View Single Post
  #27  
Old 07-30-2002, 06:20 PM
Chris M's Avatar
Chris M Chris M is offline
 
Join Date: Dec 2001
Location: Northampton, England
Posts: 6,186
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Ah yes...

I found a bug...

If you using Version 1.2 of the hack, do the following :

Find in /admin2/user.php :

PHP Code:
  // check that not removing last admin
  
$countadmin=$DB_site->query_first("SELECT COUNT(*) AS users FROM user,usergroup WHERE user.usergroupid=usergroup.usergroupid AND usergroup.cancontrolpanel=1 AND user.userid<>$userid");
  
$getperms=$DB_site->query_first("SELECT cancontrolpanel FROM usergroup WHERE usergroupid=$usergroupid");
  if (
$countadmin[users]==and $getperms[cancontrolpanel]!=1) {
    echo 
"<p>You are about to edit the last user with control panel access so that they do not have control panel access. This would lock you out of the control panel, so you cannot proceed.</p></body></html>";
    exit;
  } 
and remove it completely!

Only do it if you are using Version 1.2 - The bug will not occur in Version 1.1, because you can still update usergroups - Anyone who does not want a Security leak, should upgrade to Version 1.2...

Why is there a bug? Im not totally sure, but I think it is because that php statement above, is looking for the updating of Usergroups, and in Version 1.2, the usergroup updating options have been deleted...Therefore it is looking for something it Cannot find...It seems logical enough...I tested it myself at my co-admin panel, and all seems fine...

Reasons why not to do it with Version 1.1? - Well...For starters, you can still update Usergroups...So...If you delete that, and accidentally change your OWN usergroup, then you may be in trouble...

That should solve your problem...I have updated the first post

Satan
Reply With Quote
 
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01046 seconds
  • Memory Usage 1,772KB
  • Queries Executed 11 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD_SHOWPOST
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)bbcode_php
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)post_thanks_box
  • (1)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (1)post_thanks_postbit_info
  • (1)postbit
  • (1)postbit_onlinestatus
  • (1)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open 

Phrase Groups Available:
  • global
  • postbit
  • reputationlevel
  • showthread
Included Files:
  • ./showpost.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_postinfo_query
  • fetch_postinfo
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showpost_start
  • bbcode_fetch_tags
  • bbcode_create
  • postbit_factory
  • showpost_post
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • showpost_complete