Author Topic: [1.7 / 1.7.1] Security fix in search.php and register.php (Read 187408 times)

V@no · « **on:** December 27, 2005, 10:19:37 AM »

This is an important security fix.

Это очень важная заплатка для опасной дыры в скрипте

Step 1

In search.php any variables or other code that is located _below copyright notice

В search.php всё что находится ниже копирайта (который заканьчиватся этой строкой):

Code: [Select]

*************************************************************************/

and ^above

и выше:

Code: [Select]

$main_template = 'search';

must be moved _below

должно быть перенесено ниже:

Code: [Select]

include(ROOT_PATH.'global.php');

In default 4images, the block that must be moved is:

В свежей 4images кусок кода который должен быть перемещён выглядит так:

Code: [Select]

if (isset($HTTP_POST_VARS['show_result']) || isset($HTTP_GET_VARS['show_result'])) {
  $show_result = 1;
}
else {
  $show_result = 0;
}

if (isset($HTTP_POST_VARS['search_keywords']) || isset($HTTP_GET_VARS['search_keywords'])) {
  $search_keywords = (isset($HTTP_POST_VARS['search_keywords'])) ? trim($HTTP_POST_VARS['search_keywords']) : urldecode(trim($HTTP_GET_VARS['search_keywords']));
  if ($search_keywords != "") {
    $show_result = 1;
  }
}
else {
  $search_keywords = "";
}
$org_search_keywords = $search_keywords;

if (isset($HTTP_POST_VARS['search_user']) || isset($HTTP_GET_VARS['search_user'])) {
  $search_user = (isset($HTTP_POST_VARS['search_user'])) ? trim($HTTP_POST_VARS['search_user']) : urldecode(trim($HTTP_GET_VARS['search_user']));
  if ($search_user != "") {
    $show_result = 1;
  }
}
else {
  $search_user = "";
}
$org_search_user = $search_user;

if (isset($HTTP_POST_VARS['search_terms'])) {
  $search_terms = (trim($HTTP_POST_VARS['search_terms']) == "all") ? 1 : 0;
}
else {
  $search_terms = 0;
}

if (isset($HTTP_POST_VARS['search_fields'])) {
  $search_fields = trim($HTTP_POST_VARS['search_fields']);
}
else {
  $search_fields = "all";
}

$search_cat = (isset($HTTP_POST_VARS['cat_id']) ) ? intval($HTTP_POST_VARS['cat_id']) : 0;

if (isset($HTTP_POST_VARS['search_new_images']) || isset($HTTP_GET_VARS['search_new_images'])) {
  $search_new_images = 1;
  $show_result = 1;
}
else {
  $search_new_images = 0;
}

Step 2

In register.php find:

В register.php найдите:

Code: [Select]

      if ($site_db->not_empty($sql)) {
        $msg .= (($msg != "") ? "<br />" : "").$lang['username_exists'];
        $error = 1;
      }

Insert _below:

Добавьте ниже:

Code: [Select]

      elseif (preg_match("#[<>]#", $user_name))
      {
        $msg .= (($msg != "") ? "<br />" : "").$lang['username_bad_characters'];
        $error = 1;
      }

Then in lang/<your language>/main.php at the end, ^above closing ?> insert:

Затем в lang/<ваш языковой пакет>/main.php в самый конец файла, выше закрывающей ?> добавьте:

Code: [Select]

$lang['username_bad_characters'] = "Username contains not allowed character(s)";

Step 3

In global.php find:

В global.php найдите:

Code: [Select]

//-----------------------------------------------------
//--- Start DB ----------------------------------------
//-----------------------------------------------------

Insert ^above:

Добавьте ^выше:

Code: [Select]

if (isset($HTTP_POST_VARS['show_result']) || isset($HTTP_GET_VARS['show_result'])) {
  $show_result = 1;
}
else {
  $show_result = 0;
}

if (isset($HTTP_POST_VARS['search_keywords']) || isset($HTTP_GET_VARS['search_keywords'])) {
  $search_keywords = (isset($HTTP_POST_VARS['search_keywords'])) ? trim($HTTP_POST_VARS['search_keywords']) : urldecode(trim($HTTP_GET_VARS['search_keywords']));
  if ($search_keywords != "") {
    $show_result = 1;
  }
}
else {
  $search_keywords = "";
}

if (isset($HTTP_POST_VARS['search_user']) || isset($HTTP_GET_VARS['search_user'])) {
  $search_user = (isset($HTTP_POST_VARS['search_user'])) ? trim($HTTP_POST_VARS['search_user']) : urldecode(trim($HTTP_GET_VARS['search_user']));
  if ($search_user != "") {
    $show_result = 1;
  }
}
else {
  $search_user = "";
}

if (isset($HTTP_POST_VARS['search_new_images']) || isset($HTTP_GET_VARS['search_new_images'])) {
  $search_new_images = 1;
  $show_result = 1;
}
else {
  $search_new_images = 0;
}

If you wish, you can remove this block of code from search.php to increase perfomance (very insignificaly).

Если вы хотите, то можете удалить такой-же блок кода из search.php, но это не обязательно.

In the attachment below you can find already modifyed default search.php, register.php and global.php

Вы можете загрузить исправленные search.php, register.php и global.php из приложеного архива.

piet · « **Reply #1 on:** December 27, 2005, 02:28:52 PM »

Thank you very much!

TheOracle · « **Reply #2 on:** December 27, 2005, 03:07:20 PM »

Actually, I don't get this ...

why would :

Quote

$main_template = 'search';

need to be moved below the global.php line ?

All 4images's PHP files (on the root path - even the index.php file) has the $main_template string on top of the GET_CACHES line ...

V@no · « **Reply #3 on:** December 27, 2005, 03:14:42 PM »

That is why my earlier suggestion was "Re-read three times, reply ones"

There is nothing says about moving that line...it says "the code above it"

Eagle Eye · « **Reply #4 on:** December 27, 2005, 05:43:40 PM »

Thanks

Acidgod · « **Reply #5 on:** December 27, 2005, 07:46:49 PM »

Also Du hast es richtig gemacht... Vielleicht hätte V@no es so schreiben sollen... (o:

move the code between

Code: [Select]

*************************************************************************/
and

Code: [Select]

$main_template = 'search';
_belowthis Line:

Code: [Select]

include(ROOT_PATH.'global.php');

torment · « **Reply #6 on:** December 28, 2005, 09:26:34 AM »

das selbe problem habe ich auch...

nach diesem fix konnte man nicht als #username# registieren konnen. aber das funktioniert bei mir auch nicht.

V@no · « **Reply #7 on:** December 28, 2005, 02:47:47 PM »

mmm...it was not ment restrict all "special" characters, but only < and >

V@no · « **Reply #8 on:** December 28, 2005, 03:05:04 PM »

no, it calls "Regular expression" (aka REGEX) http://php.net/manual/function.preg-match.php
The pattern search only < and > in the name, nothing else.

RoadDogg · « **Reply #9 on:** December 29, 2005, 11:21:18 AM »

Thanks for the fix, V@no!

brakstar · « **Reply #10 on:** December 30, 2005, 12:55:24 AM »

Hi all, What they can do without this fix ?

:

I have a 1.1 beta 3 p version of smf ....

V@no · « **Reply #11 on:** December 30, 2005, 01:06:35 AM »

hmmm....huh?
what SMF has anything to do with 4images? this is 4images support forum not SMF

Ston4Img · « **Reply #12 on:** January 01, 2006, 06:32:46 PM »

Quote from: V@no on December 28, 2005, 03:05:04 PM

no, it calls "Regular expression" (aka REGEX) http://php.net/manual/function.preg-match.php
The pattern search only < and > in the name, nothing else.

Mhh. I can register a User with < and > after the Update !!!

:

Edit:
My register.php:
/** START **********************************************
ADD ab elseif
Sercurity Update 27.12.2005
http://www.4homepages.de/forum/index.php?topic=10921.0
*******************************************************/

      if ($site_db->not_empty($sql)) {
        $msg .= (($msg != "") ? "<br />" : "").$lang['username_exists'];
        $error = 1;
      }
    }
    elseif (preg_match("#[<>]#", $user_name))
      {
        $msg .= (($msg != "") ? "<br />" : "").$lang['username_bad_characters'];
        $error = 1;
      }

/** ENDE **********************************************
ADD
Sercurity Update 27.12.2005
http://www.4homepages.de/forum/index.php?topic=10921.0
*******************************************************/

fotograf74 · « **Reply #13 on:** January 08, 2006, 02:27:49 PM »

Hmm,

I fixed my code, but now I can´t use the search function. I get no result.
I think that was not your idea with the sexurity fix.

What´s the problem. I use now the old code again.

Ston4Img · « **Reply #14 on:** January 08, 2006, 03:11:54 PM »

Servus Fotograf74.
Irgendwelche Modifikationen bereits eingebaut? Wenn nicht lade dir 4Images erneut runter und tausche die Dateien aus.

Have you some modification in your 4images? Download 4images again and insert the orginal files.

4images Forum & Community

News:

Author Topic: [1.7 / 1.7.1] Security fix in search.php and register.php (Read 187408 times)

V@no

[1.7 / 1.7.1] Security fix in search.php and register.php

piet

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

TheOracle

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

V@no

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

Eagle Eye

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

Acidgod

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

torment

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

V@no

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

V@no

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

RoadDogg

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

brakstar

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

V@no

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

Ston4Img

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

fotograf74

Re: [1.7 / 1.7.1] Security fix in search.php and register.php

Ston4Img

Re: [1.7 / 1.7.1] Security fix in search.php and register.php