nodebb/nodebb

Node.js based forum software built for the modern web

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. NodeBB takes the best of the modern web: real-time streaming discussions, mobile responsiveness, and rich RESTful read/write APIs, while staying true to the original bulletin board/forum format → categorical hierarchies, local user accounts, and asynchronous messaging.

NodeBB by itself contains a "common core" of basic functionality, while additional functionality and integrations are enabled through the use of third-party plugins.

Try it now | Documentation

Screenshots

NodeBB's theming engine is highly flexible and does not restrict your design choices. Check out some themed installs in these screenshots below:

Our minimalist "Harmony" theme gets you going right away, no coding experience required.

How can I follow along/contribute?

• If you are a developer, feel free to check out the source and submit pull requests. We also have a wide array of plugins which would be a great starting point for learning the codebase.
• If you are a designer, NodeBB needs themes! NodeBB's theming system allows extension of the base templates as well as styling via SCSS or CSS. NodeBB's base theme utilizes Bootstrap 5 as a frontend toolkit.
• If you know languages other than English you can help us translate NodeBB. We use Transifex for internationalization.
• Please don't forget to like, follow, and star our repo! Join our growing community to keep up to date with the latest NodeBB development.

Requirements

NodeBB requires the following software to be installed:

• A version of Node.js at least 16 or greater (installation/upgrade instructions)
• MongoDB, version 3.6 or greater or Redis, version 2.8.9 or greater
• If you are using clustering you need Redis installed and configured.
• nginx, version 1.3.13 or greater (only if intending to use nginx to proxy requests to a NodeBB)

Installation

Please refer to platform-specific installation documentation. If installing via the cloud (or using Docker), please see cloud-based installation documentation.

Securing NodeBB

It is important to ensure that your NodeBB and database servers are secured. Bear these points in mind:

1. While some distributions set up Redis with a more restrictive configuration, Redis by default listens to all interfaces, which is especially dangerous when a server is open to the public. Some suggestions:
   • Set bind_address to 127.0.0.1 so as to restrict access to the local machine only
   • Use requirepass to secure Redis behind a password (preferably a long one)
   • Familiarise yourself with Redis Security
2. Use iptables to secure your server from unintended open ports. In Ubuntu, ufw provides a friendlier interface to working with iptables.
   • e.g. If your NodeBB is proxied, no ports should be open except 80 (and possibly 22, for SSH access)

Upgrading NodeBB

Detailed upgrade instructions are listed in Upgrading NodeBB

License

NodeBB is licensed under the GNU General Public License v3 (GPL-3) (http://www.gnu.org/copyleft/gpl.html).

Interested in a sublicense agreement for use of NodeBB in a non-free/restrictive environment? Contact us at [email protected].

More Information/Links

• Demo
• Developer Community
• Documentation & Installation Instructions
• Help translate NodeBB
• NodeBB Blog
• Premium Hosting for NodeBB
• Unofficial IRC community – channel #nodebb on Libera.chat
• Follow us on Twitter
• Like us on Facebook

nodebb's Issues

package.json manifest compliance

As per: https://npmjs.org/doc/json.html

people fields: author, contributors

The "author" is one person. "contributors" is an array of people. A "person" is an object with a "name" field and optionally "url" and "email", like this:

{ "name" : "Barney Rubble"
, "email" : "[email protected]"
, "url" : "http://barnyrubble.tumblr.com/"
}

...also relevant:

If there is an AUTHORS file in the root of your package, npm will treat each line as a Name <email> (url) format, where email and url are optional. Lines which start with a # or are blank, will be ignored.

That may be a better solution than relying on the author or contributors field. :)

---

Further issue: no repository type is stated in package.json. Just add "type":"git" to the object for repository for compliance and proper parsing.

Ajaxify should not unbind and rebind anchor elements

On ajaxify.go, ajaxify.onclick should not be iteratively bound to every anchor element in the page.

Changing ajax.enable to:

$(document.body).on('click', 'a', ajaxify.onclick);  // this code is untested

and making sure that ajax.enable is only called in $('document').ready() should be enough to have all anchors accounted for at all times, even after the HTML in #content changes.

When favouriting the main post, the label loses the "Favourites " text

Remove npm package dependency "crypto"

As on tin. Said dependency hasn't been updated in two years plus, and node ships with crypto support already.

EDIT: This is also applicable to npm package dependency "path", which also is a builtin.

when creating a new topic, the new topic doesn't invoke ajaxify.go

notifications sorting is wrong

Disconnected when trying to upload avatar

Here's the error:

trying to upload to : /nodebb/public/uploads/photo.png

events.js:72
throw er; // Unhandled 'error' event
^
Error: spawn ENOENT
at errnoException (child_process.js:980:11)
at Process.ChildProcess._handle.onexit (child_process.js:771:34)

Edit: upon restart of the app, I can see that the upload did take place successfully

Use npm commander for parsing argv

As on tin; would also make creation of a --help command much easier and make it a bit easier to determine how to run or configure the application from commandline.

Mobile Menu throws js errors in admin control panel

mobile-websockets enhancement

websockets: anything not "important" (ex. calls to get total # of people, or people logging into a topic) should be disabled on mobile. And most especially stuff that isn't visible anyways. I think it slows down old phones

Not able to post more than 11 replies

I have created two topics till now, and whatever replies I post more than 11 under a topic, they end up not being displayed. They show up in Recent posts, and redis as well, but not in the UI. Am I missing something ? Like pagination buttons or so?

/recent sorting is done by topic creation date

Should use the last post date in the topic for the sorting

Notifications stay forever in the topbar.

Either need a X to delete them or remove them after they are clicked on.

thread tools needs to be same height as reply button

res.send(JSON.stringify()) to res.json()

express comes with res.json() for sending json back with proper mimetype and stringification; why not use it? Easier to read.

[security] Use node path builtin for path resolution

https://github.com/designcreateplay/NodeBB/blob/master/src/routes/user.js#L115

I smell security issues with this, probably directory traversal; probably in that you're only working with / and not \ too. Let path do the job it is made to do.

http://nodejs.org/api/path.html

Use path.normalize to prevent directory traversal, path.relative to change the path we're aimed towards...etc.

Username checking (for register/rename) should check for duplicate slugs

Related to issue #32, when a user registers, a slug should be generated, and whenever the change their name, or when a new user registers, slugs need to be compared.

Right now, users can register nearly identical usernames by using different cases (julian vs. Julian vs juLIAN)

Move the "chat" button over to somewhere near the user

Hi

I think it would make more sense to move the chat button from the bottom bar of the post to somewhere near the user's picture. The chat function has something to do with the user while all other buttons down there have something to do with the post itself.

See screenshot.

Really cool project!

User Management in ACP lists myself as not an admin

uid 1 is hardcoded as administrator in Redis, though on user creation, the user's administrator hash is defaulted to 0.

NodeBB cannot be configured to work with a passworded Redis server

Third-party hosted redis databases usually have passwords.

I needed to add support of a password on Redis as I use an external service.
I added the following two lines to redis.js at line 9 (just after the redis.createClient line):

if( global.config.redis.password ) {
    RedisDB.exports.auth(global.config.redis.password);
}

You can favourite your own post.

It doesn't give rep but the post remains favourited after reload.

Features Broken in Safari (5.1.7, Windows)

Seemingly websocket related - features that require websockets just don't work. Not sure if this is an issue for Safari on Macs but I'll assume yes.

new post button is out of place on mobile

add some padding to the bottom

user routes are sending users to 403 when a 404 would be more appropriate

Need to create a 404 route as well, and send users to it instead of /403

Hide "minimize" button in post window when on phone

How do you manage users?

I see the Users section under /admin but there is no way to delete a user or disable an account or change permissions on an account that I can find, is there a way to do any of this?

incorrect login messages

When you try to login with incorrect details or non-existant account there is no error/warrning message.

Category has unread notification after you make a new post.

If u make a post to a topic and go to the home page the category that topic is in is highlighted red. It shouldn't be highlighted

app.alert timeout bug

If an app.alert is made with timeout and alert_id values set, and another timeout is made with the same alert_id, the old setTimeout(); is not cleared to make way for the new timeout, so the alert fades away prematurely.

Reproduction steps

1. `app.alert({ alert_id: 'foo', timeout: 10000 });
2. Wait five seconds.
3. `app.alert({ alert_id: 'foo', timeout: 10000 });
4. Alert disappears after another five seconds, instead of the expected ten.

server side validation for username,password,email on register

recent replies don't update after making a new post

seems like a sorting issue, post made more recently appear at the bottom of the recent replies section

initial reply button needs to be fixed or removed for mobile

Loading a composer window via click event causes ajaxify to trigger

The lis inside of the composer bar have a href of #, causing ajaxify to trigger.

post formatting bar showing up blank

The formatting section looks like this: http://imgur.com/Q2p9gWk

But the links are present and do work fine.

avatar is shown full size on topic display

As described above. I guess you either need to limit picture upload size in pixels or restrict the size on display.

moving a topic doesn't change topic count in categories

when a topic is moved from one category to another the topic_count of those categories should change. -1 from the old category +1 to the new category.

crash on try.nodebb when viewing user profile

userData[uid].username || 'anonymous', postTools.js line 155, doesn't happen all the time

add the facebook google and twitter share widgets to category view

Uncaught TypeError: Cannot set property 'innerHTML' of null topic.js:292

JS error on try.nodebb.org

document.getElementById('thread_active_users').innerHTML = active;

hard to repro.

I get disconnected when trying to access the 'topics' entry in the admin menu

Here's the error:

nodebb/node_modules/redis/index.js:535
throw err;
^
Error: write after end
at writeAfterEnd (_stream_writable.js:130:12)
at Gzip.Writable.write (_stream_writable.js:178:5)
at ServerResponse.res.write (/home/andy/dev/node/nodebb/nodebb/node_modules/connect/lib/middleware/compress.js:86:18)
at ServerResponse.res.end (/home/andy/dev/node/nodebb/nodebb/node_modules/connect/lib/middleware/compress.js:91:23)
at /home/andy/dev/node/nodebb/nodebb/node_modules/connect/lib/middleware/session.js:286:13
at /home/andy/dev/node/nodebb/nodebb/node_modules/connect-redis/lib/connect-redis.js:130:18
at try_callback (/home/andy/dev/node/nodebb/nodebb/node_modules/redis/index.js:532:9)
at RedisClient.return_reply (/home/andy/dev/node/nodebb/nodebb/node_modules/redis/index.js:614:13)
at ReplyParser. (/home/andy/dev/node/nodebb/nodebb/node_modules/redis/index.js:266:14)
at ReplyParser.EventEmitter.emit (events.js:95:17)

valid email is invalid

[email protected]

https://github.com/designcreateplay/NodeBB/blob/master/public/src/utils.js#L88

User creation should also create a user slug

A user account is currently accessed via URL by their username (/users/julian), although for some social accounts (namely Facebook and Google), spaces are used, which while not technically broken, could do with some prettifying, since it currently saves as (/users/Julian%20H.%20Lam).

On user creation, a slug should be assigned to the user, and this should be the user's canonical username (as opposed to a display name)

Can't seem to echo template properly in topic view

Not working on Chrome 27.0.1453.110

Doesn't work on this version of Chrome. Getting the following socket.io related error.

Failed to load resource: the server responded with a status of 500 (Internal Server Error)

Stack trace

GET http://localhost:4567/socket.io/1/?t=1371463646460 500 (Internal Server Error) socket.io.js:1659
Socket.handshake socket.io.js:1659
Socket.connect socket.io.js:1699
Socket socket.io.js:1551
io.connect socket.io.js:94
$.ajax.success app.js:15
fire jquery.js:3074
self.fireWith jquery.js:3186
done jquery.js:8253
callback jquery.js:8796
send jquery.js:8802
jQuery.extend.ajax jquery.js:8154
(anonymous function) app.js:9
(anonymous function) app.js:294

Local function `set_up_posts` should be deprecated

The local function set_up_posts should be deprecated in favour of delegated events in the $(document).ready() block in the same file.

Please clarify the open source license being used

The exact license is not mentioned neither in the readme nor in the package.json. Which license are you using? MIT, GPL etc.

No CSRF protection on forms

As stated above, there's zero csrf protection. This can be done in express already with express.csrf (reference express documentation).

flicker on page load

This is a minor issue, I'm sure, but when a new view is loaded, there is a slight flicker possibly due to the scroll bar. It seems to render before the scrollbar then flick back when the scrollbar is present. This is the case even when both views required the scroll bar.

This is only really an issue because it loads so fast, but sorting this would make it much easier on the eye.

Related to this is the fade out/in of the views. Personally, I think it works much better without it (setting hide/show instead of fadeIn/fadeOut.

sort and search at /users

Usability bugs for post composer bar

1. Opening a new composer window while another is already open causes both window buttons to become active
2. Restoring/unminimizing a composer window should cause the other buttons to reset to default (inactive) state
3. Shenanigans when toggling through windows