My first vBulletin project was sometime early last year. The code base was horribly outdated and spammers had littered the board with tens of thousands of posts. I managed to clean out most of those and turn on the built-in CAPTCHA in about three hours. Ultimately we failed to keep the spammers out and vBulletin was replaced with another forum software.

Another customer has recently decided to power their forums with vBulletin. The newest release has a built-in CMS and some other novel features. The problem is that they guard their “trade secrets” jealously and you have to go through a review process in order to gain access to their forums. Since my customer ordered vBulletin himself, I gave up on trying to figure them out.

One of the requirements for this project was a custom theme, complete with several special links and featured articles. If you are not familiar with vBulletin, here is the default layout:

Their template system has the ability to search for specific items. None of the links (mouse over or view source) showed up like I expected them to, except for the “What’s New?” link and that appeared in a number of template elements. That should have been my first clue about this modification.

A grep through the code base turned up an XML file that seemed to contain defaults for the database. includex/xml/product-vbcms.xml holds a reference to “content.php” (the “Home” link):

<setting varname="site_tab_url" displayorder="30">

    <datatype>free</datatype>

    <defaultvalue>content.php</defaultvalue>

</setting>

Sure enough, it was stashed in the database:

Interestingly, they keep a copy of the original value as well. In this case I have not changed anything so it is a duplicate of the current value.

A search for “site_tab_url” in the template returned a hit in the “vbcms_navbar_link” element.

Isn’t that great? No color coding and we have to use their administrative interface to edit the templates because of its complexity. Copy and Paste are friends.

This is where things go from bad to worse. The template is built on true OO principles, so each element of the theme does exactly one thing. The portion above decides whether or not to hilight the “Home” link as selected. There are no other navigation links in this section, which means that another theme section should reference this – right?

Wrong. No other theme elements reference vbcms_navbar_link. Back to searching the codebase. The linux “grep” command found the next step:

That .= operator is a string concatenation for PHP. The code from this XML file is a plugin and gets stored in the database. It will be eval()’d on page load by vBulletin. Yikes. Anyway, it looks like “vbcms_navbar_link” is tossed into the “navbar_start” variable and that one does appear in the template:

“navbar,” in turn, is directly referenced in a number of other template elements with the directive “{vb:raw navbar}.”

Whew, we have managed to trace a single link. For something as common as creating or modifying a theme, you would think that they could come up with a better way to manage the data. I’ve themed Drupal, Joomla and WordPress. The appearance of a website should not be this difficult.

Any thoughts?