trying to mod download.php

[voogru]

trying to mod this download.php to reject members who havent been authed by the email.

heres what i got:


<?
############################################
# Hack by: GameZilla #
# E-mail: gamezilla@socal.rr.com #
# Forum: http://www.otakuforums.com #
############################################

$file_name = "".basename($file);
include("config.inc");
$mysql['user'] = "voogru";
$mysql['pass'] = "password";
$mysql['db'] = "voogru_website";
$mysql['table'] = "user";

$link = mysql_connect("localhost",$mysql['user'],$mysql['pass']);
mysql_select_db($mysql['db']);

$user = ($HTTP_COOKIE_VARS['user']) ? $HTTP_COOKIE_VARS['user'] : $HTTP_POST_VARS['user'];
$pass = ($HTTP_COOKIE_VARS['pass']) ? $HTTP_COOKIE_VARS['pass'] : $HTTP_POST_VARS['pass'];

$r = mysql_query("SELECT userid,username,password,usergroupid FROM $mysql[table] WHERE username='$user'");
while ($row = mysql_fetch_array($r))
{
if(strtolower($user) == strtolower($row['username']) && md5($pass) == $row['password'])
{

if ($usergroupid == '3') {
exit;
}

else
setcookie("user","$user",time() + (120 * 120));
setcookie("pass","$pass",time() + (120 * 120));
header("location: $file");
exit();
}

}
$data = addslashes(implode("",file("http://www.voogru.com/files/login.phtml")));
eval("echo stripslashes(\"$data\");");
exit();
?>


however when i do that i did a test user and i was still able to download the file.

any ideas?

[Steve Machol]

Out of curiousity why don't you just set the appropriate permissions for the 'Users Awaiting Email Confirmation' group? Just set 'Can download attachments' to 'No'.

[voogru]

no, the download.php is an external file from vbulletin, my can download attachments is already at "no"

[Steve Machol]

Ah, ok. I should have noticed this wasn't a normal vB file!

[voogru]

especially with the

############################################
# Hack by: GameZilla #
# E-mail: gamezilla@socal.rr.com #
# Forum: <a href="http://www.otakuforums.com" target="_blank">http://www.otakuforums.com</a> #
############################################

up top hehe :D

anyways still looking for a solution :)

[voogru]

I seemed to fix this by totally re-doing my download.php and putting it in my forums directory. anyways heres what i did:


<?
require('global.php');
if ($bbuserinfo[usergroupid]==3) {
eval("dooutput(\"".show_nopermission()."\");");
exit;
}
if ($bbuserinfo[usergroupid]==0) {
eval("dooutput(\"".show_nopermission()."\");");
exit;
}
if ($bbuserinfo[userid]==0) {
eval("dooutput(\"".show_nopermission()."\");");
exit;
}
$file_name = "".basename($file);
echo "<META HTTP-EQUIV=\"refresh\" content=\"0;URL=http://www.voogru.com/files/$file\"> \n";
exit();
?>


i love meta refresh hehe :D anyways feel free to use it, just change the address, also the to link to the file:

Usage:

if you have www.domain.com/files/yap.zip you would make the link:
http://www.domain.com/forum/download.php?file=yap.zip
if you have a link like:
www.domain.com/files/coolstuff/yap.zip you would make the link:
http://forums.voogru.com/download.php?file=coolstuff/yap.zip and ect.

*wonder if this would qualify as a hack :paranoid:

[Admin]

What's the point in this hack if you can see the filename in the URL? You can just go straight to it without using download.php.

[voogru]

you dont understand it, if you set the ure to refresh to like


echo "<META HTTP-EQUIV=\"refresh\" content=\"5;URL=http://www.voogru.com/files/secretfolderthatnoonewouldbeabletofigureout/$file\"> \n";
exit();
?>


when you link to the file you would put.
download.php?file=yap.zip and it would access

files/secretfolderthatnoonewouldbeabletofigureout/yap.zip

i just put the main dir as an example, the file could be called from anywhere on the server only showing the path and file after the directory where the files are hiden, i cant really explain it that well :ermm:

[Admin]

In that case don't use META tags, it's very easy to find them out (just view the HTML source!). Use PHP's header() function. (i.e header('Location: yourfile');) :)

[voogru]

yeah but they will have to be quick if u set the refresh to 0

[Admin]

You can "Save Target As..." and have the HTML page downloaded to your computer.

[voogru]

Ill play with that header thing once my site gets back up, sites going
down everyday now :angry:

[voogru]

wow thanks FireFly, i got it working :)


header("Location: http://www.voogru.com/secretfolder/$file");

[voogru]

hmm, vbulletin paresed it :confused: anyways thanks, and i got it working without the meta-refresh now :)