LiveJournal Development

Fri, 03 Oct 2008 16:00:14 GMT

I hope this isn't terribly off-topic, it's certainly development work, relating to LJ, and involves the use of a client of sorts, so I feel it's mostly in-keeping with the spirit of the thing..

I have a site that runs alongside an LJ community, and does.. well.. various things. One such thing is that (in theory) the site maintains a list of mappings from LJ username to "real name", which then goes into the community style itself as an associative array and overrides the usernames in comments and entries and displays the users' actual names.

Now in order to get that to work nicely, along with all the other site features, I need to have some means of authenticating users so as not to allow people to update each other's names, which of course would lead to all kinds of fun and games. I've come up with what I think is a decent way of doing that, but I'd really appreciate feedback on a) whether there's a better way and b) whether or not I'm leaving myself open to massive security holes. Because the site itself effectively works as a client, interacting with LJ itself, this would seem to be an appropriate place to ask.

So the site throws up an input box for your username, a hidden input item that contains a randomly generated key, and a submit button. The user is then pointed to a reply page for an entry within the community (opening in a new window), where there are various layout overrides to give it a very specific look and feel. One of those is that an md5 hash of the key is passed via an argument, and displayed on the page with the instruction "Hey, post this string in the box below and hit submit".

Upon submission, obviously the page then returns the user to the EntryPage view, where rather than rendering comments, the page renders 0x0 images which are actually calls to a PHP file on the server, which have arguments with the comment talkid. When the server encounters a new talkid (having saved all previously seen ones), it then fires off an HTTP GET request to that EntryPage, passing the talkid as an argument, along with another argument that tells the page to just return the posted text, and the user who posted it. This is then stored in a database on the site.

So all this is happening as the EntryPage view loads. Once that's loaded, the user is told to close this window and swap back to the form, where they then hit "submit". Upon submission, the site hashes the key that was in the hidden field, and checks the submitted hash and username against existing hashes and usernames held on file from the post. If there's a match, it gives the browser a cookie, and the user is now authenticated.

So the idea is, since only user X can post that hash in the community, and since only user X can possibly know the unhashed key value, then the person who was served the form must be the same person as the one who posted the comment, ergo authentication. Convoluted, I know, but I'm not sure I know how to do "simple"..

I guess my question is, am I missing a really easy trick here? I've thought pretty hard about it, and I think that it's impossible (within reason) to fake your way through the process, because you'd either have to spoof a comment by the desired user, or reverse-engineer the form based on an alreay-posted comment (in which case you'd have to unhash the md5 crap in the comment). So what you end up with, in theory, is a way to validate that a user of your website who says they're user X on LJ actually is user X.

Or is there a huge security hole that I've missed? Any obvious exploits?

Thanks to anybody who took the time to get through all that, I know it's not necessarily the most logical process in the world, and am always open to suggestions for improvement :o)

All feedback / comments / criticism welcome..

livejournal repo trac viewer broken

Sat, 27 Sep 2008 07:14:39 GMT

Hi. The livejournal repository trac viewer is broken. It displays an error with a python traceback right now. (The svn view is unaffected and checkouts/'svn log' work fine.)

...that's it. :)

Force RSS Syndication

Wed, 17 Sep 2008 07:14:03 GMT

Is there anyway to force RSS syndication (that is accounts that are syndicated accounts/journals) for feed that return errors like "Too Big!"?? Or should I clear out the table so it resets it...I would prefer to just force it regardless of how big it is though :)

I think it happened because my server was down for a day or 2 so when it went to go syndicate there were too many items between what was last syndicated and what was available when I brought my server back online.

Thanks - I am MISSING LOLCATS!!!!

Wed, 17 Sep 2008 07:04:27 GMT

Hey, this will sound painfully nubish, but... maybe a get a silver star sticker for effort? I want to download the LJ source to play with, but I'm not quite sure how to get it all in one fel swoop.
(Yeah, I know, if I don't know how to get it I probably have no business messing with it, but hey, one of my favorite ways to learn is to dive in heedlessly.) Is there an archive of the whole thing somewhere, or can I wget it or something? Thanks.

Wed, 17 Sep 2008 06:43:57 GMT

Is there a list somewhere of all the URLs that can be used to pull info from the site? Other than just pulling journal feeds and FOAF data as mentioned in the FAQs?

Wed, 17 Sep 2008 06:30:21 GMT

While developing a custom layer for s2 I came across a strange problem: lj-embed doesn't work. I've looked at other layers, and they don't seem to differ much from my own in the entry presentation code. Any ideas why that happens?

LJ's Jabber Service loses messages sent to an off-line subscriber

Wed, 17 Sep 2008 06:08:10 GMT

I've always suspected that, but yesterday it made me sick completely and I decided to check it with testing: my friend was sending me messages while I was logged out. All of them were lost as it turned out when I logged in.

Success...partially...

Tue, 16 Sep 2008 10:26:14 GMT

I apologize for flooding the queu.
Please disregard my prior posts.

At this juncture, I have succeeded in posting to my LJ using Tickle Text
by using this proc:

################
# post to livejournal...

proc ljpost {} {

global post
global plength
global login
global lurl
global subject
global mood
global tunes
global tags
global year
global mon
global day
global hour
global min
global mood
global tunes
global ptext
global lprops

set subject "subject"
set mood "mood"
set tags "enter, tags, here"
set tunes "music"
set lurl "http://www.livejournal.com/interface/flat:80"

set year [clock format [clock second] -format %Y]
set mon [clock format [clock seconds] -format %m]
set day [clock format [clock seconds] -format %d]
set hour [clock format [clock seconds] -format %H]
set min [clock format [clock seconds] -format %M]

toplevel .lj
wm title .lj "LiveJournal Post"

grid [tk::label .lj.ljname -text "LJ Username:"]\
[tk::entry .lj.uname -textvariable ljname]\
[tk::label .lj.pwd -text "LJ Password:"]\
[tk::entry .lj.pswd -show * -textvariable ljpswrd]

grid [tk::label .lj.date -text "Post time="]\
[tk::label .lj.dato -text "$year $mon $day - $hour : $min"]

grid [tk::label .lj.sujet -text "Subject:"]\
[tk::entry .lj.assunto -textvariable subject]

grid [tk::label .lj.md -text "Current mood:"]\
[tk::entry .lj.mude -textvariable mood]

grid [tk::label .lj.tunages -text "Current music:"]\
[tk::entry .lj.tunez -textvariable tunes]

grid [tk::label .lj.tagz -text "Tags:"]\
[tk::entry .lj.tagit -textvariable tags]

set ptext [.txt.txt get 1.0 {end -1c}]

set login [::http::formatQuery mode login user $::ljname password $::ljpswrd ]
set log [http::geturl $lurl -query $login]

grid [tk::button .lj.go -text "POST" -command {

set post [::http::formatQuery mode postevent auth_method clear user $::ljname password $::ljpswrd subject $::subject year $::year mon $::mon day $::day hour $::hour min $::min event current_mood $::mood current_music $::tunes taglist $::tags $::ptext ]
set plength [string length $::post]
set dopost [http::geturl $::lurl -query $::post]
set ljmta [http::meta $dopost]
set ljl [http::size $dopost]
set ljstat [http::status $dopost]
tk_messageBox -message "$ljmta\nLJ says: $ljstat\nPost length: $ljl"
}]\
[tk::button .lj.bro -text "VIEW Journal" -command {
set ljv "http://$::ljname.livejournal.com"
exec $::brow $ljv &
}]\
[tk::button .lj.ajuda -text "LJ Help" -command {ljhelp}]\
[tk::button .lj.no -text "DONE" -command {destroy .lj}]

}

####
# end proc ljpost

But, I'm not succeeding in setting the tags, music, and mood.
I don't understand what I'm doing wrong here...

Invalid character

Tue, 16 Sep 2008 06:59:29 GMT

I'm boppin along on foaf xml using .NET Framework 3.5 and after parsing 2k of foafs clean-n-easy I hit this one:

XDocument.Load("http://www.livejournal.com/users/andrewus/data/foaf");

System.Xml.XmlException: Invalid character in the given encoding. Line 39, position 331.

I think it's due to Russian characters in the or something. It's a bummer and I'm skipping it for now but I'm hoping someone's got a tip.

pebcak

Tue, 16 Sep 2008 06:53:01 GMT

I would like to add lj posting capability to Tickle Text, a text editor I wrote in tcl/tk, but, being entirely new to trying to work with this particular kind of thing (communicating with a remote machine, but not using ftp or ssh) I'm a little lost.
Maybe someone here can straighten me out...or point me to resources that explain the matter a bit more clearly.
I'm using what I found here (Part III. Client/Server Protocol) and here (Tcl socket manual page).

This is the proc I've written, as a test, and it doesn't seem to be getting any response, or, effectively posting to my journal.
This is the most basic attempt just to understand how to use
a) socket
b) the protocol to communicate with the LJ server.

proc ljpost {} {
set chan [socket www.livejournal.com 80]
puts $chan "POST /interface/flat HTTP/1.1\n
Host: www.livejournal.com\n
Content-type: application/x-www-form-urlencoded\n
Content-length: 105\n
\n
mode=postevent&user=tonytraductor&password=******&subject=testing+testing+testing&event=this+is+a+test+post"

close $chan

exit
}

I don't even understand, at this juncture, how to get/read a response from the server.
The only things I've written that have had to communicate with a remote machine have used ssh or ftp,
so, this is completely unfamiliar territory to me.
I don't know, here, if I am misunderstanding how to use tcl socket, or the protocol to communicate with the server.
I know I'm doing something wrong, because this fails to post to my journal (yes, I replace ****** with my actual password).

Trying to post via Atom

Tue, 16 Sep 2008 06:43:41 GMT

I got the following error when trying to post via atom

HTTP/1.0 400 Bad Request
<html><head><title>400 Bad Request</title></head><body>
<h1>Bad Request</h1><hr /><p>Could not parse the entry due to invalid markup.<br /><pre>Empty String at /home/lj/cgi-bin/XML/Atom/Thing.pm line 40
</pre></p>
</body></html>

This is what I tried to post:

<?xml version="1.0" encoding="utf-8"?>
<entry><title>testing!</title><content>my content is here</content></entry>

I can't find any documentation on what I should be putting in an entry

Any WS?

Tue, 16 Sep 2008 06:40:16 GMT

Hi everybody.
I can't find XML scheme or WSDL for LJ. Is it possible to communicate with server thru WS?

Restricting site to paid users only

Tue, 16 Sep 2008 06:35:45 GMT

What is the easiest way to restrict an LJ-clone site to paid users only? If you use account codes, then anyone who has an existing account could conceivably invite their friends.

Thanks.

Error on a fresh install

Tue, 16 Sep 2008 06:33:30 GMT

I just set everything up today, and after getting all the modules satisfied, and apache with mod_perl compiled in working, I get this:

Error loading event module 'LJ::Event::JournalNewComment': Base class package "LJ::MemCacheable" is empty.\n

Full error after the cut.

Thu Sep 11 14:36:14 2008] [error] Error loading event module 'LJ::Event::JournalNewComment': Base class package "LJ::MemCacheable" is empty.\n (Perhaps you need to 'use' the module which defines that package first.)\n at /home/lj/cgi-bin/LJ/Poll.pm line 9\nBEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/Poll.pm line 9.\nCompilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.\n at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410\nBEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/Entry.pm line 1219.\nCompilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.\n at (eval 903) line 2\nBEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/Comment.pm line 13.\nCompilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.\n at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410\nBEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/Event/JournalNewComment.pm line 4.\nCompilation failed in require at (eval 903) line 2.\nBEGIN failed--compilation aborted at (eval 903) line 2.\nCompilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.\n at /home/lj/cgi-bin/weblib.pl line 20\nBEGIN failed--compilation aborted at /home/lj/cgi-bin/weblib.pl line 20.\nCompilation failed in require at /home/lj/cgi-bin/LJ/NotificationMethod/Email.pm line 8.\nCompilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.\n at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410\nBEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/NotificationMethod.pm line 11.\nCompilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.\n at /home/lj/cgi-bin/ljlib.pl line 23\nBEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/Subscription.pm line 9.\nCompilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.\n at /home/lj/cgi-bin/Apache/LiveJournal/Interface/AtomAPI.pm line 15\nBEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/User.pm line 39.\nCompilation failed in require at /home/lj/cgi-bin/ljlib.pl line 23.\nBEGIN failed--compilation aborted at /home/lj/cgi-bin/ljlib.pl line 23.\nCompilation failed in require at /home/lj/cgi-bin/fbupload.pl line 10.\nCompilation failed in require at /home/lj/cgi-bin/Apache/LiveJournal/Interface/AtomAPI.pm line 15.\nCompilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.\n at (eval 2) line 1\nBEGIN failed--compilation aborted at /home/lj/cgi-bin/Apache/LiveJournal.pm line 31.\nCompilation failed in require at /home/lj/cgi-bin/modperl_subs.pl line 11.\nBEGIN failed--compilation aborted at /home/lj/cgi-bin/modperl_subs.pl line 11.\nCompilation failed in require at /home/lj/cgi-bin/modperl.pl line 20.\nCompilation failed in require at (eval 2) line 1.\n
Syntax error on line 22 of /usr/local/apache/conf/httpd.conf:
Error loading event module 'LJ::Event::JournalNewComment': Base class package "LJ::MemCacheable" is empty.
(Perhaps you need to 'use' the module which defines that package first.)
at /home/lj/cgi-bin/LJ/Poll.pm line 9
BEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/Poll.pm line 9.
Compilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.
at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410
BEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/Entry.pm line 1219.
Compilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.
at (eval 903) line 2
BEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/Comment.pm line 13.
Compilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.
at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410
BEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/Event/JournalNewComment.pm line 4.
Compilation failed in require at (eval 903) line 2.
BEGIN failed--compilation aborted at (eval 903) line 2.
Compilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.
at /home/lj/cgi-bin/weblib.pl line 20
BEGIN failed--compilation aborted at /home/lj/cgi-bin/weblib.pl line 20.
Compilation failed in require at /home/lj/cgi-bin/LJ/NotificationMethod/Email.pm line 8.
Compilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.
at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410
BEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/NotificationMethod.pm line 11.
Compilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.
at /home/lj/cgi-bin/ljlib.pl line 23
BEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/Subscription.pm line 9.
Compilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.
at /home/lj/cgi-bin/Apache/LiveJournal/Interface/AtomAPI.pm line 15
BEGIN failed--compilation aborted at /home/lj/cgi-bin/LJ/User.pm line 39.
Compilation failed in require at /home/lj/cgi-bin/ljlib.pl line 23.
BEGIN failed--compilation aborted at /home/lj/cgi-bin/ljlib.pl line 23.
Compilation failed in require at /home/lj/cgi-bin/fbupload.pl line 10.
Compilation failed in require at /home/lj/cgi-bin/Apache/LiveJournal/Interface/AtomAPI.pm line 15.
Compilation failed in require at /usr/lib/perl5/site_perl/5.8.8/Class/Autouse.pm line 410.
at (eval 2) line 1
BEGIN failed--compilation aborted at /home/lj/cgi-bin/Apache/LiveJournal.pm line 31.
Compilation failed in require at /home/lj/cgi-bin/modperl_subs.pl line 11.
BEGIN failed--compilation aborted at /home/lj/cgi-bin/modperl_subs.pl line 11.
Compilation failed in require at /home/lj/cgi-bin/modperl.pl line 20.
Compilation failed in require at (eval 2) line 1.

/usr/local/apache/bin/apachectl start: httpd could not be started

Is this a bug, or am I doing something wrong? I've left the ljconfig.pl file completely default.

Edit: This was fixed this morning(Sept 16th). They were moving a feature from ljcom over to the svn. NOW I have an issue with not being able to view user info.

Questions on FotoBilder

Tue, 16 Sep 2008 06:31:02 GMT

Okay, I have FotoBilder installed and running.

One. It's running on a different port - 8082. What do you do to change that, so when you type in pics.yourdomain.com it goes straight to pics.yourdomain.com:8082?

Also, I've installed this after I already have paid and perm accounts. How do you tie the two together so the existing accounts have automatic access? Yes, I followed all the directions and included the fotobilder information in the ljconfig file, but this doesn't seem to tie existing accounts into fotobilder.

Any help would be appreciated. Thanks.

Exporting comments in syndicated entries?

Tue, 16 Sep 2008 06:26:49 GMT

Is there a way to export comments in syndicated entries, like the one described at this page? I'm trying to write a WordPress plugin that automatically fetches comments from a syndicated feed and enters them into the original blog.

LJ Flash Lite mobile client /beta

Tue, 16 Sep 2008 06:11:14 GMT

Hi all,

My name's Alex Tur, and I'm a newbie here. But I've came not empty-handed. Let me please introduce the beta version of Adobe Flash Lite 2.x+ mobile client for LJ. This's a simple version for Flash Lite enabled smartphones that allows:

• connect to LJ resource with its XML-RPC API through MobiTile proxy server
• login with user account data
• read user's journal with thumbnails of included images
• review reduced images
• make a new post in the user's journal
• edit previouse events
• delete selected posts
• get list of friends
• manage the list of favorites
• read other journals of friends and favorites
• switch a landuage of interface (auto/english/russian)
• turn off loading thumbnails

Original Adobe Flash Lite format (SWF) file and installetion for Symbian S60, 3rd edition smartphones are published as a part of MobiTile Project at http://www.mobitile.com/?l=en&p=livejournal

Advanced versions are in the way.

Best,
Alex

LiveJournal SVN file naming

Tue, 16 Sep 2008 06:04:32 GMT

While I was checkouting latest livejournal version under Windows with command line client, I'd got error about some files are missed, but files are in repository and under version control!
Detalied analysis shows, that there're files which differ in case in filename (for example: scrapbook.gif and Scrapbook.gif , Journal.gif and journal.gif and some others.)

Is this really bug (possibly copy-paste) or files are really should be different (possibly not only by filename)?

grep command says, that Journal.gif and some others are not used.

Tue, 16 Sep 2008 06:01:55 GMT

Hey devs,

I don't see an iPhone Livejournal app anywhere. Is there a reason why nobody's created one? There seems to be only one app that will post to lj on the App Store; Shozu, and from the reviews, it's not very good.

I'll gladly write one, if anyone would like to have it.

-Amanda

Poll Results

Tue, 16 Sep 2008 05:58:05 GMT

Is there a way to read all of the answers to all of the questions in a poll at once, or do you need to screenscrape for each individual question?

setting up my very first installation, but where to start?

Tue, 16 Sep 2008 05:54:47 GMT

I want to setup my own blogging site using the Livejournal source code. I have downloaded the full source code and I use a web host that has the following stats:

OS: Linux
Apache: 1.3.37
Perl: 5.8.8
PHP: 5
MySQL: 5.0
(I can also create Postgresql databases but am not sure about the version)

I do not know where to start. Can someone please tell me what structure to upload the source to my host and what to do to get started? There are just too many files and I am lost..... :) Thanks!

"Bloggish" themes not working

Tue, 16 Sep 2008 05:47:15 GMT

None of the available S2 styles on Inksome based on "bloggish" are working. Other styles work, however. Can anyone suggest where I might start looking to fix this problem?

And when my users talk about "themes", do they mean "styles", or is that something else?

[Maintainer] Moderation queue -- update!

Tue, 16 Sep 2008 05:35:57 GMT

Hi all,

My apologies for not being able to attack the moderation queue -- been coding night and day for my job and have a few hundred people waiting for it's release (such as life).

To help out with the queue I have asked pauamma to look after the moderation queue until I get this project rolled out. I'm hoping to be free from this coding nightmare in 2-3 weeks (yay).

Thank you all for your patience, and happy coding!

-Steve

[Maintainer] Entry queue

Thu, 11 Sep 2008 19:44:29 GMT

Hi all,

My apologies for the delay in going through the entry queue for this community. I recently had a medical emergency which has kept me away from the computer which has resulted in massive delays.

I am starting to go through the queue right now, and should be through by this evening.

If you haven't seen your post come through by this evening leave me a comment so I can have a look.

Again, my apologies!

-Steve