vb.org Archive - trying to mod download.php

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 Programming Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=15)

- - trying to mod download.php (https://vborg.vbsupport.ru/showthread.php?t=37721)

trying to mod download.php

trying to mod this download.php to reject members who havent been authed by the email.

heres what i got:

PHP Code:


		
			
<?

############################################

# Hack by: GameZilla                       #

# E-mail: [email]gamezilla@socal.rr.com[/email]           #

# Forum: [url]http://www.otakuforums.com[/url]        #

############################################



$file_name = "".basename($file);

include("config.inc");

$mysql['user']   = "voogru";

$mysql['pass']   = "password";

$mysql['db']     = "voogru_website";

$mysql['table']  = "user";



$link = mysql_connect("localhost",$mysql['user'],$mysql['pass']);

mysql_select_db($mysql['db']);



$user = ($HTTP_COOKIE_VARS['user']) ? $HTTP_COOKIE_VARS['user'] : $HTTP_POST_VARS['user'];

$pass = ($HTTP_COOKIE_VARS['pass']) ? $HTTP_COOKIE_VARS['pass'] : $HTTP_POST_VARS['pass'];



$r  = mysql_query("SELECT userid,username,password,usergroupid FROM $mysql[table] WHERE username='$user'");

while ($row = mysql_fetch_array($r))

{

    if(strtolower($user) == strtolower($row['username']) && md5($pass) == $row['password'])

    {



    if ($usergroupid == '3') {

    exit;

 }



    else

        setcookie("user","$user",time() + (120 * 120));

        setcookie("pass","$pass",time() + (120 * 120));

        header("location: $file");

        exit();

    }



}

$data = addslashes(implode("",file("http://www.voogru.com/files/login.phtml")));

eval("echo stripslashes(\"$data\");");

exit();

?>

however when i do that i did a test user and i was still able to download the file.

any ideas?

Out of curiousity why don't you just set the appropriate permissions for the 'Users Awaiting Email Confirmation' group? Just set 'Can download attachments' to 'No'.

no, the download.php is an external file from vbulletin, my can download attachments is already at "no"

Ah, ok. I should have noticed this wasn't a normal vB file!

especially with the

PHP Code:


		
			
############################################

# Hack by: GameZilla                       #

# E-mail: [email]gamezilla@socal.rr.com[/email]           #

# Forum: <a href="http://www.otakuforums.com" target="_blank">[url]http://www.otakuforums.com[/url]</a>        #

############################################

up top hehe :D

anyways still looking for a solution :)

I seemed to fix this by totally re-doing my download.php and putting it in my forums directory. anyways heres what i did:

PHP Code:


		
			
<?

require('global.php');

if ($bbuserinfo[usergroupid]==3) {

eval("dooutput(\"".show_nopermission()."\");");

exit;

}

if ($bbuserinfo[usergroupid]==0) {

eval("dooutput(\"".show_nopermission()."\");");

exit;

}

if ($bbuserinfo[userid]==0) {

eval("dooutput(\"".show_nopermission()."\");");

exit;

}

$file_name = "".basename($file);

echo "<META HTTP-EQUIV=\"refresh\" content=\"0;URL=http://www.voogru.com/files/$file\"> \n";

exit();

?>

i love meta refresh hehe :D anyways feel free to use it, just change the address, also the to link to the file:

Usage:

if you have www.domain.com/files/yap.zip you would make the link:
http://www.domain.com/forum/download.php?file=yap.zip
if you have a link like:
www.domain.com/files/coolstuff/yap.zip you would make the link:
http://forums.voogru.com/download.ph...lstuff/yap.zip and ect.

*wonder if this would qualify as a hack :paranoid:

What's the point in this hack if you can see the filename in the URL? You can just go straight to it without using download.php.

you dont understand it, if you set the ure to refresh to like

PHP Code:


		
			
[b]echo "<META HTTP-EQUIV=\"refresh\" content=\"5;URL=http://www.voogru.com/files/secretfolderthatnoonewouldbeabletofigureout/$file\"> \n";[/b]

exit();

?>

when you link to the file you would put.
download.php?file=yap.zip and it would access

Code:

files/secretfolderthatnoonewouldbeabletofigureout/yap.zip

i just put the main dir as an example, the file could be called from anywhere on the server only showing the path and file after the directory where the files are hiden, i cant really explain it that well :ermm:

In that case don't use META tags, it's very easy to find them out (just view the HTML source!). Use PHP's header() function. (i.e header('Location: yourfile');) :)

yeah but they will have to be quick if u set the refresh to 0

X vBulletin 3.8.12 by vBS Debug Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)bbcode_code_printable (4)bbcode_php_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (1)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages:

Phrase Groups Available:

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01178 seconds Memory Usage 1,744KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)bbcode_code_printable (4)bbcode_php_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)pagenav (1)pagenav_curpage (1)pagenav_pagelink (1)post_thanks_navbar_search (1)printthread (10)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start pagenav_page pagenav_complete bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: