vb.org Archive - want to make my "Spy on user" hack work in vbb 2

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- Member Archives (https://vborg.vbsupport.ru/forumdisplay.php?f=202)

- - want to make my "Spy on user" hack work in vbb 2 (https://vborg.vbsupport.ru/showthread.php?t=14778)

G0D	04-21-2001 10:16 AM

I made a new field in the table "session"
the field is called "location" (this is a field used in vbb 1.1.X but not in vbb 2)

The reason I need this field is for my "Spy on user" hack.
It tells us what other users are doing..(viewing what thread, forum, etc.)

I made some adjustment in session.php
example:

$DB_site->query("UPDATE session SET userid=$bbuserid,lastactivity=$datenow,location='".addslashes($scriptpath)."' WHERE sessionid=$session[sessionid]");

The code works fine :)

but...the location is showed as:

/vbb2/showthread.php?s=d10a266aeba10e516dc0707abc5c262f&threadid=2

the sessionid (d10a266aeba10e516dc0707abc5c262f) is also part of "location"..but I don't want that.
I want it to show :

/vbb2/showthread.php?threadid=2

Anyone here that can help me so I can use my hack?
better question: Does it mather when someone knows the session id of another user?

G0D	04-21-2001 10:46 AM

never mind..found the piece of code in newtread.php

Code:

$scriptpath=ereg_replace("sessionhash=[a-z0-9]{32}&","",$scriptpath);

  $scriptpath=ereg_replace("\\?sessionhash=[a-z0-9]{32}","",$scriptpath);

  $scriptpath=ereg_replace("s=[a-z0-9]{32}&","",$scriptpath);

  $scriptpath=ereg_replace("\\?s=[a-z0-9]{32}","",$scriptpath);

But still then..does it mather when users know other users sessionid?

JamesUS

04-21-2001 02:05 PM

It doesn't directly cause problems but it is a big security risk.
Just use the code you posted above to remove the sessionhashes from the urls.

All times are GMT. The time now is 07:00 AM.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01010 seconds Memory Usage 1,710KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)bbcode_code_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (3)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: