This is primarily a security update due to PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Have not touched this source code since last week, so it is primarily server maintenance at this point.
0 Comments
Three weeks this time... the previous post...
* header.php, user/profile.php: Trying to access array on null and Undefined variable PHP warnings dirty fix for trying to access nonexistent or formerly existing user profiles
* viewuser.php: Additional checks added for nonexistent and formerly existing users... also for UID 0, which should never exist
* viewstory.php: very old $priner typo fix
* admin/blocks.php: remove original variable fix as the issue was actually at blocks/menu/menu.php
- this also broke variables.php viewing so needed removing anyway
* browse/class.php: Uncaught TypeError in PHP 8 with visiting a classification type that has no classifications listed
- also Undefined array key, Trying to access array offset on null, and another Uncaught TypeError [fixes]
* browse/categories.php, browse/ratings.php: Add 'no results' message for empty results
* includes/mysqli_functions.php: add set_charset to query - security-related
- and fix a self-caused copy-paste oversight with it
* Collation change in classifications sorting/handling
* various block directories' admin.php files: formatting changes
* various block directories' init.php files: SQL engine change and consistency fixes
* includes/load-bearing.php: Fix amusing misspelling of the word variable [was spelled 'Varaible' in seven places]
* more general cleanup in various parts of the script - usually forgotten error suppression hacks someone added some time ago and odd hardcoded stuff I added in places
0 Comments
Not much to report otherwise. Though, I would have compiled it and installed it yesterday, but I got very sidetracked with another project...
---
Okay... the project is eFiction 3 Mod running with the PostgreSQL database. I actually got it partially working, surprisingly enough. The Archive Conversion page link is quite useless in this case and will have to be removed. Counts do not work properly, and some PHP files have not been patched for PostgreSQL-specific querying yet.
Some code still assumes old MySQL behavior (i.e., boolean stuff is always coded as hard numbers for MySQL use, which will need a bit of a rewrite for PostgreSQL use - I had to change some fields to SMALLINT for now until I tweak it for BOOLEAN...).
...It is just for some fun and experimentation and should not be used, actually, and MySQL/MariaDB is recommended for this script.
0 Comments
From eFiction 1.0 to 3.5.3, timestamps have been stored using the datetime data type with the server's set time zone's data (and not UTC 0). They would be parsed through eFiction itself using MySQL/MariaDB's UNIX_TIMESTAMP() and would be inserted as datetime with the reference of now() .
Note: UNIX_TIMESTAMP() always references them in UTC then the system converts that back to local time...
From eFiction 3.5.5 on, a structural upgrade has changed how timestamps are stored, from the datetime data type to an int(10) data type and the existing datetime values are converted to the actual Unix timestamp. The UNIX_TIMESTAMP() references as a result are removed. The now() references were also replaced with time() .
Upgrading from 3.5.3 to 3.5.5 should convert the stored datetime values properly... as long as the server's hardware was set with UTC in mind and the server's time zone was never changed in any way before conversion. Normally, you'd think of the timestamp data type (yes, there is another one)... but there are limitations, which are mentioned later here.
The current methods in version 3.5.5 and newer are a more proper way to store and read timestamps with MySQL/MariaDB since its datetime data type can go to year 9999, but does not even store time zone values. There is also the issue of the timestamp data type handling on older MySQL/MariaDB database server versions... you can store the Unix timestamp in human-readable format (in UTC, of course) with this data type, but those values (predictably) end at the signed 32-bit Unix epoch, or the Year 2038 problem, especially if using the 32-bit releases. Going past the signed 32-bit Unix epoch limit with those older database versions results in a null value, hence eFiction's historical use of the datetime data type, despite its own limitations.
As for the timestamp data type now... Newer MariaDB server versions now use an unsigned 32-bit value, so the limit goes to the next century instead, around the year 2106 — this is to not cause issues with timestamp data on existing databases; and newer MySQL server versions now use a signed 64-bit value, so the limit goes to ~292 billion years from point 0 of the Unix epoch. However, older database server versions are still running in production to this day, which will eventually cause issues when using the timestamp data type.
...You can now see why eFiction 3.5.5 and newer store timestamps as a Unix timestamp using an int(10) data type and parsed through eFiction itself with time() .
0 Comments
...from Ubuntu Server 24.04.5 LTS to 26.04.1 LTS.
Also...
* PHP 5.6.40 and 7.4.33 had to be community-patched in order to compile at all for the 26.04 environment
- PHP 7.4.33 is properly patched for gcc/g++/cpp 15, but PHP 5.6.40 was very hack-patched by me in order for it to compile with 15 (I would not trust that, lol - also I used some errors-to-warnings flags as well...)
* PHP 5.6.40 is barely used on the server, only two or three vintage projects use it at all
* PHP 7.4.33 is still set globally for projects
* PHP 8.5.11 and PHP 8.6.0RC2 needed to be recompiled
* All C-adjacent compilers were to be changed back to gcc/g++/cpp 13 from 15 - far into the future, I would use 15
- Also found out that early major PHP 8 versions without modifications fail to compile; I think PHP 8.4 may be the earliest version that compiles with gcc/g++/cpp 15
* libicu/icu4c needed to be source-compiled because the system version was built against gcc/g++/cpp 15, and the environment uses 13
* Apache httpd and Apache apr-util were updated (security)
0 Comments
Turning out nicely, yes.
Remember this post... regarding this archive being near production use?
Funny to find so many bugs, typos, and assumptions in this codebase since that news post ~13 days prior, lol.
Why PHP 8.6.0RC2? This is why: Blog: No PHP 8.6.0RC1
0 Comments
Been a while since I made such a post... two weeks! ...yes, it was a lot.
Following this post, and the one before...
* forgotten coauthors reverts in reviews.php and includes/storyblock.php, amongst other coauthors fixes and reverts (the unofficial eFiction 3.5.7 changes would break legacy modules like DisplayWord and ePubVersion)
* Action Admin Log file had values hardcoded to English, so those were moved to languages/en_admin.php language file
* New Archive Conversion page! (Mod only)
* install/install.php: general cleanup due to recent changes
* default_tpls/listings.tpl: Completed and Word Count/Read Count separation fix/change
* admin/links.php: formatting changes
* includes/dbfunctions.php include moved back to config.php, otherwise it breaks legacy modules like DisplayWord and ePubVersion
* includes/userlist.php: Uncaught TypeError if you attempt to search for a nonexistent Co-Author when creating a story fix - discovered entirely by accident by hitting a stray key on my laptop keyboard... the backtick/tilde key!
* tinyMCE inits fix - missing HTML entity encoding setting clobbers special characters in textareas... notably stories, comments, and reviews
* browse/ratings.php: Uncaught TypeError when browsing the Ratings section with no ratings listed/present and Undefined variable ratingslist fixes
* user/register.php: Admins can now check the page when editing the dynamic fields without having to re-enable the Registrations feature (Mod only)
* user/manageimages.php: Add WebP support
* dumb Manage Favorites 'fix': collation issue (binary -> text) [Mod only]
* languages/en.php: Various Undefined variable PHP warnings fix - new includes/load-bearing.php file exists now
* error suppression removal in various pages, as the underlying languages/en.php issue was fixed
* admin/settings.php: Do not parse the mailer directory in Settings > Language selection drop-down menu
* search.php: MySQL error message overwriting the Search Results header when searching for a nonexistent penname fix
* reviews.php, includes/reviewform.php, includes/seriesreviews.php: Number of Likes functionality - implement entirely missing calculation functions in various parts of the script and fix oversights
* blocks/menu/menu.php: Array to string conversion PHP warning fix (fixes my menu2 block mod as well)
* admin/panels.php: Trying to access offset array on null PHP warnings fixes
* languages/en.php: Uncaught ValueError: Unknown format specifier "'" in _LOG_ADMIN_EDIT_AUTHOR fix due to a very old easily missed editing typo from 2010, which is why this constant and its definition was not used in eFiction 3.5.3 specifically (the usernames were originally reversed in the log until 3.5.3, lol) - this specifically was to be used for logging changing authors in stories' entries - someone who released eFiction 3.5.5 did not catch this, either, so this was also not fixed for nearly a decade after that release
* admin/backup_utf8.php: double encoding of UTF-8 database dump fix - it was doing ISO-8859-1 -> UTF-8 -> ISO-8859-1 [Also found out 2026/09/20 that neither the original backup.php nor the backup_utf8.php scripts handle binary data stored in BLOB or BINARY or VARBINARY storage properly, so you are better off using phpMyAdmin or some equivalent anyway]
* header.php, viewstory.php: Undefined variable PHP warning if viewstory.php is ever accessed directly fix
* reviews.php: Trying to access array offset on null PHP warning dirty fix and prevent anyone from trying to create reviews to nonexistent/null stories/series fix
* viewseries.php: Add check for nonexistent/null series just like the viewstory.php page - if not present, PHP warnings regarding null references appear
0 Comments
Primarily for sorting and counting purposes (some story entries use it as well), but everything else uses the binary form of UTF-8.
Never tested emoji yet, but they should work...
Doesn't work, even directly through the database. Someday, I will figure out why.
Update 2026/09/18: EMOJIS NOW WORK! It was database setting related. 😁👍
MariaDB: 10.6 to 11.4: old-mode explicitly needs to be empty due to old-mode mapped to utf8_is_utf8mb3 by default, so: 'old-mode = '
MariaDB: 11.8 and newer: Nothing to do; character_set_system will be mapped to utf8mb4, overriding old-mode.
Update 2026/09/19: There's actually a one-line change you can make in includes/mysqli_functions.php. I added it to the file so you can comment and uncomment which one you want.
Original line:
mysqli_query($mysqli_access, "SET NAMES UTF8;");
Added line (commented out by default):
mysqli_query($mysqli_access, "SET NAMES UTF8MB4;");
UTF8MB4 supports emojis and other multibyte characters that UTF8 (mb3) cannot.
Another line (should be uncommented if UTF8MB4 is also used):
mysqli_query($mysqli_access, "SET collation_connection = utf8mb4_bin;");
3 Comments
Last Updated: 2026/09/28
Module Status
Display Word: Fully Functional
Download - PHP 7.x and 8.x: http://cwcyrix.nsupdate.info/efiction-info/downloads/modules/3.x/displayword-1.9.zip
Download - PHP 5.x: http://cwcyrix.nsupdate.info/efiction-info/downloads/modules/3.x/displayword-1.9-php5.zip
Notes: Needed some patching for PHP 8.x and for somewhat broken co-authors data retrieval. As a result, I got the co-authors in filename behavior working along with the co-authors behavior in the document itself! Version 1.6 should be definitive now.
Update 2026/09/19: Version 1.7 released: the storyblock link only yanks one chapter when linked at the table of contents. This is a very old oversight. Discovered that when modding it to make it more prominent on the site.
Update 2026/09/23: Version 1.8 released: Properly fixed the table of contents/storyindex discrepancy.
Update 2026/09/28: Version 1.9 released: Fixed uninstall.php Uncaught TypeError due to nonexistent constant.
ePubVersion: Near Fully Functional
Notes: Needed patching for PHP 8.x. Installer needed to use Version 1.2 behavior. Fixed the Array to string conversion warning in epubversion.php and Undefined property warning in EPub.php. The cover_img.php and image_support.php files had deprecated strtolower() use, so patched as well. The manage.php file was broken, but caught this one early! The dynban.php file was the very first one fully fixed... or so I thought. [Such dynamic banner use does not work in the .epub file, so the image remains broken. The file itself does render font and background, however.] Also upgraded the ePub class to last known 2.x version as a test, and it works there as well. Cover art, when enabled, is generated twice in the document. A blank page is inserted at the end of the document. The cover art one may be a bug (found out not), but the blank page one may be intentional.
Added a recent ePub logo to this module, which is now deployed to this testing archive CMS. Found out the Epub.php class file uses deprecated each(), but the code still functions in PHP 8... Fixed story link oversight, which also plagued Display Word. Properly fixed story link oversight on 2026/09/23. Fixed generating ePub books when no cover image is chosen or no image support is even enabled on 2026/09/25, meaning all earlier releases are obsolete. Fixed uninstall.php Uncaught TypeError due to not including its own language file path on 2026/09/28.
0 Comments
This archive seems to be near production ready, as I have fixed some egregious issues that would have prevented eFiction 3 Mod from being compatible with future PHP 9.0.
Not so important issues:
* tinyMCE 4 and newer make the characters selection form's top entry (usually the None entry as the id for it doesn't exist) disappear after adding a category. However, previewing a story makes it reappear.
* tinyMCE 6 and newer render the enable/disable toggles in the Admin Panel useless... along with the previously mentioned issue...
0 Comments
This tinyMCE version is the last version that works fully on eFiction 3. Anything later has bugs with the admin panel's tinyMCE toggles.
However, I kept the later release on the install just to try and fix the issue... someday.
0 Comments
Last Updated: 2026/10/13
The following:
* database: latin1 -> utf8mb4 (efiction3-mod only)
* passwords: md5 -> bcrypt (efiction3-mod only)
* additional tinyMCE versions (efiction3-mod only)
* disable new user registrations option (efiction3-mod only)
* Number of Likes ratings fixes - this includes the definition conflict and calculation oversights
* Various installer fixes
* Layout changes and fixes in various parts of the script
* Some general cleanup
* coauthors array handling fixes - mostly reverting some changes in reviews.php, stories.php, viewstory.php, includes/corefunctions.php, includes/storyblock.php, includes/storyform.php, user/revres.php - then fixing it proper
- this also mostly fixes the old displayword module - which needed its own fixes)
* additional checks in various parts of the script: reviews.php, viewseries.php, viewuser.php
* PHP 8.x Uncaught TypeError fixes: admin/categories.php, browse/class.php, browse/ratings.php, includes/corefunctions.php, includes/userlist.php
* PHP 8.x Uncaught ValueError fixes: languages/en.php
* PHP 8.x Warning fixes: header.php, reviews.php, series.php, viewseries.php, viewstory.php, admin/panels.php, admin/settings.php, blocks/menu/menu.php, browse/class.php, browse/ratings.php, includes/corefunctions.php, languages/en.php, user/profile.php, user/revres.php
* includes/dbfunctions.php fixes and cleanup
* error and warning message suppression hacks removed - language PHP file parsing fix due to undefined variables going nowhere
* possible CHARSET breakage in various spots - revert and fix
* GD captcha font handling fix for PHP 8.6.x/GD 2.4.0 users
* old $printer typo fix in viewstory.php
0 Comments
Found more bugs, and some changes:
* PHP warnings in series.php
* GD captcha font handling broken for GD 2.4.0 libraries (incidentally, a PHP 8.6 issue using bundled GD as well)
* Resized that same captcha for today's screen resolutions
0 Comments
Finally fixed the various PHP warnings for this archive.
Should be near ready...
0 Comments
Well, PHP 8.6.0 is updated again, and this archive is running fine so far.
0 Comments
Interesting that this never existed as an option before. You had to actually remove the file and remove the entry from your eFiction install in order to truly disable new user registration.
This setting is in action on this very archive, because no one should try to register to a demo archive... but I will create a manual writeup to enable it on your own archive after this is pushed to the efiction3-mod repository.
For the record, this setting is located in Admin > Settings > Site Settings under Enable New User Registrations. Quite straightforward.
0 Comments
tinyMCE 6, specifically version 6.8.6, is added to the tinyMCE set for this archive.
This should be the last version added to the set. Version 5 is of course skipped. Newer versions should work with it, but that is up to the admins of those archives.
0 Comments
PHP 8.6.0 is now in Beta! This archive is a development area anyway.
Seems there are no issues with using this version with this archive so far.
0 Comments
This test archive is being tested for issues that may crop up while running this development release.
No production build should run such versions. But, since this is a test setup, it's fine. I can still roll back to PHP 8.5.
0 Comments
This one is running tinyMCE 4.5.12 for the newest selection, but 6.8.3 is running perfectly on the /eee/ test install script setup!
0 Comments
This time, I am testing tinyMCE 3.4.9.x!
Ami Sapphire
CW Cyrix
2 Comments
The versions of tinyMCE 3 and 4 have been upgraded to the following:
Version 3: 3.4.8 -> 3.4.9.x (technically patched 3.4.9 - bugfixes)
Version 4: 4.5.3 -> 4.5.12 (bugfixes and patched security issues)
Currently testing version 4.5.12 - and not deploying this to git... not yet, anyway.
0 Comments