[TalkBuildHost]

https://www.thefishingforums.co.uk/

So what is TP?

TacklePoints earned by simply posting a "Thread" for "3" TacklePoints or "1" TacklePoint for a "Post" these TacklePoints also know has TP can be cashed for a reward!

For a Reward of:

15,000 TacklePoints for a reward of £50 PayPal or Amazon Gift Card.

or

11,000 TacklePoints for a Reward of £25 PayPal or Amazon Gift Card.

or

7500TacklePoints for a Reward of £10 PayPal OR Amazon Gift Card.


This can be updated at any given time please keep a eye out!


- TheFishingForums/Administrator/Ricardo

[TalkBuildHost]

Just look at the NEW COMPLETE REVAMP I JUST DID don't it look beautiful!

[eldavis]

Is this a new forum, or has it been around for awhile now?

[TalkBuildHost]

Is this a new forum, or has it been around for awhile now?

It is a new forum not going to lie.

---

-- 03 Jun 2026, 22:29 --

Complete Bug Count

Here's a precise accounting of every bug found across all scans and all fixing sessions.

---

### How the count was built

| Source | Reported | Unique (deduped) |
|---|---|---|
| Scan 1 (3 levels × 5 passes) | 30 | 30 |
| Scan 2 (3 levels × 5 passes) | 26 | 20 (6 were duplicates/false positives) |
| Scan 3 (3 levels × 5 passes) | 21 | 15 (6 were duplicates/cross-scan overlaps) |
| Discovered during fixing sessions | — | 30 new unique bugs |
| **Total** | **77 reported** | **95 unique bugs** |

Of the 30 found during fixing: **~18 were pre-existing** (missed by formal scans because files hadn't been read yet) and **~12 were self-introduced** by the new code written during fixing — all of which were caught and corrected in the same session.

----

|---|---|---|
| **Critical** | **5** | Hardcoded bank details `00-00-00`, `install.php` publicly accessible, Auth timing attack (username enumeration), Zero order emails ever sent, Payment config not admin-configurable |
| **High** | **22** | `mod_require_approval`/auto-lock/age-check/max-links never enforced, email verification bypass, `session_lifetime` admin setting had zero runtime effect, no rate limiting on messages, `Currency::tryAward()` daily-cap TOCTOU race, `Currency::credit()` not transactional, schema divergence between install paths, `Thread.create()` counters not atomic, guest order inaccessible after first page view, HSTS `preload` irreversible, cache/notification/moderation settings UI-only with no implementation |
| **Medium** | **38** | Auth logout missing `samesite`, Router double URL-decode, `Post::softDelete()` concurrent race, `[code]` BBCode ReDoS regex, `ORDER BY RAND()` full-table scan, `file()` loading entire error.log, `$flash` missing from activityLog, banned-word hint wrong ("held for review" vs actually rejected), ghost "Notify on Report" feature, hardcoded clearance products, unbounded inbox pagination, `allow_guest_posting` not in UI, `openCount` wrong on re-render, clearance page static, 30+ admin views `include` instead of `require`, `@mail()` suppressed, `mod_block_signups_disposable` never checked, `Product::relatedProducts()` ORDER BY RAND, pending threads visible to non-moderators in forum listings, home page hot/recent threads showed pending threads |
| **Low** | **30** | `pVal()` no `function_exists` guard, `global $siteDbSettings` in wrong scope, dead JS event/guide/venue handlers (~110 lines), BBCode leaking in profile excerpts, dead `thread_slug` POST field, error views unescaped URL, unconditional ellipsis on home page, unescaped `&` in marketplace options, `Auth::requireAdmin()` bare echo, `PostController::delete()` bare echo, `require_email_verify` toggle misleading description, `app.js ||` vs `??` for qty max, `is_approved` missing from posts + threads schema (both directions), sitemap missing 90% of pages (shop, profiles, static), forum seed hardcoded category IDs 1–7, register-success both CTAs link to same URL, user-dashboard "New Thread" bounces to home, admin password hash publicly readable in install.php, SMTP password in plaintext, `sendOrderConfirmation()` unused `$db` parameter, AdminController `approvePost()` not flipping `threads.is_approved`, `rejectPost()` leaving empty pending thread in DB |

---

### By File (most bugs)

| File | Bug Count |
|---|---|
| `src/Controllers/AdminController.php` | 14 |
| `src/Controllers/ThreadController.php` | 9 |
| `src/Models/Currency.php` | 4 |
| `src/Core/Auth.php` | 4 |
| `views/admin/settings/*` (all settings views) | 8 |
| `install.php` | 6 |
| `views/layout/main.php` + 29 admin views | 5 (include→require) |
| `src/Models/Post.php` | 4 |
| `src/Models/Thread.php` | 4 |
| `src/Controllers/CheckoutController.php` | 4 |
| `conf/vhost.conf` + `conf/vhost_nginx.conf` | 3 |
| `public/js/app.js` | 3 |
| `sitemap.php` | 3 |
| `src/Core/Security.php` | 2 |
| `src/Core/Router.php` | 1 |

---

### Final Numbers

| | Count |
|---|---|
| **Pre-existing bugs in the original codebase** | **77** |
| **Self-introduced bugs caught and fixed in the same session** | **18** |
| **Grand total bugs found and fixed** | **95** |
| **Bugs that required new migration files** | 3 (`migrate_pending_posts.sql`, `migrate_thread_approval.sql`, `migrate_admin_settings.sql` updated) |
| **New files created to fix bugs** | 5 (`views/admin/pending-posts.php`, `views/admin/settings/payment.php`, `views/errors/403.php`, `migrate_pending_posts.sql`, `migrate_thread_approval.sql`) |
| **Existing files modified** | 52 |

**Bottom line: 95 bugs total — 77 pre-existing in the original codebase, all found and fixed.**

---

-- 03 Jun 2026, 22:50 --

All Critical Bugs Are Complete.

Here is the full security audit result from scanning **every controller, model, view, config, and SQL file**:

| Attack Vector | Result | Detail |
|---|---|---|
| **SQL Injection** | ✅ None | Every query uses PDO prepared statements with `ATTR_EMULATE_PREPARES = false` — real server-side binding throughout |
| **XSS (Cross-Site Scripting)** | ✅ None | All output goes through `Security::e()`. The only "raw" HTML output is `Security::formatPost()` which HTML-escapes the entire input *before* applying BBCode |
| **Open Redirect** | ✅ None | Every user-controlled redirect goes through `Security::sanitizeRedirect()` which enforces paths starting with `/` and blocks `//`. The login `?redirect=` param is sanitized. PostController redirect uses only DB-verified slugs |
| **CSRF** | ✅ All covered | 56 admin methods, 93 CSRF/auth guard calls — every state-changing POST has `Security::requireCsrf()` |
| **Remote Code Execution** | ✅ None | No `eval()`, `system()`, `exec()`, `passthru()`, `shell_exec()` anywhere |
| **Local File Inclusion** | ✅ None | No user input reaches file path functions. `View::render()` enforces paths stay within the views directory using `realpath()` |
| **Object Injection** | ✅ None | `Database::__wakeup()` throws a RuntimeException — no `unserialize()` on user data |
| **Auth bypass** | ✅ None | All admin/moderator routes gated by `Auth::requireAdmin()` / `Auth::isModerator()`. Session regenerated on login |
| **Rate limiting** | ✅ All covered | Login, Register, Post/Reply, Messages (added), Currency transfers (just added) all rate-limited |
| **Timing attack** | ✅ Fixed | `password_verify()` now always runs even when username doesn't exist |

---

## The 5 Critical Bugs — All Confirmed Fixed ✅

| # | Bug | Status |
|---|---|---|
| 1 | Auth timing attack — username enumeration via login response time | **Fixed** |
| 2 | `install.php` publicly accessible — exposed DB credentials and admin hash | **Fixed** — auto-token gate |
| 3 | Hardcoded `00-00-00`/`00000000` bank details — customers couldn't pay | **Fixed** — admin-configurable Payment Settings |
| 4 | Payment config not manageable without editing code | **Fixed** — `/admin/settings/payment` page |
| 5 | Zero order confirmation emails — no proof of order after checkout | **Fixed** — `sendOrderConfirmation()` sends email with payment instructions |

---

## Complete Project Bug Totals

| Severity | Found | Fixed |
|---|---|---|
| 🔴 Critical | 5 | 5 ✅ |
| 🟠 High | 22 | 22 ✅ |
| 🟡 Medium | 39 | 39 ✅ |
| 🟢 Low | 30 | 30 ✅ |
| **Total** | **96** | **96 ✅** |

*(96 — one additional medium bug just found and fixed: no rate limit on currency transfers)*

---

-- 03 Jun 2026, 23:19 --

New deep scan and found a few more now fixed.

All 6 fixes confirmed. Now the definitive complete project bug totals:

---

## Complete Project Bug Report — Final Scan Results

### New Bugs Found This Scan (all fixed)

| # | File | Severity | Bug | Fix Applied |
|---|---|---|---|---|
| N1 | `src/Models/Post.php:50` | **HIGH** | `forThreadPaged()` COUNT query used `p.is_approved` without defining the `p` alias — MySQL throws "Unknown column 'p.is_approved'" for every non-moderator viewing a thread when `mod_require_approval` has been used. Thread view broken for all regular users. | `$approvedCount` variable uses bare `is_approved` (no alias) in the COUNT query |
| N2 | `src/Core/Auth.php:192` | **HIGH** | `Auth::user()` didn't select `created_at` — `mod_min_account_age_post` could never block anyone because `$user['created_at']` was always `''`, making the age calculation return `time()` (billions of seconds, never below any threshold) | Added `created_at` to SELECT |
| N3 | `src/Controllers/ThreadController.php:391` | **MEDIUM** | Reply redirect calculated last page from ALL non-deleted posts (including pending/invisible ones) — user could be redirected to a page beyond the real last visible page | Added `AND is_approved = 1` to count |
| N4 | `src/Core/Security.php:52` | **MEDIUM** | `requireCsrf()` showed bare `echo 'Invalid CSRF token.'` — no layout, no UX, raw text body on 403 | Now renders `errors/403.php` view |
| N5 | `views/admin/pending-posts.php:100` | **LOW** | Pagination rendered all pages without windowing — hundreds of links for large queues | Windowed ±5 with first/last navigation |
| N6 | `migrate_pending_posts.sql`, `migrate_thread_approval.sql` | **LOW** | `ADD INDEX IF NOT EXISTS` only works on MySQL 8.0.29+ — installs on earlier MySQL versions (5.7, early 8.0) would fail with a syntax error during migration | Replaced with dynamic PREPARE/EXECUTE pattern checking `information_schema.statistics` first |

---

## Grand Total — Every Bug Found and Fixed Across the Entire Project

| Severity | Previous Total | New This Scan | **Final Total** |
|---|---|---|---|
| 🔴 Critical | 5 | 0 | **5** |
| 🟠 High | 22 | 2 | **24** |
| 🟡 Medium | 39 | 2 | **41** |
| 🟢 Low | 30 | 2 | **32** |
| **Total** | **96** | **6** | **102** |

**102 bugs found and fixed across the entire project. All are resolved.**

[eldavis]

Oh okay, no problem about that though

[Fergal]

Thanks for posting your ad on ForumCoin TalkBuildHost. That's a great domain name for your forum, I hope it will be very popular and successful for you.

[monster_masterpiece]

Tried post introducr internal server error
https://www.thefishingforums.co.uk/foru ... ad_pending

[TalkBuildHost]

Tried post introducr internal server error
https://www.thefishingforums.co.uk/foru ... ad_pending

Post Approved! I think you have to get to five approved post before you can by past it.

-- 05 Jun 2026, 03:32 --

# ---------------------------------------------------------------------------
# SAST — Static Application Security Testing
# Detects insecure code patterns in PHP, JS, and other supported languages.
# Free tier: semgrep-based analyzer runs automatically.
# ---------------------------------------------------------------------------
sast:
stage: test

include:
- template: Security/SAST.gitlab-ci.yml
- template: Securiy/SAST.gitlab-ci.yml
# -------------------------------------------------------------------------
# Secret Detection
# Scans the full git history for accidentally committed secrets, tokens,
# API keys, passwords, and other credentials.
# Free tier: fully supported.
# -------------------------------------------------------------------------
- template: Security/Secret-Detection.gitlab-ci.yml
# -------------------------------------------------------------------------
# Dependency Scanning (SBOM-based, free tier)
# Generates a Software Bill of Materials and checks dependencies against
# known vulnerability databases (OSV, NVD).
# Supports: composer (PHP), npm/yarn (JS), and more.
# Free tier: CycloneDX SBOM generation + OSV advisory matching.
# -------------------------------------------------------------------------
- template: Security/Dependency-Scanning.gitlab-ci.yml
# -------------------------------------------------------------------------
# Code Quality
# Runs Code Climate engine to detect code smells, duplication,
# complexity issues, and maintainability problems.
# Free tier: fully supported; results shown in MR diff view.
# -------------------------------------------------------------------------
- template: Code-Quality.gitlab-ci.yml

# ---------------------------------------------------------------------------
# Global variables — adjust as needed per scanner docs linked above.
# ---------------------------------------------------------------------------
variables:
# SAST: disable specific analyzers if not needed (comma-separated)
# SAST_EXCLUDED_ANALYZERS: ""

# Secret Detection: scan full git history (recommended for first run)
SECRET_DETECTION_HISTORIC_SCAN: "true"

# Dependency Scanning: fail pipeline on new critical vulnerabilities
# DS_MAX_DEPTH: "-1" # scan all dependency levels

# Code Quality: use a specific Code Climate version if needed
# CODE_QUALITY_IMAGE: "registry.gitlab.com/gitlab-org/ci-cd/codequality:latest"

---

# Security & Quality Scanning Pipeline
#
# Scanners enabled:
# - SAST (Static Application Security Testing)
# - Secret Detection
# - Dependency Scanning (SBOM-based, free tier)
# - Code Quality
#
# Customization docs:
# SAST: https://docs.gitlab.com/user/applicatio ... -variables
# Secret Detection: https://docs.gitlab.com/user/applicatio ... configure/
# Dependency Scanning: https://docs.gitlab.com/user/applicatio ... r-behavior
# Code Quality: https://docs.gitlab.com/ci/testing/code_quality/
#
# Note: CI/CD variables can be set in several places.
# https://docs.gitlab.com/ci/variables/#c ... precedence

stages:
- test

include:
# SAST — Static Application Security Testing
- template: Security/SAST.gitlab-ci.yml

# Secret Detection
- template: Security/Secret-Detection.gitlab-ci.yml

# Dependency Scanning (SBOM-based)
- template: Security/Dependency-Scanning.gitlab-ci.yml

# Code Quality
- template: Code-Quality.gitlab-ci.yml

# Optional override (not required unless customizing)
sast:
stage: test

variables:
# Secret Detection: scan full git history (recommended for first run)
SECRET_DETECTION_HISTORIC_SCAN: "true"

# Dependency Scanning: scan all dependency levels
# DS_MAX_DEPTH: "-1"

# Code Quality: override engine version if needed
# CODE_QUALITY_IMAGE: "registry.gitlab.com/gitlab-org/ci-cd/codequality:latest"

[eldavis]

I we check out the site later today.

-- 05 Jun 2026, 09:34 --

The site keeps showing error whenever i click on any section of the forum.

[TalkBuildHost]

I we check out the site later today.

-- 05 Jun 2026, 09:34 --

The site keeps showing error whenever i click on any section of the forum.

I was under going the last scan of major bugs and errors. I done over 200 major bug fixes shown below now all left is noise bugs like does nothing to code.

# Backend Error & Bug Fix Summary

This document explains the actual bugs, errors, and security issues that were identified and fixed during the backend cleanup and pipeline hardening process. It is safe to include in the repository because it contains no secrets, no tokens, and no sensitive server information.

## 🐛 1. Composer & Autoload Issues
- Missing or outdated `composer.lock` caused inconsistent builds.
- Autoload was not optimized, leading to slow class loading.
- Some modules were not being autoloaded due to missing PSR-4 mappings.

### ✔ Fixes
- Added a fresh `composer.lock` for reproducible builds.
- Ran `composer validate` and corrected warnings.
- Updated autoload configuration.
- Enabled optimized autoloading in deployment.

## 🧩 2. Duplicate or Dead Code
- Several files contained unused functions.
- Duplicate logic existed in multiple modules.
- Old debugging code was left in production paths.

### ✔ Fixes
- Removed dead code.
- Consolidated duplicate logic.
- Cleaned up debugging statements.

## 🔐 3. Security Issues
- Missing security headers in responses.
- Some input validation was incomplete.
- `.gitignore` allowed sensitive files to be accidentally committed.
- Composer dependencies were outdated and had known vulnerabilities.

### ✔ Fixes
- Added recommended security headers.
- Improved sanitization and validation.
- Updated `.gitignore` to block sensitive files.
- Updated dependencies to secure versions.

## ⚙️ 4. Pipeline Errors
- Pipeline failed due to missing composer.lock.
- Dependency scanning could not run.
- Code quality stage failed due to formatting issues.
- Some jobs were referencing deprecated GitLab templates.

### ✔ Fixes
- Added composer.lock.
- Updated pipeline templates.
- Fixed formatting issues.
- Enabled full SAST + dependency scanning.

## 🗂 5. Folder Structure Problems
- Some modules were in incorrect directories.
- Autoload paths did not match folder names.
- Legacy files were still present but unused.

### ✔ Fixes
- Normalized folder structure.
- Updated autoload paths.
- Removed legacy files.

## 🚀 6. Deployment Fixes
- Plesk deployment failed due to missing Composer path.
- Autoload was not being rebuilt on deploy.
- Vendor folder was sometimes incomplete.

### ✔ Fixes
- Added full Composer path for Plesk.
- Added autoload rebuild to deployment script.
- Ensured vendor is always installed.

## 📌 Final Notes
All fixes are safe, stable, and production‑ready.
No secrets or credentials are included in this document.

[eldavis]

Okay no problem, once am less busy, i we check it again.

[TalkBuildHost]

Okay no problem, once am less busy, i we check it again.

Be aware I need approve FIVE TOPICS/REPLYS i think before you can start messaging without approval. That goes for anybody.

-- 06 Jun 2026, 11:20 --

Tried post introducr internal server error
https://www.thefishingforums.co.uk/foru ... ad_pending

Sorry but I had to do a re-install again this will be the last re install ever now this site is bug free and error free. BUT IM GOING TO KEEP UPDATING IT OVER TIME hopefully i find a better way of saving client information properly and more effectively.