Mambo CMS

[Demonz]

Any of you web gurus used it before? I am having trouble with my menu alignment on our work website. Its only occurring with the new IE7. Would appreciate some some help to figure it out if you have any ideas.

Cheers,
Grant

[TSM]

If you find open the template_css.css and find the below and change. Hopefully it will work fine.

You also seem to have the class tags on the bit that is wrong set to 'mainlevel-nav' but that CCS ref does not exist. I have not gone though everything, but you are probably having hierarchy problems in your css, unfortunately IE & FF sometimes render differently so its wise to declare your css fully with alignment etc.

table.moduletable td {
font-family: Trebuchet MS, Verdana, Arial, Helvetica, sans-serif;
font-size: 10px;
font-weight: normal;
}

to

table.moduletable td {
font-family: Trebuchet MS, Verdana, Arial, Helvetica, sans-serif;
font-size: 10px;
font-weight: normal;
text-align: left;
}

[Baph]

Please please please tell me that you're not allowing the world & their dog access to a server running Mambo.

PLEASE tell me.

(if you are, it's a bad thing to do btw, just so were clear. If it's private corporate use only, it's not so bad).

EDIT: I've just seen the link in your signature. Oh dear :( Personally, I recommend e107 for CMS work, but so long as you migrate away from Mambo, you stand a better chance of the website being comprimised (yes, mambo is THAT bad).

[timwilky]

I would suggest a CMS swap as well, for a freeby I would recommend Jahia, see http://www.jahia.org/jahia/page712.html

My company used it for some pretty big sites and only abandoned it for commercial (not technical) reasons)

[TSM]

Please please please tell me that you're not allowing the world & their dog access to a server running Mambo.

PLEASE tell me.

(if you are, it's a bad thing to do btw, just so were clear. If it's private corporate use only, it's not so bad).

EDIT: I've just seen the link in your signature. Oh dear :( Personally, I recommend e107 for CMS work, but so long as you migrate away from Mambo, you stand a better chance of the website being comprimised (yes, mambo is THAT bad).

What about Jomla, yes i know its a branch from Mambo but they split branches because of developers annoyed with security risks etc..

I remember you telling me about e107, have not given it a try yet though.

[Baph]

Joomla (not Jomla :P) 1.x has it's problems too.

The latest branch of Joomla was released on 12/25/2006 & the latest publicised vulnerabilities were on 29/12/2006.

The majority of the problems it has a XSS (Cross site scripting), however, the grapevine says that it still has issues with SQL injection that haven't been brought to public attention. At worst, this would probably reveal passwords (remember, encrypted passwords are no longer safe after projects like GData).

So long as your password for Joomla is only for Joomla, and you run it with the usual user level restrictions you should be safe.

As I always do though, if you're worried, run Apache in a jail (assuming *nix server). At least that way, problems are minimised (but even jails aren't a foolproof answer).

[Demonz]

Thanks for the comments - I guess I need to look into the security issues you have highlighted and do some cost benefit analysis. I looked at Joombla a year or so back and havent bothered updating any of our backend server stuff to this - mainly as we have been happy with the template the site was based around.

I guess worst case scenario for business is someone hacks it and deletes some files. Our server is hosted by an outside organisation so I am not concerned about this.

From here its a couple of days to reinstall and get it back online from our backups.

The other option is to learn and install a new system - sort out the templates and put the site together to how it currently is and away I go... I am not sure how long this will take here.

[Jabba]

I use xoops............... :P

[Baph]

I allow Cross Site Scripting, SQL Injection, remote code execution & probably Private Message disclosure............... :P
:shock:

Well, whatever floats your boat I suppose ;)

The Internet aint a safe place to play :)

[Jabba]

I allow Cross Site Scripting, SQL Injection, remote code execution & probably Private Message disclosure............... :P
:shock:

Well, whatever floats your boat I suppose ;)

The Internet aint a safe place to play :)

Depends upon what you install and how you configure it and the server :P

All CMS systems have their issues in this regard.........and phpbb (this site's software) isn't immune either :wink:

[Baph]

Yup, I accept that as fact too. I use e107 because the latest released version only has 1 known unpatched vulnerability.

If you run PHP without magic_quotes_gpc enabled, then you're asking for it to be honest, and the vulberability with e107 requires that it's disabled to even work. Of course, you've also got the option of editing the source in 4 places & magic_quotes_gpc doesn't make any difference :)

The stuff I saw with xoops was the latest branch, standard installation, with no additional features :)

I refuse to comment on phpBB, on a forum using the software.

[Jabba]

The stuff I saw with xoops was the latest branch, standard installation, with no additional features :)

They recommend the installation of a "protector" module, one of which is pretty good and it gives instructions for server configuration. It's updated pretty regularly, too.

There isn't one in the standard install as this might preclude development by others. Fair enough, but people sometimes don't heed the warnings :roll:

I refuse to comment on phpBB, on a forum using the software.

Quite.

I no longer run Forums using it, and now have Forums integrated into the CMS.