Kudos CMS

ETbyrne · 01-24-2008, 11:28 PM

This is a CMS (Content Management System) I have been working on for a long time. It is sort of like a Social Networking script
but for a small group of people, like a youth group, club, or family.

Check it out for yourself to get a better feel for how it works.
> Official Site
> Live Demo

As for now members can...
- Post comments for other members to see on the Bulletin Board
- Every user has his or her very own wall that they or other members can post on.
- Members can upload photos and create photo album pages.
- Members can't post Announcements (you can turn this on from the admin panel)

It is template driven and has many features like smilies and post formatting. Please tell me what you think.

Please register and post on the forum to give it a little kick start.

> Kudos Support Forums

webtuto · 01-24-2008, 11:57 PM

really nice i like it
but add more plugins

TlcAndres · 01-25-2008, 12:35 AM

Can we have a user/pass to admin area to check out the backend?

ETbyrne · 01-25-2008, 02:31 AM

Nope, sorry can't let anyone demo the admin panel, but I can tell you that it is very easy to use and doesn't have a bunch of pointless settings like a lot of CMS's.

Maybe I'll post a screen shot...

ETbyrne · 01-25-2008, 02:21 PM

Here's a screen of the admin panel:

> http://www.evanbot.com/kudos/img/admincp.png

ETbyrne · 01-27-2008, 02:46 PM

I just released the Kudos version 0.6 and it supports custom plug-ins! :D

Download version 0.6:
> http://www.evanbot.com/kudos/bin/kudos-v0-6.zip

Patch for version 0.5 users:
> http://www.evanbot.com/kudos/bin/patch-v0-6.zip

I'll make a short "hello world" plug-in tutorial soon and show you all how easy it is to make a plug-in. And to install plug-ins is really easy, just upload the folder and it works!

richardm · 02-21-2008, 07:18 AM

It looks nice and simple. Very clean and crisp.

Do you have plans to make the project into something like Joomla with a file repository?

ETbyrne · 03-19-2008, 03:32 PM

I just released version 0.7, you should give it a try.

> Kudos Content Management System (CMS)

@richardm: I don't have any plans to add a file repository to Kudos, but it could be easily added on as a Plug-in.

Haris · 03-19-2008, 05:38 PM

As a open-source developer, it will be really easy to maintain your code if you use version controlling system. I recommend SVN.

ETbyrne · 03-20-2008, 04:26 PM

There's no point to add a fancy version control system, updating is as easy as uploading files. Why complicate it?

Haris · 03-20-2008, 05:05 PM

Quote:

Originally Posted by ETbyrne

There's no point to add a fancy version control system, updating is as easy as uploading files. Why complicate it?

You're under-estimating the power of version controlling system. You'll regret your decision when CMS might grow from 78 files to 586 files. VCS is not equal to uploading files.

ETbyrne · 03-21-2008, 02:59 AM

So, what are the advantages of using SVN? I still have no clue what SVN even does. From the SVN home page it looks like just something for managing files and folders. It also sounds a little on the heavy side, something that Kudos is aimed at not being. Plus it's all binary and has OS specific releases, that means my users would have to have to be on a certain OS to run my CMS and - correct me if I'm wrong - you would have to have direct access to the server to install it.

sketchMedia · 04-06-2008, 02:14 PM

been using CVS at work for ages (were just switiching to SVN atm)
it allows you to roll back changes if they go tits up and also its helpful if you have more than one developer working there are more benifits aswell.

ETbyrne · 04-06-2008, 05:01 PM

Sounds like it would be a good idea for a group of developers to use locally...

autehonker · 04-12-2008, 04:28 PM

Heya man ur scripts have Multiple Cross-Site Scripting Vulnerabilities

PHP Code:


			
------------------- XSS ---------------------

http://www.evanbot.com/kudos/demo/?page=edit_profile_photo&id=[XSS]

http://www.evanbot.com/kudos/demo/?page=search&keywords=[XSS]

http://www.evanbot.com/kudos/demo/?page=edit_profile&id=username[XSRF]

http://www.evanbot.com/kudos/demo/?page=user&id=[XSS]

http://www.evanbot.com/kudos/demo/?page=album&id=[XSS]

http://www.evanbot.com/kudos/demo/?page=post_wall&id=[XSS]

------------------- XSRF ---------------------

<form method='post' action='scripts.php?page=edit_profile&id=username'>

<textarea cols='65' rows='17' name='profile'>[XSRF]</textarea></p>

<input name='email' value='mail@site.com' /></p>

<input type='submit' value='Save' /></form>

The disclosure of these issues has been credited to autehonker of the / Depo2 BugTracker/ReverseEnginnering/Cryptology Development Center | Depo2.Nm.Ru |

Enjoy!

ETbyrne · 04-15-2008, 03:30 PM

I'm not quite sure what you are saying here... More info on what this means?

autehonker · 04-15-2008, 10:22 PM

Quote:

Originally Posted by ETbyrne

I'm not quite sure what you are saying here... More info on what this means?

read that Cross-site scripting - Wikipedia, the free encyclopedia

ETbyrne · 04-16-2008, 03:30 PM

only four of those are a problem:
http://www.evanbot.com/kudos/demo/?p...file_photo&id=[XSS],
Live Kudos CMS Demo[XSRF],
http://www.evanbot.com/kudos/demo/?page=post_wall&id=[XSS], and
http://www.evanbot.com/kudos/demo/?page=album&id=[XSS]

Other than that all the other ones don't do anything at all. I'll fix the problem and release a patch.

NOTE: These will not screw up someone's account, they will only waist disc space. Thanks for the heads up.

freenity · 04-16-2008, 08:11 PM

Quote:

Originally Posted by ETbyrne

only four of those are a problem:
http://www.evanbot.com/kudos/demo/?p...file_photo&id=[XSS],
Live Kudos CMS Demo[XSRF],
http://www.evanbot.com/kudos/demo/?page=post_wall&id=[XSS], and
http://www.evanbot.com/kudos/demo/?page=album&id=[XSS]

Other than that all the other ones don't do anything at all. I'll fix the problem and release a patch.

NOTE: These will not screw up someone's account, they will only waist disc space. Thanks for the heads up.

Using xss vulnerability someone could steel your cookies, possibly getting access to victim's account.
Another thing that can be done, is a popup window, that will show attackers page, or even a redirect :S

ETbyrne · 04-17-2008, 03:33 PM

These are just disc space wasters. I will release a patch when I get back from my comp this weekend.