vb.org Archive - Hacked again...

Page 2 of 4

Show 40 post(s) from this thread on one page

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- Modification Requests/Questions (Unpaid) (https://vborg.vbsupport.ru/forumdisplay.php?f=112)

- - Hacked again... (https://vborg.vbsupport.ru/showthread.php?t=42464)

Steve Machol

08-19-2002 03:07 AM

Quote:

Originally posted by Link14716
Unfortunetly, I had left debug on while doing some hacks and of course the hacker took out all of the settings (almost).

That's a security risk as you probably have figured out by now.

Boofo

08-19-2002 03:11 AM

How do you restrict the setting.php file?

Quote:

Originally posted by g-force2k2
if the hacker was trying to cripple through the admin cp then he must've just hacked the forums then... if thats they case the just define yourself as the only person able to access admin cp... ;) and restrict the setting.php file... just some ideas of course...

g-force2k2

NTLDR

08-19-2002 09:21 AM

Quote:

Originally posted by Boofo
How do you restrict the setting.php file?

Its allready protected by:

PHP Code:


		
			
cpheader();

So only admins can use it, you could of course restrict it to a specified userid:

PHP Code:


		
			
if ($bbuserinfo[userid]!=1) {

exit;

}

After cpheader(); so that the script exits if you don't have the userid 1.

The safest option though is to put the entire admin directory behind a .htaccess block and uses a different username / password combo then you do for your forums.

Link14716

08-19-2002 10:31 AM

Quote:

Originally posted by smachol
That's a security risk as you probably have figured out by now.

I have always know that it was a security risk, I used it mostly to add templates into the global set.

Link14716

08-19-2002 10:42 AM

I can get back my settings, but don't get these errors......

Parse error: parse error, expecting `T_VARIABLE' or `'$'' in /home/sites/site68/web/forums/admin/global.php(125) : eval()'d code on line 1

Warning: Cannot add header information - headers already sent by (output started at /home/sites/site68/web/forums/admin/global.php(125) : eval()'d code:1) in /home/sites/site68/web/forums/admin/functions.php on line 1628

Warning: Cannot add header information - headers already sent by (output started at /home/sites/site68/web/forums/admin/global.php(125) : eval()'d code:1) in /home/sites/site68/web/forums/admin/functions.php on line 1628

Warning: Cannot add header information - headers already sent by (output started at /home/sites/site68/web/forums/admin/global.php(125) : eval()'d code:1) in /home/sites/site68/web/forums/admin/functions.php on line 1628

Every other page has that on it, with the global.php, and I am wondering if when I get my settings back from the grave if it'll fix......

Dark_Wizard

08-19-2002 10:43 AM

Make sure there is no white space at the end of functions.php after the ?>

Link14716

08-19-2002 11:42 AM

If only it were that easy...

The global.php line:

Code:

eval($optionstemp[template]);

functions.php line 1628:

Code:

setcookie($name, $value, $expire, $cookiepath, $cookiedomain, $secure);

Dark_Wizard

08-19-2002 11:53 AM

Change this:

Code:

eval($optionstemp[template]);

to this:

Code:

eval($optionstemp['template']);

Link14716

08-19-2002 12:41 PM

Once again..... if only it were that easy.... I tried it and still get the exact same error in all 3 global.php and function.php's

Link14716

08-19-2002 12:52 PM

BTW, I got the settings up, but it still has same error, nthing has changed. I am going to go ahead and ban the corrupt admin so I don't have to deal with his ass whining and +++++ing...

All times are GMT. The time now is 03:49 AM.

Page 2 of 4

Show 40 post(s) from this thread on one page

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.03369 seconds Memory Usage 1,739KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (4)bbcode_code_printable (2)bbcode_php_printable (4)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (3)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: