Rename adoptables (Security issue fixed!)

Forum
Last Post
Threads / Messages
Status
Not open for further replies.

kisazeky

Member
Member
Joined
Mar 14, 2009
Messages
44
Points
0
Mysidian Dollar
11,537
Update: I fixed the "hacking" security issue, I think.

Step 1:

Download rename.php and rename2.php and put them in your main folder.

Step 2:

Add this link <a href='rename.php?id=$id'>Rename ".$name."</a> to myadoptables.php. Here is an example:

Find this line with ctrl + f.
PHP:
//Begin our content output...

Directly below it is
PHP:
$article_content=$article_content."<p align='center'><b><u>".$name.":</u></b></p>
<p align='center'><img src='".$imageurl."' border='0'></p>
<b>Current level of ".$name.": ".$currentlevel."<br></b><b>Total clicks on ".$name.": ".$totalclicks."<br></b>
<b>Clicks needed until LevelUP ".$name.": ".$neededclicks."<br></b><br>
<a href='levelup.php?id=".$id."'>Click Here to LevelUP ".$name.".</a>  (You can do this once per day)<br>
<a href='manage.php?id=".$id."&action=bbcode'>Click Here to get BBCODEs for ".$name.".</a> <br>
<a href='manage.php?id=".$id."&action=delete'>Click Here to Delete (Kill) ".$name.".</a> <br>
<a href='rename.php?id=$id'>Rename ".$name.".</a> <br>";

:)

Now the pages have been updated to display general messages.
 
RE: Rename adoptables (because we REALLY can't wait)

iluvu =)
 
RE: Rename adoptables (because we REALLY can't wait)

wow, thanks again for a great mod kisazeky :) , but where exactly do i add "rename.php?id=$id" ??

Can you help us all out with the shop mod though please ?? no-one can get it working :(
 
RE: Rename adoptables (because we REALLY can't wait)

OH MY GOSH. You are officially a genius ><
 
RE: Rename adoptables (because we REALLY can't wait)

rosepose, if you got it working, can you tell me where you added the link "rename.php?id=$id" please ??
 
RE: Rename adoptables (because we REALLY can't wait)

In rename.php

Some of you might wanna change this...

PHP:
	if($name == ""){
	$article_title = "Oops";
	$article_date = date('Y-m-d');
	$article_content = "This Digimon does not exist.";
	}
	else if($owner != $username){
	$article_title = "Oops";
	$article_date = date('Y-m-d');
	$article_content = "You do not own this Digimon!";
	}

Some might wanna change digimon to adopable or pet
 
RE: Rename adoptables (because we REALLY can't wait)

D'oh! Sorry. I changed it to display general messages.
 
RE: Rename adoptables (Updated!!)

The link you say to add doesnt work, you need to add it like this :

<a href='rename.php?id=".$id."&action=rename'>Click Here to rename ".$name.".</a> <br>
 
RE: Rename adoptables (Updated!!)

You sir, are a genius!

EDIT: It works fine on my site, just the way it is, So maybe you didn't have something right in your script page?
 
RE: Rename adoptables (Updated!!)

*****CAUTION********
I used this today.. worked great.. went out, .. came home.., GREY SCREEN!! I call my host for that site & asked.. they found a hack entry from the script!! They fixed the issue on ALL pages & emailed me some info on protection. I will read the email in the morning & give for info. But there is a security issue in the mod.

Sea
 
RE: Rename adoptables (Updated!!)

It doesnt filter for SQL injections i bet...
 
RE: Rename adoptables (Updated!!)

I included this

PHP:
$id = $_POST["id"];
$id = preg_replace("/[^a-zA-Z0-9s]/", "", $id);
$newname = $_POST["newname"];
$newname = preg_replace("/[^a-zA-Z0-9\\040.]/", "", $newname);

What do I need to include to filter these injections, Rsmiley?

Edit: Maybe this will protect it?

Adding this to functions.php:

PHP:
function cleanQuery($string)
{
  if(get_magic_quotes_gpc())  // prevents duplicate backslashes
  {
    $string = stripslashes($string);
  }
  if (phpversion() >= '4.3.0')
  {
    $string = mysql_real_escape_string($string);
  }
  else
  {
    $string = mysql_escape_string($string);
  }
  return $string;
}

Then adding this line in rename2.php:

PHP:
if (isset($_POST['newname'])) $newname = cleanQuery($_POST['newname']);


What do you think Rsmiley?

It certainly does not hurt anything.
 
RE: Rename adoptables (Updated!!)

It should be quite secure. I doubt it would be exploitable after that has been added.

You are safe with that added
 
RE: Rename adoptables (Updated!!)

kisazeky said:
I included this

PHP:
$id = $_POST["id"];
$id = preg_replace("/[^a-zA-Z0-9s]/", "", $id);
$newname = $_POST["newname"];
$newname = preg_replace("/[^a-zA-Z0-9\\040.]/", "", $newname);

What do I need to include to filter these injections, Rsmiley?

Edit: Maybe this will protect it?

Adding this to functions.php:

PHP:
function cleanQuery($string)
{
  if(get_magic_quotes_gpc())  // prevents duplicate backslashes
  {
    $string = stripslashes($string);
  }
  if (phpversion() >= '4.3.0')
  {
    $string = mysql_real_escape_string($string);
  }
  else
  {
    $string = mysql_escape_string($string);
  }
  return $string;
}

Then adding this line in rename2.php:

PHP:
if (isset($_POST['newname'])) $newname = cleanQuery($_POST['newname']);


What do you think Rsmiley?

It certainly does not hurt anything.

EDIT: I'm assuming that
PHP:
if (isset($_POST['newname'])) $newname = cleanQuery($_POST['newname']);
goes here:
Code:
$newname = $_POST["newname"];
but I get this error: "
PHP Error Message

Parse error: syntax error, unexpected T_IF in /home/---------/public_html/rename2.php on line 78

Free Web Hosting"
 
RE: Rename adoptables (Updated!!)

No, don't do that.

Add

PHP:
if (isset($_POST['newname'])) $newname = cleanQuery($_POST['newname']);

below

PHP:
$newname = $_POST["newname"];

Edit: Wait a minute, I just realized. Rusnak had the post data things before the connect to database script. That makes sense, hijackers can't input manipulative data if they don't have access to the database yet.
 
Cool :) Thanks for the fix
:)
Sea

***EDIT***
**FYI**
This is an edit just because I do tend to hear things. I have just heard a rumor that Soleria stole code, just because they used this script without changing the Digimon reference. I corrected the person before they took this rumor further, but that is how easy rumors can start in this field. So please make sure you offer generic scripts & those using the scripts make sure you check them for issues like this.

Sea
 
I'm sorry Kisazeky, when I said "you" I really didn't mean YOU. I know you had made the change to be more generic. :) I was just meaning "you" in general to anyone who might offer a script or design so that some unsuspecting site didn't get in trouble for something they didn't do. :)

Sea
 
Status
Not open for further replies.

Similar threads

Users who are viewing this thread

  • Forum Contains New Posts
  • Forum Contains No New Posts

Forum statistics

Threads
4,267
Messages
33,048
Members
1,602
Latest member
BerrieMilk
BETA

Latest Threads

Latest Posts

Top