« previous next »
Pages: [1]

Author Topic: [1.7 - 1.7.6] Security fix in global.php  (Read 85561 times)

0 Members and 1 Guest are viewing this topic.

Offline V@no

  • If you don't tell me what to do, I won't tell you where you should go :)
  • Global Moderator
  • 4images Guru
  • *****
  • Posts: 17.849
  • mmm PHP...
    • View Profile
    • 4images MODs Demo
[1.7 - 1.7.6] Security fix in global.php
« on: April 02, 2009, 03:27:36 PM »
In global.php find:

4images version 1.7

if (isset($HTTP_GET_VARS['l']) || isset($HTTP_POST_VARS['l'])) {
  $l = (isset($HTTP_GET_VARS['l'])) ? trim($HTTP_GET_VARS['l']) : trim($HTTP_POST_VARS['l']);
  if (file_exists(ROOT_PATH.'lang/'.$l.'/main.php')) {
    $config['language_dir'] = $l;
  }
}

Replace it with:

$l = null;
if (isset($HTTP_GET_VARS['l']) || isset($HTTP_POST_VARS['l'])) {
  $requested_l = (isset($HTTP_GET_VARS['l'])) ? trim($HTTP_GET_VARS['l']) : trim($HTTP_POST_VARS['l']);
  if (!preg_match('#\.\.[\\\/]#', $requested_l) && $requested_l != $config['language_dir'] && file_exists(ROOT_PATH.'lang/'.$requested_l.'/main.php')) {
    $l = $requested_l;
    $config['language_dir'] = $l;
  }
}




4images version 1.7.1 - 1.7.6

  if ($requested_l != $config['language_dir'] && file_exists(ROOT_PATH.'lang/'.$requested_l.'/main.php')) {

Replace it with:

  if (!preg_match('#\.\.[\\\/]#', $requested_l) && $requested_l != $config['language_dir'] && file_exists(ROOT_PATH.'lang/'.$requested_l.'/main.php')) {




For these who installed [MOD] Language select with cookies support and can't find anything mentioned above, then you'll need find in global.php:

if (isset($HTTP_GET_VARS['l']) || isset($HTTP_POST_VARS['l'])) {
  $l = (isset($HTTP_GET_VARS['l'])) ? trim($HTTP_GET_VARS['l']) : trim($HTTP_POST_VARS['l']);
  if (file_exists(ROOT_PATH.'lang/'.$l.'/main.php')) {
    $config['language_dir'] = $l;
    setcookie('4images_lang', $l, (time()+ 60 * 60 * 24 * 365), "/", "", 0);
  }
}
else
{
  if (isset($HTTP_COOKIE_VARS['4images_lang']) && file_exists(ROOT_PATH.'lang/'.$HTTP_COOKIE_VARS['4images_lang'].'/main.php'))
  {
    $l = $config['language_dir'] = $HTTP_COOKIE_VARS['4images_lang'];
  }
}


And replace it with:

if (isset($HTTP_GET_VARS['l']) || isset($HTTP_POST_VARS['l'])) {
  $requested_l = (isset($HTTP_GET_VARS['l'])) ? trim($HTTP_GET_VARS['l']) : trim($HTTP_POST_VARS['l']);
  if (!preg_match('#\.\.[\\\/]#', $requested_l) && file_exists(ROOT_PATH.'lang/'.$requested_l.'/main.php')) {
    $l = $requested_l;
    $config['language_dir'] = $l;
    setcookie('4images_lang', $l, (time()+ 60 * 60 * 24 * 365), "/", "", 0);
  }
}
else
{
  if (isset($HTTP_COOKIE_VARS['4images_lang']) && !preg_match('#\.\.[\\\/]#', $HTTP_COOKIE_VARS['4images_lang']) && file_exists(ROOT_PATH.'lang/'.$HTTP_COOKIE_VARS['4images_lang'].'/main.php'))
  {
    $l = $config['language_dir'] = $HTTP_COOKIE_VARS['4images_lang'];
  }
}

(I've already updated the code in the mentioned mod with this fix)


P.S.
thanks to 4dabdura for reporting this bug and Jan for providing us with the fix.
« Last Edit: April 11, 2009, 03:06:14 AM by V@no »
Logged
Your first three "must do" before you ask a question:
Please do not PM me asking for help unless you've been specifically asked to do so. Such PMs will be deleted without answer. (forum rule #6)
Extension for Firefox/Thunderbird: Master Password+    Back/Forward History Tweaks (restartless)    Cookies Manager+    Fit Images (restartless for Thunderbird)

Offline kai

  • Administrator
  • Addicted member
  • *****
  • Posts: 1.423
    • View Profile
    • 4images - Image Gallery Management System
Re: [1.7 - 1.7.6] Security fix in global.php
« Reply #1 on: April 02, 2009, 08:37:48 PM »
Thanks V@no!
Logged
Your first three "must do" before you ask a question:
1. Forum rules
2. FAQ
3. Search

Offline mawenzi

  • 4images Moderator
  • 4images Guru
  • *****
  • Posts: 4.500
    • View Profile
Re: [1.7 - 1.7.6] Security fix in global.php
« Reply #2 on: April 02, 2009, 10:05:17 PM »
... thanks V@no for your fix for version 1.7 - 1.7.6 ...
Logged
Your first three "must do" before you ask a question ! ( © by V@no )
- please read the Forum Rules ...
- please study the FAQ ...
- please try to Search for your answer ...
You are on search for top 4images MOD's ?
- then please search here ... Mawenzi's Top 100+ MOD List (unsorted sorted) ...

Offline sanko86

  • Sr. Member
  • ****
  • Posts: 310
    • View Profile
    • Elemegim
Re: [1.7 - 1.7.6] Security fix in global.php
« Reply #3 on: April 03, 2009, 03:33:01 PM »
thank you  V@no
this is  important edit
Logged
Web site:http://www.anlatiyoruz.com
Hayat zorluklarla doludur.Ama en zoru insanýn insana düþmanlýðýdýr.

Offline om6acw

  • Full Member
  • ***
  • Posts: 187
    • View Profile
    • My Animal's World
Re: [1.7 - 1.7.6] Security fix in global.php
« Reply #4 on: April 06, 2009, 07:01:20 PM »
thanks V@no!
Logged

Offline V@no

  • If you don't tell me what to do, I won't tell you where you should go :)
  • Global Moderator
  • 4images Guru
  • *****
  • Posts: 17.849
  • mmm PHP...
    • View Profile
    • 4images MODs Demo
Re: [1.7 - 1.7.6] Security fix in global.php
« Reply #5 on: April 08, 2009, 03:03:04 PM »
« Last Edit: April 09, 2009, 02:06:34 AM by V@no »
Logged
Your first three "must do" before you ask a question:
Please do not PM me asking for help unless you've been specifically asked to do so. Such PMs will be deleted without answer. (forum rule #6)
Extension for Firefox/Thunderbird: Master Password+    Back/Forward History Tweaks (restartless)    Cookies Manager+    Fit Images (restartless for Thunderbird)

Offline Sunny C.

  • Addicted member
  • ******
  • Posts: 1.808
  • I ♥ 4I
    • View Profile
Re: [1.7 - 1.7.6] Security fix in global.php
« Reply #6 on: April 08, 2009, 07:05:35 PM »
Habt ihr das im "Downloadpaket" schon beigefügt? Damit andere, die 4images z.B heute einsetzen wollen bzw. downloaden wollen das nicht hier extra suchen müssen!
Logged

Offline yesme

  • Jr. Member
  • **
  • Posts: 61
  • Yes for 4images!
    • View Profile
Re: [1.7 - 1.7.6] Security fix in global.php
« Reply #7 on: April 10, 2009, 02:46:21 PM »
Hi,

Thank V@no for the updates and fix.   :)

Regards,
Yesme
Logged
Love 4images! @--^-----

Offline Jasi

  • Jr. Member
  • **
  • Posts: 74
    • View Profile
Re: [1.7 - 1.7.6] Security fix in global.php
« Reply #8 on: April 10, 2009, 05:34:15 PM »
Hi,

Thank V@no for the updates and fix.  :)

Best Regards,
Jasi

----------------------------------------------------------

Danke V@no für's Update und den Fix !  :)

Beste Grüße
Jasi
Logged
LG Jasi

Offline Blackman5001

  • Pre-Newbie
  • Posts: 8
    • View Profile
Re: [1.7 - 1.7.6] Security fix in global.php
« Reply #9 on: April 13, 2009, 09:52:48 PM »
Quote from: Benny on April 08, 2009, 07:05:35 PM
Habt ihr das im "Downloadpaket" schon beigefügt? Damit andere, die 4images z.B heute einsetzen wollen bzw. downloaden wollen das nicht hier extra suchen müssen!

Ist nicht drin. Habe es gestern runtergeladen und installiert und jetzt die Änderungen gemacht.
Logged

Offline softxgame

  • Newbie
  • *
  • Posts: 12
    • View Profile
Re: [1.7 - 1.7.6] Security fix in global.php
« Reply #10 on: May 06, 2009, 06:04:45 AM »
Thank you for the follow-up
Logged
Links from my profile were removed and I'm about to get banned for spam.
One more stupid post and I'm gone. Ops, I did it again..."thank you for the subject" - what kind of reply is this? now I'm banned for sure.

Offline takeiteasy

  • Pre-Newbie
  • Posts: 1
    • View Profile
Re: [1.7 - 1.7.6] Security fix in global.php
« Reply #11 on: August 03, 2009, 06:30:17 AM »
Thank you very much :D






I'm banned for spam. All links were removed. One message is more then enough.
« Last Edit: August 03, 2009, 07:24:59 AM by V@no »
Logged

Offline soft4arab

  • Pre-Newbie
  • Posts: 2
    • View Profile
    • برامج
Re: [1.7 - 1.7.6] Security fix in global.php
« Reply #12 on: August 11, 2009, 01:50:52 PM »
« Last Edit: April 12, 2011, 08:32:35 PM by soft4arab »
Logged
Pages: [1]
« previous next »