• are
  • DeltaScripts Developer
  • Offline
  • From: Norway
  • Registered: 2001-02-10
  • Posts: 7,452

Topic: Important Security Patch for 6.18-6.20

I recieved information yeasterday about a potential security risk in PHP Classifieds 6.20, and 6.18/6.19 will probably also be affected. You need to upgrade imidiatly! This issue lets a user without password login and publish ads if you know one of the emailaddresses registered in the system.

It will only be a problem on servers running with magic_quotes_gpc = Off. If you have a Cpanel server, you are not affected in most cases since Magic_quotes_gpc is default.

To check if you can be affected, put a php file named test.php with content <? phpinfo(); ?> in a web folder and access it from your web-browser. Magic_quotes_gpc shall be ON to be secure.

Two ways to solve.

Either:

- Set magic_quotes_gpc = On in file php.ini on your server, it will also increase security for entire server.

OR:

- Visit our Download Area and replace member_login.php with the one in the .zip file there (Security Patch).

Package 6.20 has also been updated today with this fix. If you have downloaded after 13.02.2006, you are secure.

Regards,
Are

http://www.deltascripts.com

are's Website

+ -

  • Revan
  • Some experience
  • Offline
  • Registered: 2005-12-15
  • Posts: 74

Re: Important Security Patch for 6.18-6.20

I updated the file and testing on localhost it was imposible to me log in whit my old user.

I had magic_quotes_gpc = On

+ -

  • are
  • DeltaScripts Developer
  • Offline
  • From: Norway
  • Registered: 2001-02-10
  • Posts: 7,452

Re: Important Security Patch for 6.18-6.20

Find this line:
//$_SESSION["valid_user"] = $valid_user;

And uncomment to be like this:
$_SESSION["valid_user"] = $valid_user;

Updated files.

Regards,
Are

http://www.deltascripts.com

are's Website

+ -

  • McGill
  • Experienced user
  • Offline
  • Registered: 2003-11-27
  • Posts: 1,160

Re: Important Security Patch for 6.18-6.20

The patch I downloaded has it commented out

Man in a suitcase

+ -

  • McGill
  • Experienced user
  • Offline
  • Registered: 2003-11-27
  • Posts: 1,160

Re: Important Security Patch for 6.18-6.20

Hi,
should it be commented out or not as it is not commented out in the downloaded patch

Man in a suitcase

+ -

  • Registered: 2005-08-24
  • Posts: 30

Re: Important Security Patch for 6.18-6.20

After I replaced it (v6.18), all users can't login, so I have rolled back.. Please advice

+ -

  • are
  • DeltaScripts Developer
  • Offline
  • From: Norway
  • Registered: 2001-02-10
  • Posts: 7,452

Re: Important Security Patch for 6.18-6.20

Should not be commented out. It sets the session cookie. I disabled session cookies during testing so that I didn

Regards,
Are

http://www.deltascripts.com

are's Website

+ -

  • McGill
  • Experienced user
  • Offline
  • Registered: 2003-11-27
  • Posts: 1,160

Re: Important Security Patch for 6.18-6.20

Hi,
but the patch that is in the download area IS commented out

Man in a suitcase

+ -

  • are
  • DeltaScripts Developer
  • Offline
  • From: Norway
  • Registered: 2001-02-10
  • Posts: 7,452

Re: Important Security Patch for 6.18-6.20

Ok.. Use the member_login.php in the 6.20 instead, I verified that it is correct.

Regards,
Are

http://www.deltascripts.com

are's Website

+ -

  • Maxx
  • Some experience
  • Offline
  • Registered: 2006-02-27
  • Posts: 45

Re: Important Security Patch for 6.18-6.20

Hi,

do have the user login problem as well - installed 6.20 -  I tried with and without security patch...

What to do ? I fear to purchase a license and it does not work proper.

Best regards

Maximillian

Polskaweb - Polen in deutscher Sprache - Poland in German Language
News, Events, Dating, Traveling, Foto Bank and more..  www.polhost.de  www.singles-polen.de   20 000 Members

+ -

11 Reply by are

  • are
  • DeltaScripts Developer
  • Offline
  • From: Norway
  • Registered: 2001-02-10
  • Posts: 7,452

Re: Important Security Patch for 6.18-6.20

Use the one with 6.20, it is repacked with the fixed version of member_login.php.

Regards,
Are

http://www.deltascripts.com

are's Website

+ -

  • Maxx
  • Some experience
  • Offline
  • Registered: 2006-02-27
  • Posts: 45

Re: Important Security Patch for 6.18-6.20

Thanks for the info...

No way !  tried with 3 new users, 3 different browsers and different chmods, with and without Email verificacion.

best regards

Maximillian

Polskaweb - Polen in deutscher Sprache - Poland in German Language
News, Events, Dating, Traveling, Foto Bank and more..  www.polhost.de  www.singles-polen.de   20 000 Members

+ -

  • Registered: 2002-07-05
  • Posts: 125

Re: Important Security Patch for 6.18-6.20

It looks member_login.php was changed in 6.20 recently but the version was not updated?
I had 6.20 downloded in Jan and I downloaded it again today and I saw the memer_login.php has this new function
function lnonly($string) {
return eregi( "^[a-z0-9]+$", $string );
}

which was not there in the earlier version on 6.20.   Just wondering what this does and if it is causing problem for some folks.

+ -

  • Maxx
  • Some experience
  • Offline
  • Registered: 2006-02-27
  • Posts: 45

Re: Important Security Patch for 6.18-6.20

so far I did not get any useful help in this case  I took an old version from the member_login.php and it works, sure included the known bug.

nevertheless I am still ready to purchase the license, but please with a proper working member_login.php.

Polskaweb - Polen in deutscher Sprache - Poland in German Language
News, Events, Dating, Traveling, Foto Bank and more..  www.polhost.de  www.singles-polen.de   20 000 Members

+ -

  • Maxx
  • Some experience
  • Offline
  • Registered: 2006-02-27
  • Posts: 45

Re: Important Security Patch for 6.18-6.20

Hi community,

I`ve got some heavy problems with the 6.20 version and these problems are here only partly mentioned without any practical solution, so I am so kind to post the things here on this place.

I bought some mods from Alex, not a great Idea, so far they installation description was made for older versions and not updatet. I had hell a lot of work to get the multilanguage mod working, only partly working, more was not possible.

This 6.20 was now about 2 months, more or less, working but from yesterday, without any understandable reason I do have the following problems:

ADMIN  cannot   , delete, approve ads

USER  cannot pay cause payment site does not open, does not see uploaded pictures, cannot delete pictures.

Question:  Has anyone a 100% working multilanguage 6.20 ?

Thank you very much !

Maxx

Last edited by Maxx (2006-05-08 21:59:42)

Polskaweb - Polen in deutscher Sprache - Poland in German Language
News, Events, Dating, Traveling, Foto Bank and more..  www.polhost.de  www.singles-polen.de   20 000 Members

+ -

  • Maxx
  • Some experience
  • Offline
  • Registered: 2006-02-27
  • Posts: 45

Re: Important Security Patch for 6.18-6.20

Maxx wrote:

Hi community,

I`ve got some heavy problems with the 6.20 version and these problems are here only partly mentioned without any practical solution, so I am so kind to post the things here on this place.

I bought some mods from Alex, not a great Idea, so far they installation description was made for older versions and not updatet. I had hell a lot of work to get the multilanguage mod working, only partly working, more was not possible.

This 6.20 was now about 2 months, more or less, working but from yesterday, without any understandable reason I do have the following problems:

ADMIN  cannot   , delete, approve ads

USER  cannot pay cause payment site does not open, does not see uploaded pictures, cannot delete pictures.

Question:  Has anyone a 100% working multilanguage 6.20 ?

Thank you very much !

Maxx

no answer is as well something like an answer....

Polskaweb - Polen in deutscher Sprache - Poland in German Language
News, Events, Dating, Traveling, Foto Bank and more..  www.polhost.de  www.singles-polen.de   20 000 Members

+ -

  • Maxx
  • Some experience
  • Offline
  • Registered: 2006-02-27
  • Posts: 45

Re: Important Security Patch for 6.18-6.20

Maxx wrote:
Maxx wrote:

Hi community,

I`ve got some heavy problems with the 6.20 version and these problems are here only partly mentioned without any practical solution, so I am so kind to post the things here on this place.

I bought some mods from Alex, not a great Idea, so far they installation description was made for older versions and not updatet. I had hell a lot of work to get the multilanguage mod working, only partly working, more was not possible.

This 6.20 was now about 2 months, more or less, working but from yesterday, without any understandable reason I do have the following problems:

ADMIN  cannot   , delete, approve ads

USER  cannot pay cause payment site does not open, does not see uploaded pictures, cannot delete pictures.

Question:  Has anyone a 100% working multilanguage 6.20 ?

Thank you very much !

Maxx

no answer is as well something like an answer....

By the way,  I found the solution myself and leave it here:

mysql: 

ALTER TABLE ad ADD PRIMARY KEY (id);
ALTER TABLE ad MODIFY id INTEGER NOT NULL AUTO_INCREMENT;

Thank you

Maximillian

Polskaweb - Polen in deutscher Sprache - Poland in German Language
News, Events, Dating, Traveling, Foto Bank and more..  www.polhost.de  www.singles-polen.de   20 000 Members

+ -