uCash & uShop old support and thank you thread

/me Installs. I'm the first for the most aniticipated hack!!1

[sabret00the]

that information would be false matt, you need to run the installer

[Matt Bush]

Originally Posted by sabret00the

that information would be false matt, you need to run the installer

If you couldn't already tell I'm new with this vB stuff. When I click install, what does it do?

[rabbitdog]

I don't think this has been addressed, because I still see the unfixed code in the zip file available for download, so I'd like to point out the fact that there is a critical bug in the uShop change username action.

This affects all current installations of the uStore with this item available for purchase.

The issue is as follows:

The "sanity" check which queries the database to see if a user already exists before accepting a changed username will never find any matches. This is because of the usage of an empty (incorrect) variable in the query.

The result is that any user can change his or her username to that of an existing user.

Note that this does NOT change permissions, so a user changing his name to that of a mod or an admin will not inherit access to those functions.

Here is the fix:

1. Open action.changeusername.php, which is stored in the /uttstore/ directory
2. Change line 5 from:

PHP Code:

$changed = $DB_site->query_first("SELECT userid, username FROM ".TABLE_PREFIX."user WHERE username='".addslashes($data)."'"); 


to:

PHP Code:

$changed = $DB_site->query_first("SELECT userid, username FROM ".TABLE_PREFIX."user WHERE username='".addslashes($username)."'"); 


[Link14716]

Originally Posted by rabbitdog

I don't think this has been addressed, because I still see the unfixed code in the zip file available for download, so I'd like to point out the fact that there is a critical bug in the uShop change username action.

This affects all current installations of the uStore with this item available for purchase.

The issue is as follows:

The "sanity" check which queries the database to see if a user already exists before accepting a changed username will never find any matches. This is because of the usage of an empty (incorrect) variable in the query.

The result is that any user can change his or her username to that of an existing user.

Note that this does NOT change permissions, so a user changing his name to that of a mod or an admin will not inherit access to those functions.

Here is the fix:

1. Open action.changeusername.php, which is stored in the /uttstore/ directory
2. Change line 5 from:

PHP Code:

$changed = $DB_site->query_first("SELECT userid, username FROM ".TABLE_PREFIX."user WHERE username='".addslashes($data)."'"); 


to:

PHP Code:

$changed = $DB_site->query_first("SELECT userid, username FROM ".TABLE_PREFIX."user WHERE username='".addslashes($username)."'"); 


Nice catch. $data is used in several functions, but it looks like it shouldn't there.

Fixed for 0.95.

[GeekyDesigns]

PHP Code:

6a9bb87ef571024592ec153b259803a0 


Post created by the GeekyDesigns vB License Verification Hash System.

Hash will be changed regularly.

[GeekyDesigns]

wootage, it worked

[Zachery]

teh woot

[Taco John]

Question: Can I make this hack so that only certain usergroups can use it?

[hitmanuk2k]

why is the cost showing up as 0.0 for everything on ushop.php? even though i have it set to larger numbers...

[b4ne]

Hi

I have this error that I have no links nowher in my Admin CP or anywhere else on the page, also when I check permission, there is no mention of this .

If I got to the ushop.php page : No Actions found.

Otherwise :
Installation : Manual (did a deinstall and reinstall)

Board vb 3.0.1

Also the very first time I try to connect to ushop.php I get some error in ushop.php on line 144 ?

But this error disapears.

And I wanted to also mention that I run the betting hack.

Any idea ?