Messages

1

Bug Fixes & Patches / Re: [1.7 - 1.7.3] Security fix for Cross-Site Scripting Vulnerability

« on: November 02, 2006, 11:20:01 AM »

I compared it again (took a copy from the server again where I've put the fixed file yesterday ...)

Yes, both are exactely the same

BUT

Don't ask me why. I've had a look on my gallery just now ... the error messages are gone ...    seems that a miracle occured, doesn't it???

I am even able to log in again.   

So everything is OK. I will check it out tomorrow again ... I hope the bloody messages won't be back again. 

Thanks Nicky an Jan for your time and support

So lets go on with daily business ...

regards

Tobi

2

Bug Fixes & Patches / Re: [1.7 - 1.7.3] Security fix for Cross-Site Scripting Vulnerability

« on: November 02, 2006, 10:32:01 AM »

 

Thats funny...

my global.php ends with line 438 already.  :

here are the last lines of my global.php (426 to 438):

Code: [Select]

  $sql = "SELECT cat_id, COUNT(*) AS num_images
          FROM ".IMAGES_TABLE."
          WHERE image_active = 1
          GROUP BY cat_id";
  $result = $site_db->query($sql);

  while ($row = $site_db->fetch_array($result)) {
    $cat_cache[$row['cat_id']]['num_images'] = $row['num_images'];
  }
  $site_db->free_result();
} //end if GET_CACHES

?>

Just as a relation. The bugfix line lies between 166 to 169:

Code: [Select]

if (isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode'])) {
  $mode = (isset($HTTP_POST_VARS['mode'])) ? stripslashes(trim($HTTP_POST_VARS['mode'])) : stripslashes(trim($HTTP_GET_VARS['mode']));
  $mode = preg_replace("/[^a-z0-9]+/i", "", $mode);
}

regards

BitBull

3

Bug Fixes & Patches / Re: [1.7 - 1.7.3] Security fix for Cross-Site Scripting Vulnerability

« on: November 01, 2006, 01:05:26 PM »

most certainly yes!

But hopefully someone can "understand" these messages and give me a hint where the problem could be to find ...

For me it seems that it has something to do with the header-file because there I integrated the menu etc. of my site. Can it be that with these additions the new line in the global.php has a problem? ...

The mentioned 2 lines in the sessions.php are:
86:

Code: [Select]

    session_start();
and 94:

Code: [Select]

    setcookie($cookie_name, $value, $cookie_expire, COOKIE_PATH, COOKIE_DOMAIN, COOKIE_SECURE);
BitBull

4

Bug Fixes & Patches / Re: [1.7 - 1.7.3] Security fix for Cross-Site Scripting Vulnerability

« on: November 01, 2006, 12:45:07 PM »

Hmmm ... I guess thats not the problem really.

I am using Phase 5 (HTML Editor). I am using that editor ever and I did all my work on my sites with that editor.

I also removed the fix in global.php with this editor and everything works properly again ...

... but so I haven't applied the security fix.

Any other idea?

thanks and regards

BitBull

5

Bug Fixes & Patches / Re: [1.7 - 1.7.3] Security fix for Cross-Site Scripting Vulnerability

« on: November 01, 2006, 11:25:26 AM »

  I tried to log on as registered user ...

There are even more of these messages and I am not able to log in anymore!  : : :

Some guesses somewhere?

regards

BitBull

6

Bug Fixes & Patches / Re: [1.7 - 1.7.3] Security fix for Cross-Site Scripting Vulnerability

« on: November 01, 2006, 10:32:04 AM »

Hi,

I just applied the security fix and viewed the result.

The page in general looks like it has been before but on the Top of the page there are now a lot of additional system messages: 

Code: [Select]

cache[$row['cat_id']] = $row['new_images']; } $site_db->free_result(); // -------------------------------------- $sql = "SELECT cat_id, COUNT(*) AS num_images FROM ".IMAGES_TABLE." WHERE image_active = 1 GROUP BY cat_id"; $result = $site_db->query($sql); while ($row = $site_db->fetch_array($result)) { $cat_cache[$row['cat_id']]['num_images'] = $row['num_images']; } $site_db->free_result(); } //end if GET_CACHES ?>
Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /homepages/blablabla/publik/global.php:450) in /homepages/blablabla/publik/includes/sessions.php on line 86

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /homepages/blablabla/publik/global.php:450) in /homepages/blablabla/publik/includes/sessions.php on line 86

Warning: Cannot modify header information - headers already sent by (output started at /homepages/blablabla/publik/global.php:450) in /homepages/blablabla/publik/includes/sessions.php on line 94

Warning: Cannot modify header information - headers already sent by (output started at /homepages/blablabla/publik/global.php:450) in /homepages/blablabla/publik/includes/sessions.php on line 94

I integrated the gallery in the layout of my site. Can it be that the script tries to modify that layout now too?
What can these messages mean? 

regards

BitBull

7

Mods & Plugins (Releases & Support) / Re: [MOD] Batch Copy/Move/Edit Images v3.7.2

« on: July 25, 2006, 11:04:58 AM »

Hi v@no,

I really like that MOD! hot work! 

hmmm....  ... but as zaisk already mentioned ...

But this mod can be helpful for me just if I add extra db fields in quick edit.

Please help me to add more 2 fields in quick editting.

... I got some additional db-fields as well and the batch-editing is just a real help when it supports the editing of these extra fields as well. 

I am watching this thread now for a while, but you haven't mentioned anything to this point so far ... 

From your point of view, is there a way to edit the extra db-fileds within your MOD?  ... are you eventually working on that improvement already?

Don't get me wrong, please - no pressure at all!  ... just let us know whether you are planning to improve your MOD (so we can hope for help) or not.

Thanks a lot v@no! 

best regards

BitBull
__________

www.noether.net/publik/