XenForo to Flarum Importer

Berlyn

Definitely, but give it time. The software is still in it's early stages of development. When it's at a stable stage, I think developers can start looking at migration techniques.

Differ

I hope that someone will do qualitative plug 🙂

Rodenastyle

@Differ I'm doing a migration to flarum. Feel free to contact me for any further information 😉
@Berlyn API could be pretty enough to migrate, isn't it?

Franz

Rodenastyle API could be pretty enough to migrate, isn't it?

I don't think the API should offer all features (e.g. creating posts on behalf of other users, with old timestamps etc.) that an importer would need.

Rodenastyle

Franz

{
type: "discussions",
id: "1",
attributes: {
title: "Hola mundo",
commentsCount: "1",
participantsCount: "1",
startTime: "2016-01-22T02:04:48+00:00",
lastTime: "2016-01-22T02:04:48+00:00",
lastPostNumber: "1",
canReply: "",
canRename: "",
canDelete: "",
canHide: "",
isApproved: "1",
isLocked: "",
canLock: "",
isSticky: "",
canSticky: "",
canTag: ""
}
}

startTime and lastTime could do it, isn't it?

Franz

Yes, but I'm wondering whether the API should allow such stuff.

Rodenastyle

Franz It should be possible if you are using a master api_key, isn't it? 😉

Franz

Yes, but the more admin features the API exposes, the bigger the attack vector. That was my thought here. 😉

Rodenastyle

Franz The idea is to create public and admin API, isn't it? You can use /api/token with your user and password to get your public token, but you need to access db to be able to create master token. I thought this was the logic.

Kulga

Franz Yes, but the more admin features the API exposes, the bigger the attack vector. That was my thought here.

luceos Currently not all attributes are available for mutation in the API. I hold the same position as @Franz , better to have a secure system than a completely open one. You can always create a database importer of some sort.

It's a difficult discussion.

Could it be possible to set restrictions on master tokens?

Borrowing a example from how ssh handles authentication, you can configure a host to accept a public key ( master token) with varying conditions like forcing a command, source ip address, maybe (in this case) limiting available api requests
eg - forces connections only from 224.xxx.xx.xxx and only allows command "echo hello" before closing.

from="224.xxx.xx.xxx",command="echo hello" ssh-rsa AAAAB3...

A master token should be permitted global access (it is master), but consider:

Only accepting requests from your ip address or localhost
Permit only api requests based on what the user defines (or is instructed to permit to a script for a importer)
- Maybe have defaults like global, user, to limit potential greater security holes

This would decrease the attack vector.

luceos

Currently not all attributes are available for mutation in the API. I hold the same position as @Franz , better to have a secure system than a completely open one. You can always create a database importer of some sort.

It's a difficult discussion.

Rodenastyle

Rodenastyle
https://discuss.flarum.org/d/1871-bypassing-flood-control

Franz

Rodenastyle Yes, but once a master token is out there, it can be stolen. The less permissions it has, the smaller the impact.

Rodenastyle

Franz That's true, but we're talking about post's and discussion's date, I mean, is it really a security hole?

Rodenastyle

@Franz Well, as you said will be impossible right now to do migrations by API. We're not able to set tags as primary, to set a discussion with content or to assign a discussion to a tag. Make an extension for this could be another way, but the thing is that even knowing I'm able to change serializers by event, Flarum is developed in a really abstract way and that is too much for a junior developer as I am. The last chance to do migrations, despite I do not really like, is to attack directly to bd tables and then be changing then on bd updates. I know that you'll bring to flarum some important importers soon, but I'm not picking forum's data from backend or bd, I'm directly scraping it from DOM and parsing so it lets me to migrate big old platforms forums.

Franz

Kulga Could it be possible to set restrictions on master tokens?

Yes, the idea is to define scopes (certain groups of features) that a token has access to. That still needs to be implemented, though - the current master tokens are the stopgap solution.

kingofseo

I will be writing a xenforo converter soon.

Rodenastyle

kingofseo As a plugin, by API, SQL? What do you have in mind?

kingofseo

Rodenastyle

It will a php class which can be implemented in the flarum core/extension as well.