How to Use Your Dynamic Joomla Header in vBulletin

[dannykilla]

Thanks AzzX,

but my host wont allow the "allow_url_include = True"

I quote my support ticket below:

"Hi Danny,

Thanks for your ticket.

We already have allow_url_fopen set to ON. However, we cannot set allow_url_include to ON as this would allow an attacker to inject code into a script and potentially cause huge problems.

We can make changes like this for you with a Managed Virtual Server (MVS) or full Managed Server but not with a shared account.

Please let us know if we can be of any further help.

----
Chris Adams
Rochen Limited"

Any suggestions, is there a way around this?

Thanks
Danny

[AzzX]

You can try putting the code in a file named php.ini at your website and forum root. My webhost has phpsuexec enabled which allows the use of a custom php.ini to overide the main config.

[dannykilla]

AzzX thanks for the reply, one thing if this does actually work (touch wood) what Cmod should I set both files?

Danny

[AzzX]

Not sure what you mean in regards to both files. Just create a text file called php.ini with

allow_url_fopen = True
allow_url_include = True

in it and drop it into your website root and forum home.

[dannykilla]

Ok AzzX,

I asked about that too and I got this on a reply to my ticket:

Technically it will work but this would be circumventing something we don’t allow you to do on the shared servers and thus it would result in account suspension.

You can do a local include without issue and this is the route I suggest you look at.

----

So how do I do a local include and will what I want be possible with it?

Thanks again
Dan

[AzzX]

Had a script kiddie hack attempt using the above method so I highly recommend not doing a dynamic header is this way.

Looking through my logs, vb.org was queried with the search term Joomla highlighted in order to find my site and run an automated exploit.

From another website on the same issue:

The hacker is taking advantage of this global variables PHP exploit and inserting the URL of the code they run remotely into the URL so that they can run the program onto your server. How to fix the problem? Make it so the hacker can't pass URLs on your site.