Small width layout Medium width layout Maximum width layout Small text Medium text Large text
     Search
Downloads Downloads Directory Directory Forums Forums Forge Forge Blogs Blogs        Marketplace Marketplace Careers Program Careers
Community › Forums Register  |  

Maximum ASP
  Ads  
Aspose - The .NET & Java component publisher
 


  Sponsors  

Meet Our Sponsors

Webhost4life, specialists in DNN hosting
Mad Development is a full service interactive agency focusing on the merge of design, technology, e-commerce, and affiliate marketing by providing total website solutions.
SteadyRain
DataSprings - Great Ideas. Always Flowing.
R2integrated - formerly bi4ce
Jango Studios - Skins, Modules and Hosting for DotNetNuke
 


DotNetNuke Forums
 
  Forum  DotNetNuke® Pro...  FCKeditor Provi...  Hack FCKeditor to upload images (even when NoGallery Toolbar for Role)
Previous Previous
 
Next Next
New Post 2/6/2008 8:53 PM
User is offline Will Gillen
76 posts
10th Ranked


Hack FCKeditor to upload images (even when NoGallery Toolbar for Role) 

I found a hack to be able to browse server / upload documents in FCKEditor in combimation with the DNN forum (but it would also apply to Blog and other modules using the FCKEditor as well).

  1. Login as Admin
  2. Create a DNN Forum, and start a new Thread.
  3. Use "Show custom editor options" of FCKEditor.
  4. Configure the instance so that a role (such as UnAuthenticated Users) only have access to the "No Gallery" toolbar (so the image/flash chooser doesn't show for this role or roles).
  5. Save configuration for the instance.
  6. Logout.
  7. Goto Forum.
  8. Post a new Thread
  9. Notice there is NO image / flash chooser, but there IS the emoticon option.  Insert a simple emoticon.
  10. Right click on the newly inserted emoticon.
  11. Choose Image Properties.
  12. Browse the server, upload files, do as you wish.... 
  13. Congratulations.

Of course, this only works IF the role ALSO has been permitted upload capabilities of the root folder where FCKEditor instance is pointed... but still something to consider.  You can see the problems here if you dig a little bit.  Best case scenario is to ONLY allow the "Basic" toolbar for any role that you don't really trust.

 
New Post 2/6/2008 8:58 PM
User is offline Will Gillen
76 posts
10th Ranked


Re: Hack FCKeditor to upload images (even when NoGallery Toolbar for Role) 

Here's an even better one, you can even browse server with BASIC TOOLBAR (not allowing any images or anything):

  1. Login as Admin
  2. Create a DNN Forum, and start a new Thread.
  3. Use "Show custom editor options" of FCKEditor.
  4. Configure the instance so that a role (such as UnAuthenticated Users) only have access to the "BASIC" toolbar (so almost nothing show for this role or roles except Bold, Italic, etc).
  5. Save configuration for the instance.
  6. Logout.
  7. Goto Forum.
  8. Post a new Thread
  9. Notice there is NO image / flash chooser, no spell check, nothing but Bold, Italic, etc. 
  10. Open another browser window and goto:  http://www.google.com
  11. Highligh the Image "Google" next to the search box.
  12. Copy.
  13. Go back to the Forum posting (FCKEditor).
  14. Paste.
  15. Right click the newly pasted image.
  16. Choose Image Properties.
  17. Browse the server, upload files, do as you wish.... 
  18. Congratulations.
 
New Post 2/6/2008 9:04 PM
User is offline Will Gillen
76 posts
10th Ranked


Re: Hack FCKeditor to upload images (even when NoGallery Toolbar for Role) 

The only way that I can tell to ensure that the users can't browse the server at all is to do this:

  1. Create a sub-folder using Admin > FileManager in your portal root.
  2. Change the permissions so that ONLY Administrators have VIEW access to this folder (don't allow any other roles to have VIEW).
  3. Goto the FCKEditor instance(s) on your site.
  4. use the "Custom Editor options", and point the default folder to that newly created sub-folder (step 2)
  5. Then, if/when someone tries any of the hacks above, it will open the image properties, but if they hit "Browse Server", it will pull up an empty folder without any upload/browsing capabilities.

 

 
New Post 2/6/2008 9:36 PM
User is offline Will Gillen
76 posts
10th Ranked


Re: Hack FCKeditor to upload images (even when NoGallery Toolbar for Role) 

I think the most important thing here, is that if you haven't already done so, you should use the Admin > FileManager and make sure any / all folder that you DON'T want people to have access to INVISIBLE and UNWRITABLE to those roles (such as unauthenticated users)... Just to be safe.

 
Previous Previous
 
Next Next
  Forum  DotNetNuke® Pro...  FCKeditor Provi...  Hack FCKeditor to upload images (even when NoGallery Toolbar for Role)
 


Forum Policy

These Discussion Forums are dedicated to the discussion of the DotNetNuke Web Application Framework.

For the benefit of the community and to protect the integrity of the project, please observe the following posting guidelines:

1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DotNetNuke.
2. Discussion or promotion of DotNetNuke product releases under a different brand name are strictly prohibited.
3. No Flaming or Trolling.
4. No Profanity, Racism, or Prejudice.
5. Site Moderators have the final word on approving/removing a thread or post or comment.
6. English language posting only, please.

 


Glanton: Enterprise Intranet Specialists Using DNN
Glanton Solutions are a premier provider of sevices for large corporates lloking to outsource Intranet sites.
www.glanton.com
Jetkey Smart Map
Smart Map is an AJAX powered Google Map module that displays driving directions, proximity search results and data from your own databases. Smart Map reads GPX (GPS data) files, GeoRSS feeds, and KML data. You can pass any querystring parameter to Smart Map and into your own custom queries to control what data displays on the map.
smartmap.jetkey.com
DNNSpired.com
Inspired to extend DotNetNuke®, everyday.
www.DNNSpired.com

DotNetNuke Corporation   Terms Of Use  Privacy Statement
DotNetNuke®, DNN®, and the DotNetNuke logo are trademarks of DotNetNuke Corporation
Hosted by MaximumASP