<script>
  function toNumbers(d) {
    var e = [];
    d.replace(/(..)/g, function(d) {
      e.push(parseInt(d, 16))
    });
    return e
  }

  function toHex() {
    for (var d = [], d = 1 == arguments.length && arguments[0].constructor == Array ? arguments[0] : arguments, e = "", f = 0; f < d.length; f++) e += (16 > d[f] ? "0" : "") + d[f].toString(16);
    return e.toLowerCase()
  }
  var a = toNumbers("ddddbeefeadbeefffadebfeaaaadbeef"),
    b = toNumbers("ddddbeefeadbeefffadebfeaaaadbeef"),
    c = toNumbers("3f8404051c0555959aecb4b59d4c1e53");
  document.cookie = "VanwaNetDDoSMitigation=" + toHex(slowAES.decrypt(c, 2, a, b)) + "; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/";
  location.href = "https://8kun.top/boards-top20.json?VanwaNet-DDoS-Verification-Attempt=1";
</script>
</body>

Some random related article: https://steemit.com/cloudflare/@kopipe/8chan-is-still-using-cloudflare

I can't post with jpg or mp4/webm

i send jpg error message:
The server took too long to submit your post. Your post was probably still submitted. If it wasn't, 8chan might be experiencing issues right now -- please try your post again later. Error information:
{"readyState":4,"responseText":"","status":500,"statusText":"Internal Server Error"}

mp4 and webm error: There was a problem processing your webm.

Is the antibot code still relevant?

The only thing it seems to do is say: this post looks automated when trying to post for anons.
if you set it to true.
or is this code written so that it always needs to stay false?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.