Again, thank you for the prompt answer!

Thank you for the answer.

Regarding the second point: But thus the message would only be received by one user. So if there is only one administrator this wouldn't be a problem. But if there are multiple administrators?

To be honest I don't have a use case for this. Putting it in the uid_<uid_of_user> room would be enough for me. So the question is just out of curiousness.

So I'm currently trying to figure out the plugin development with NodeBB. I think I finally found out how the whole communication between a page in the ACP and the plugin works. But I'm now facing a security concern that I'm unclear how to solve.

Actually the problem is twofold:

1. If I expose functions in the plugin, what is the best way to make sure that only administrators can call them? Looking at other plugins like the Shoutbox plugin, they add their plugin functions to the admin object. Thus resulting in calls to admin.plugins.my-great-plugin.my-great-function. This way they use the before function in the admin object that makes sure that only an administrator can call the function. Is this the preferred way to do it? Or should I stay out of this namespace?
2. If I send events to the client, how can I make sure those are only received by an administrator? As far as I could tell everyone that is logged in can join the admin room. Thus if my plugin sends events to the admin room everyone can receive them. Just open your web console and type in app.enterRoom('admin') and you receive all those events. What can I do to prevent this?

Definitely were the cookies. Digged in the code and found the problem in src/middleware/index.js. Created a pull request that fixes this problem:
https://github.com/NodeBB/NodeBB/pull/4663

I tried to run two NodeBB forums in parallel. And apparently they interfere with each other regarding CSRF tokens and SID.

I setup two independ copies of NodeBB /opt/nodebb/tf1 (port 4567) and /opt/nodebb/tf2 (port 4568). Both are proxied through an Apache 2.4 server. The config file of the server looks like:

<VirtualHost *:80>
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/html

        ProxyRequests off

        <Proxy *>
                Order deny,allow
                Allow from all
        </Proxy>

        RewriteEngine On

        RewriteCond %{REQUEST_URI}  ^/tf1/socket.io            [NC]
        RewriteCond %{QUERY_STRING} transport=websocket        [NC]
        RewriteRule /tf1/(.*)       ws://localhost:4567/tf1/$1 [P,L]

        ProxyPass /tf1/ http://localhost:4567/tf1/
        ProxyPassReverse /tf1/ http://localhost:4567/tf1/


        RewriteCond %{REQUEST_URI}  ^/tf2/socket.io            [NC]
        RewriteCond %{QUERY_STRING} transport=websocket        [NC]
        RewriteRule /tf2/(.*)       ws://localhost:4568/tf2/$1 [P,L]

        ProxyPass /tf2/ http://localhost:4568/tf2/
        ProxyPassReverse /tf2/ http://localhost:4568/tf2/
</VirtualHost>

Looking at the cookies I have, it seems to me that the express.sid cookie might be the culprit. Its path is set to / instead to either /tf1/ or /tf2/.

Well, after that post I went digging in the code. And look what I found:
https://github.com/NodeBB/nodebb-plugin-composer-default/issues/37
https://github.com/NodeBB/NodeBB/pull/4621

That actually fixes my issues. I updated to weekly and everything seems to work nicely. Seems to have also fixed the problem with the websockets. I see no more errors. When can we expect the v1.0.4?

AdJones created this issue in NodeBB/nodebb-plugin-composer-default

closed Errors when using NodeBB in a subfolder with latest version #37

Short update:

I further analyzed this. Apparently there are at least two different problems. I'm getting a websocket connection abort, something about an invalid frame header in acp.js. This part I'm not much further as of yet.

The other thing is a problem with loading some Javascript files. For example Chart.js and mousetrap.js. Quite interestingly those are files that aren't provided in the public directory but instead are coming from node_modules. The ones in the public directory are being loaded correctly.

I'm currently testing NodeBB (1.0.3). I wanted to setup NodeBB on a test installation in a subfolder. Seemed to work quite fine until I ran into troubles with the administration page. For some reasons I never managed to load the dashboard traffic graph. Looking at the network traffic it seemed that the websocket connection was kind of unreliable. Sometimes it worked, sometimes it didn't.

My config.json:

{
    "url": "http://localhost:8080/tf1",
    "port": 4567,
    "secret": "f045d8a3-d438-4a37-8a6f-aacbbeddf0ce",
    "database": "mongo",
    "mongo": {
        "host": "127.0.0.1",
        "port": "27017",
        "username": "nodebb",
        "password": "nodebb",
        "database": "nodebb"
    }
}

And my apache configuration:

<VirtualHost *:80>
    ServerName nodebb.localhost
    DocumentRoot /var/www/html

    ProxyRequests off

    <Proxy *>
            Order deny,allow
            Allow from all
    </Proxy>

    RewriteEngine On

    RewriteCond %{REQUEST_URI}  ^/tf1/socket.io            [NC]
    RewriteCond %{QUERY_STRING} transport=websocket        [NC]
    RewriteRule /tf1/(.*)       ws://localhost:4567/tf1/$1 [P,L]

    ProxyPass /tf1/ http://localhost:4567/tf1/
    ProxyPassReverse /tf1/ http://localhost:4567/tf1/
</VirtualHost>

NodeBB and the Apache server are running in a virtual machine attached through a NAT with port forwarding on the localhost of the host machine. Port forwarding is setup for host:8080 to guest:80.

The forum itself seemed to work fine. Also for example the Manage->Categories loaded all categories fine. But the dashboard didn't wanted to load. I tested it in the latest Firefox (46.0.1) and latest stable Vivaldi (1.1.453.59). When I looked at the network overview from the Chrome Developer Tools in Vivaldi, I saw that some things were loaded through the websockets. But sometimes it seems there were timeouts or something like that: (Opcode -1).

When I removed the "/tf1" subfolder everything worked fine. Any help would be appreciated.