vb.org Archive - stristr error

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- ibProArcade Archive (https://vborg.vbsupport.ru/forumdisplay.php?f=174)

- - stristr error (https://vborg.vbsupport.ru/showthread.php?t=279382)

I'm getting a very similar error as was mentioned in this thread

I upgraded to ibProArcade v2.7.2+ yesterday and I'm getting this error at the top of the index page of the arcade.

Quote:

Warning: stristr() [function.stristr]: needle is not a string or an integer in [path]/arcade.php on line 5550

The arcade is functional and when I go to play the game, that error is gone. When I go to submit a high score, I see the same error, but on two consecutive lines. My high score is able to submit properly and there doesn't seem to be any noticeable issue... other than the glaring error at the top of the page.

Just updated and also have this error.

<a href="https://vborg.vbsupport.ru/showpost.php?p=2304863&postcount=13" target="_blank">https://vborg.vbsupport.ru/showp...3&postcount=13</a>

@Hippy

I tried those changes and it did not effect this error. The error points to line 5550...

I've looked at the arcade.php file and line 5550 comes up as....

PHP Code:


		
			
$inthis = str_ireplace($replacethis,$withthis,$inthis);

The full context of this section is...

PHP Code:


		
			
function recursive_str_ireplace($replacethis,$withthis,$inthis)

{

    while (1==1)

    {

        $inthis = str_ireplace($replacethis,$withthis,$inthis);

        if(stristr($inthis, $replacethis) === FALSE)

        {

            RETURN $inthis;

        }

    }

    RETURN $inthis;

}

Any help would be appreciated.

compare v2.7.1 and 2.7.2 and remove or comment out that code and the link above
stangger5 posted what will work in replace of till Mrz figures out the issue
it fixes the security issue

I updated 20+ arcade and 1/4 of them don't like this code..
it's a server issue I am guessing

I have used stangger5 fix but was getting the reported issue with stristr on a customer forum.

I did the below edit, code will do the same and is simpler.

In arcade.php search for the ibp_cleansql function, search for

PHP Code:


		
			
// remove any SQL-commands

Add below :

PHP Code:


		
			
$sqlcomm = array();

Then search for :

PHP Code:


		
			
$value = recursive_str_ireplace($sqlcomm, '', $value);

Comment it out :

PHP Code:


		
			
// $value = recursive_str_ireplace($sqlcomm, '', $value);

Add after :

PHP Code:


		
			
    foreach ($sqlcomm AS $key => $needle)
    {
        $value = str_ireplace($needle, '', $value);
    }

That does the same but is fairly simpler...

Though I must admit that Mrz fixed the 2.7.1 security issue rather uglily...
That bit of code could remove actual correct content ...

I didnt upgrade to 2.7.2 for just two edits..

My one edit to the arcade.php file and the mod_arcade.php..

So my arcade doesnt have any of the:

PHP Code:


		
			
// remove any SQL-commands

code..

Thanks for the code update VBDev !! :up:

Quote:

Originally Posted by VBDev (Post 2307204)

PHP Code:


		
			
// remove any SQL-commands

Add below :

PHP Code:


		
			
$sqlcomm = array();

Then search for :

PHP Code:


		
			
$value = recursive_str_ireplace($sqlcomm, '', $value);

Comment it out :

PHP Code:


		
			
// $value = recursive_str_ireplace($sqlcomm, '', $value);

Add after :

PHP Code:


		
			
    foreach ($sqlcomm AS $key => $needle)

    {

        $value = str_ireplace($needle, '', $value);

    }

That does the same but is fairly simpler...

Though I must admit that Mrz fixed the 2.7.1 security issue rather uglily...
That bit of code could remove actual correct content ...

so it should like this ?

Code:

function ibp_cleansql($value) 

{ 

        if( get_magic_quotes_gpc() ) 

        { 

                $value = stripslashes( $value ); 

        } 

        //check if this function exists 

        if( function_exists( "mysql_real_escape_string" ) ) 

        { 

                $value = mysql_real_escape_string( $value ); 

        } 

        //for PHP version < 4.3.0 use addslashes 

        else 

        { 

                $value = addslashes( $value ); 

        }



        // remove any SQL-commands

        $sqlcomm = array();  

        $sqlcomm[] = 'create';

        $sqlcomm[] = 'database';

        $sqlcomm[] = 'table';

        $sqlcomm[] = 'insert';

        $sqlcomm[] = 'update';

        $sqlcomm[] = 'rename';

        $sqlcomm[] = 'replace';

        $sqlcomm[] = 'select';

        $sqlcomm[] = 'handler';

        $sqlcomm[] = 'delete';

        $sqlcomm[] = 'truncate';

        $sqlcomm[] = 'drop';

        $sqlcomm[] = 'where';

        $sqlcomm[] = 'or';

        $sqlcomm[] = 'and';

        $sqlcomm[] = 'values';

        $sqlcomm[] = 'set';

        $sqlcomm[] = 'password';

        $sqlcomm[] = 'salt';

        $sqlcomm[] = 'concat';

        $sqlcomm[] = 'schema';

        //$value = recursive_str_ireplace($sqlcomm, '', $value);

    foreach ($sqlcomm AS $key => $needle)

    {

        $value = str_ireplace($needle, '', $value);

    }

        return $value; 

}

I been using stangger5's edit and works on every update I did..
I am just wondering at this moment.. thanks

Yep.

Dunno why but I didn't had that error on my install but a customer had the issue.

Anyways I don't know the root cause of this function but honestly that shouldn't be done like that... It removes potential words from comments for example... That sucks :p

--------------- Added [DATE]1331204033[/DATE] at [TIME]1331204033[/TIME] ---------------

Quote:

Originally Posted by stangger5 (Post 2307284)

I didnt upgrade to 2.7.2 for just two edits..

My one edit to the arcade.php file and the mod_arcade.php..

So my arcade doesnt have any of the:

PHP Code:


		
			
// remove any SQL-commands

code..

Thanks for the code update VBDev !! :up:

But if I do understand those fixed a security issue but I guess you fixed it manually ;)

The security issue was s_id,, which allowed it to be a string when it was supposed to be a int,, that is what allowed the exploit.
Comments should be ok because of the way strings are put in the database..

X vBulletin 3.8.12 by vBS Debug Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)bbcode_code_printable (14)bbcode_php_printable (3)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (2)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages:

Phrase Groups Available:

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01153 seconds Memory Usage 1,766KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)bbcode_code_printable (14)bbcode_php_printable (3)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (2)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: