MigrateToFlarum Lab, the health scanner for Flarum

clarkwinkelmann

SezginYILDIRIM there is an encoding problem on your homepage, most likely inside of the preloaded discussion data. It's not valid UTF-8.

I have improved error handling for invalid encoding, now it should at least provide an error message. Previously the database requests would fail because it was trying to insert the data in MySQL. This left the scan in an unfinished state.

Littlegolden

clarkwinkelmann If it happens every single time it's a bit concerning.

Yeah... it happens every single time... My server is in Beijing.

Gatsu

Hi @clarkwinkelmann ,
now I don't know why, the scanner gives me as result B and this error.
Can you help me get back with the A or A + score?
I state that my website is reachable without WWW, as configured in the config.php.

https://ibb.co/Xbf2q2s

clarkwinkelmann

Gatsu it seems like it was just a temporary error. A new scan works fine https://lab.migratetoflarum.com/scans/dcaa4f81-e002-4f34-b49a-67d13d1583e8

The error message might not be the best description of the issue. Because an HTTPS request failed, the scan assumes that URL never works, which clearly isn't the case here.

debynory

Disaster 🙁 https://lab.migratetoflarum.com/scans/f8328b3b-9bf6-42a0-bf41-394e8b57ab86

clarkwinkelmann

debynory if that's your website, the fix seems easy enough. It's missing HTTPS redirects.

debynory

clarkwinkelmann I don't understand where are "multiple urls"

datitisev

debynory You allow both HTTP & HTTPS, and non-www & www URLs to work. You should redirect to the one you want.

debynory

datitisev I have added this to .htaccess:

<IfModule mod_rewrite.c> RewriteCond %{HTTPS} !=on RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L] </IfModule>

but always error 🙁

clarkwinkelmann

debynory if you get an Apache error, check the Apache error log.

If it just doesn't work, maybe the mod_rewrite isn't enabled. Or maybe it's not added in the right place.

Also that code looks like a loop to me. It redirects to http when the request isn't https? But if there's a loop it should be obvious in the browser, they have a special message just for that.

matteocontrini

I was scanning discuss.flarum.org and I broke something...

https://lab.migratetoflarum.com/scans/5296c709-eca0-45b8-b311-e68d731a3354

clarkwinkelmann

matteocontrini the server disk was full. Something's wrong with my server monitoring as I didn't get any alert 🙉

It should be working again now.

clarkwinkelmann

I have deployed an update for many of the lab dependencies, including upgrading to the latest Laravel version.

I have also fixed my monitoring, so hopefully no more unexpected full disk errors. I'll still need to move the lab to another server in the near future as the Droplet starts showing its age.

Let me know if you notice anything out of the ordinary.

clarkwinkelmann

The Lab can now show Flarum beta 14 forums!

Flarum version detection has also been improved. Now most of the time the Lab should show a single version instead of "10/11/12/13".

All versions prior to beta 13 are now awarded a "D" rating due to the vulnerability in the Tags extension.

I don't have any easy way to show whether beta 13 forums are impacted, as the update from Tags beta13 to Tags beta13.2 cannot be detected without attempting the exploit. For now beta 13 forums will keep their existing rating, but please make sure you have applied the Tags update.

As always please let me know if you experience any issue 🙂

https://lab.migratetoflarum.com/

clarkwinkelmann

I have just added the ability to recognize beta 14.1 and 15 forums. Better late than never 🙉

EDIT: oops, seems like my hack to detect Flarum versions on Cloudflare doesn't work anymore with beta 15 forums 😅 will try to find a fix.

MikeJones

clarkwinkelmann I haven't used this tool in forever and just noticed that it shows if there are updates for extensions out there! Thats awesome!

clarkwinkelmann

MikeJones yes it's been here for a while.

However it only shows if there's any version with a higher number. It might suggest alpha/beta versions as well, or versions not compatible with your Flarum version. And if it cannot guess the extension version it will simply show the latest version published to packagist without knowing if that's the one you have or not.

A tool like the Extiverse helper is much more precise for this because it has access to the exact list of extensions and versions you have installed.

giter

How can I make my forum not be scanned?

clarkwinkelmann

giter https://lab.migratetoflarum.com/opt-out

This won't prevent other people from scanning your forum, but the results will always be private and the website will never be added to the showcase.

giter

clarkwinkelmann

Why am I still able to scan after adding <meta name="migratetoflarum-lab-opt-out" content="yes">to the Custom Header?

Checked just now:

Opted in - this website can appear in public results and showcase

Is it because my website is using a CDN?

clarkwinkelmann

giter can you send me the link to the website so I can check if something's wrong? If you want to do so privately you can send me the link via private message on Discord or email (click "Security or legal inquiries" on the lab footer for the email, or just use the email on my own website)

« Previous Page Next Page »