We want to let you know that we will soon be making changes to the way we sell our extensions. There are two changes coming...

One Plan To Rule Them All

There are currently four paid plans: Silver, Gold, Diamond, and Lifetime. We have decided to stop selling them. Instead, we will have just one plan: Developer Membership.

Developer Membership will give you access to everything on our website, for an entire year. That includes all current extensions and any new extensions we develop during the course of your membership. Developer Membership will be yours for $147/yr.

If you are an existing member... fear not; Your plan will continue to be active as long as you continue to renew your subscription (at the price you originally paid to join).

Buy One, Get One

"I only want [insert extension name here]. Why should I pay $147 to get all the other stuff I will never use?"

We have always received a lot of requests for single-extension purchases, and we’re pleased to tell you that we will soon offer just that option.

We haven't yet settled on a price for every extension, but generally, our major extensions (Ninja Content, Ninjamonials, etc) will likely sell for $47 and our smaller extensions (Ninja Accordion, Ninja Access, etc) will be $7.

Why The Changes?

Because after four years, we now have over sixty extensions available, and it has just become too expensive to maintain them while working on new extensions and features for the existing ones.

As a result almost all of our development team now has to work part or full time on other jobs and freelancing to cover our expenses. Which results in even less time to work on extensions for you.

Our goal is to provide the best quality extensions available today, and we can’t do that without being able to focus 100% on them.

It has been a great ride, and we are grateful to all our members past, present and even future, but things need to change if we are going to maintain our quality and development rate.

When Does The New Pricing Come Into Effect?

The change will happen this coming Monday, which is only a couple of days away. That means that if you want to lock in the current low pricing, you need to act fast!

Grab a membership now!

Hi everyone,

We've been quiet for some time now, so about time we told you what's happening with Ninjaboard!

1. A new release cycle.

Inspired by how apps like Google Chrome is developed, we've done a dramatic shift in how we develop Ninjaboard.

The way we used to do it, is that we worked on a single version for everything.

The problem were that if a security vulnerability, or a critical bug surfaced that required immidiate action then an unstable trunk would delay the release.

Now we have two separate versions that we develop on. One production version (right now that's 1.0.x), and the other the development version (today that's 1.1).

The production version is the stable one, and on that branch we only do bugfixes, optimizations and other minor things.

The development version is for everything else. We develop new features here and even though it's called "development" we target each iteration as a stable one.

Why does each build need to be as stable as possible? Every 6th week the development version will replace the production version on our svn, and we spend 1 week further stabelizing it before we do a public release.

We also instantly continue working on the next version.

This allows us to release new versions whenever we need to, whenever we fix our users bugs. Maintenance releases don't have to wait for new features to finalize. New features don't have to wait for bugfixes either.

So with that in mind, the new cycle kicks in February 7th, meaning we'll see a public release on the 14th.

2. JoomlaWorks sponsors development!

Thanks to JoomlaWorks, 1.1 will have some really cool new features:

1. SMF 1.1 converter, the first ever Ninjaboard converter that can handle stand-alone (not bridged with Joomla in any way) forums.
2. Private Messages, since SMF have this feature the converter couldn't be successful without also migrating that data.
3. UTF8 and ASCII dual support for slugs, the code used to accomplish this in k2 is donated to us by JoomlaWorks.

This is just the tip of the iceberg on what's coming in 1.1, so the 1.1 release announcement will reveal a couple of nice surprises

3. Joomla! 1.6 support moved to 1.2

We simply don't have enough time to make our ACL work with the changes done in 1.6 in time for 1.1's release, so it's moved to the 1.2 milestone.

At last, it's finally released!

There is just too much to mention in just one blogpost, so we'll tell you just our top 5 most interesting changes since RC7 and leave you with a link to the full changelog.

Click here to download.

HUGE thanks to all our testers and translators! We really wouldn't be this far without you

1. Achieved milestones.

RC6 is our most exciting release yet, and we achieved a few significant milestones.

• We passed SVN commit #1000 during the development of RC6.
• We upgraded all our code from GPLv2 to GPLv3 licensing, just like Nooku and Anahita did last month.
• Early last week we patched Nooku Framework for Joomla! 1.6 compatibility, and the patch got accepted!
• The following weekend we got Ninjaboard installable on Joomla! 1.6 without losing 1.5 compatability.

With milestones covered, I'm gonna focus on 2 other topics today to keep things brief and to the point.

2. What's new in RC6.

There's far too much to say about RC6 to squeeze it into a single blog post.
But you can see them all by spending a few minutes of your valueable time and

Download Ninjaboard RC6 Preview

right now and see what all the fuzz is about.

For those of you like me prefer to learn about the juicy bits first, read on!

The most sensational news about RC6 are of course that it now supports Joomla! 1.6*, without dropping 1.5 support.

We've largely renovated our install script ground up.
We've made it smarter by no longer running database schema upgrades during install, but rather the first time you visit Ninjaboard after installing.
We're using AJAX to not only prevent script timeout errors, but mainly to make the installer report exactly what it's doing, when it's doing it.
So far the feedback we've received reports that by being able to see what's happening under the hood, the install feels much faster and less of a pain.

Proper Email Notifications!
We studied how people wanted to subscribe to them, and we managed to squeeze it down to 3 common ways.

1. By topic, standard in all forum apps.
2. By category, fairly common and also critical for moderators.
3. By person, uncommon in forum apps but extremely common in social apps. So most people expects that feature to be there.

And while we implemented all 3, each email notification carries an link to where you can organize whatever you're subscribed to, or what we call "watches".
We're also planning on allowing you to reply directly to a post by simply replying to a notification email.
And just a closing note; Admins can control wether to include post text or not. And email notifications are translatable.

With that said, we've fixed more bugs than in any previous release. Making RC6 effectively the most stable and production ready release we've done so far.

But our main focus have been making Ninjaboard radically better performing, more out of the box and less in your way than ever before.

Be good sport and download now to see for yourself

3. Ninjaboard around the web.

For concluding our brief post about exciting new release, I want to share a few of the exciting things happening around the web related to Ninjaboard.

Yireo blogging about their decision to migrate to Ninjaboard.

Ninjaboard featured and running on the RocketTheme September 2010 template, Omnicron.

Ninjaboard featured and running on the RocketTheme October 2010 template, Syndicate.

For the October issue of Joomla! Magazine I got the opportunity to talk about what makes Ninjaboard stand out from the rest.
And while you're there don't forget to checkout the awesome new November issue!

JoomStew with me super excited to be their guest. Talking about Ninjaboard on 1.6, Nooku FW and a lots of other fun stuff!

*There's a known issue related to the different acl architechture in 1.6. Calling RC6 for "Preview" at this point is our way of calling it Beta.

All Joomla! 1.5 native components and modules supports something called template layout overrides.

Template layout overrides allows you to copy the files that generate the html in an component, into your template.

And the component will then use the files found in your template, instead of its own.

There are times when you just want to load another image, change a little bit of css or customize a piece of javascript.

So you don't want or need to override an entire PHP file just for doing that.

Good news is that Ninjaboard supports overrides by path for all of its assets.

Every image, css file, js script and php layout can be overriden at your hearts content.

That includes frontend and backend.

Template layout override

Ninjaboard

/components/com_ninjaboard/views/person/tmpl/default.php

Your template

/templates/yourtemplate/html/com_ninjaboard/person/default.php

Stylesheet override

Ninjaboard

/media/com_ninjaboard/css/site.form.css

Your template

/templates/yourtemplate/css/com_ninjaboard/site.form.css

Script override

Ninjaboard

/media/com_ninjaboard/js/jquery/site.js

Your template

/templates/yourtemplate/js/com_ninjaboard/jquery/site.js

Image override

Ninjaboard

/media/com_ninjaboard/images/forums/default.png

Your template

/templates/yourtemplate/images/com_ninjaboard/forums/default.png

Thanks for reading! Download Ninjaboard now and give it a try.

Try it out now!

Need to be convinced? Here's what's new in Beta 5:

• Views like Forums in the admin now have maintenance mode that runs once per week. They will automatically fix table relations and such when needed.
• Full downgrade support. Ninjaboard 0.5 tables are backed up during install, and will be recovered during uninstall to allow downgrades.
• Users can now be assigned to more than one usergroup at once.
• Possible to adjust spacing between forum boxes
• Custom designed premium topic icons, exclusively for Ninjaboard.
• Person page frontend. Shows the avatar, user rank and the persons latest topics.
• Auto-translator, updates your NB language file with untranslated strings for your convenience. Turn on Language debugging under Global Config to activate it.
• Tools screen upgraded
• Norwegian translation on frontend.
• Ninjaboard Stats Admin Module upgraded with another graph. Go to the module manager > administrator and publish it to ninjaboard-dashboard-tabs.
• Chameleons compatibility with Gantry Framework and Warp5 are improved.
• Views like the forums and topics views are now taking advantage of HMVC.
• The forms styling when creating a topic, posting a reply or editing a post are now even sexier and more user friendly.
• Usergroups are now easier to setup, as you get a live, human readable paragraph to the right explaining your permissions configurations.
• Improved the Sample Content available on the Tools screen.
• Added option to not make the forums title in forums view linkable. Instead of just showing a permalink, or making it linkable (which don't work well in all templates)
• Much more localizable, javascript that were previously hardcoded, now uses JText for translatability.
• Forums styling is enhanced to take advantage of more CSS3 features, and subtle highlights between rows that change correctly based on mouse hover.
• Ninjaboard 1.0 can now install on a 0.5 site, and it'll present you an option to import the 0.5 data into your 1.0 database after upgrade.
• Styling of moderation tools frontend upgraded to use Chameleon.
• Advanced CSS3 (like gradients) no longer favor WebKit based browsers. Gecko and Presto support added.
• Usability of usergroup Mapper is improved. Easier to click and drag, and mouseover highlight the end point.
• phpBB3 converter vastly improved.
• Converter speeds are dramatically faster. Things that used to take 3 hours, now take literally 3 minutes.
• Major speed improvements, queries no longer recurse!
• bbCode parser upgraded to support more tags, like table tags.

If you really enjoy using Ninjaboard, let others know here.

if you experience something that suck, there's a place for that to, just because we love you

We'll start posting some tutorials while working on RC in the coming days, like how to use the auto-translation feature to localize Ninjaboard super fast!

Cheers!

There's some buzz on twitter that Ninjaboard got an SQL injection vulnerability.

Here's the first tweet that started the buzz:

New Exploit [dos] - Joomla Ninjaboard Component (com_ninjademo) SQL Injection Vulnerability: http://bit.ly/aa5CnQ

Now, first off. The component being referenced is actually com_ninjademo.
NinjaDemo has nothing to do with Ninjaboard.

NinjaDemo is not even released, and it likely never will be either. It's an in-house extension we're using to quickly setup demo links, as seen on the Ninjaboard Demo site

The security vulnerability disclosed is that if you pass something other than an ID into the link, like this: http://ninjaforge.com/ninjaboard-demo/index.php?option=com_ninjademo&view=demo&id=[sql] then an error happens because the generated SQL query gets a syntax error.

However that's terribly wrong, follow that link and you'll get this error:

Warning:  Invalid argument supplied for foreach() in tmpl://components/com_ninjademo/views/demo/tmpl/default.php on line 11

Since NinjaDemos source is unavailable, I'll show you the code in that file here so you know what's happening:

<? foreach ($demo->links['href'] as $i => $link) : ?>

We store each demo link in a JSON encoded object. Like this:

{
	"link": ["#", "#"],
	"title": ["Foo", "Bar"],
	"image": ["foo.png", "bar.png"]
}

The reason that warning happens, is simply because if you don't supply the right id, no JSON data is fetched, so this part of our layout will fail.

There is absolutely no SQL injection happening. We take great pride in security, and NinjaDemo is also using Nooku Framework. So the id variable is sanitized multiple times before the sql query is generated.

1. URL variable is fetched using KRequest::get('get.id', 'int'), so it's sanitized as an integer.
2. The id is put as a model state, and the model state is configured as $this->_state->insert('id', 'int') in the model. Meaning it's sanitized as an integer for the second time.
3. Before the database query is generated, Nooku Framework will filter each column according to table metadata. The id is a bigint type, so it's sanitized as an integer for the 3rd time during the generation of the SQL query.

So it's pretty obvious that there is absolutely no SQL injection going on here.

"Then what is going on?"

Like I said earlier, the fault is that if the supplied ID don't exist, no JSON data is sent to the view. So when we do the foreach loop, $demo->links['href'] don't exist, as $demo->links wont hold any data, so we get a PHP warning.

What should be done in our case, is to check that the JSON data exists before trying to loop it.

That's all there is to it. I would appreciate it if the people who reported this "vulnerability" in the future contact us before making it public, so we get a chance to prevent a faulty report like this to be made public.

After all, it's common decency to alert the author before making reports public.

Especially if they think it's an piece of software that's used on many sites (they did think the extension was Ninjaboard), as it's important to be able to fix vulnerabilities so users can update their sites before they could be attacked.

Since we’re following the release schedule of Nooku Framework, we’re a little delayed. We were intending to release Beta5 last week, but the changes in the latest branch of Nooku FW 0.7, require all our views and helpers to be re-factored.

Beta5 will be released next week. And the first Release Candidate (RC) will be out the same week Nooku FW 0.7 Beta is released.

We’ll tell you all about Beta5 next week