uCash & uShop old support and thank you thread

/me Installs. I'm the first for the most aniticipated hack!!1

[Link14716]

Originally Posted by Blam Forumz

What was the exploit?

Using donate, someone can give a user a whole lot of points while only being charged something small, like 1.

A pretty bad exploit if you ask me.

[Link14716]

Originally Posted by Deimos

Well that's what I thought, but i've been through the postbit legacy and the showthread files and it's all in there
I'm running IE 6

Here's a screeny of my postbit_legacy template

Move

<if condition="$post['uttstore_glow']"><div id="postmenu_$post[postid]" style="width:100%; filter:Glow(color=$post[uttstore_glow], strength=5);"><else /><div id="postmenu_$post[postid]"></if>

to right before the <a> tag.

[Deimos]

wait that worked
lol
Kick ass, thanks link!

[Limpkinw]

I have modified my Uttstore files is there a way u can tell the changed made on the files or is tehre too many to list?

thanks!

[Zelda-King]

Originally Posted by Deimos

Aye, I did that and it stayed the same.
Hmm, would any of the other template or file hacks affect it?
I don't understand why it's not working, when I origiinally had ushop installed it worked aok

After upgrading your forums you need to reinstall the templates via the install script. Assuming you've done that, ensure you've reverted any customised store templates, such as UTTSTORE.

[saint_seiya]

um, glowing username doesn't work, is there any reason why?

[Link14716]

Originally Posted by saint_seiya

um, glowing username doesn't work, is there any reason why?

Yes it does. Follow the directions.

[Link14716]

Originally Posted by Limpkinw

I have modified my Uttstore files is there a way u can tell the changed made on the files or is tehre too many to list?

thanks!

I believe these edits are correct.

action.admindonate.php (this one is not important, but I fixed it here as well):

Find:

PHP Code:

global $DB_site, $bbuserinfo, $points, $action; 


Replace with:

PHP Code:

global $DB_site, $bbuserinfo, $points, $action, $_FIELDS; 


Find:

PHP Code:

    return $data; 


Add Above:

PHP Code:

    $nonoarray = array(" ", "'", "\"", ",", "+", "=", "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z");
    $_FIELDS['points'] = str_replace($nonoarray, "", $_FIELDS['points']); 


action.bank.php:

Find:

PHP Code:

function uttstore_deposit_sanity($amount) {
    global $points; 


Replace with:

PHP Code:

function uttstore_deposit_sanity($amount) {
    global $points, $_FIELDS; 


Find:

PHP Code:

    if ($points < $amount) {
        $message = "You cannot deposit more than you have!";
        uttstore_print_end_message($message);
    } 


Replace with:

PHP Code:

    $nonoarray = array(" ", "'", "\"", ",", "+", "-", "=", "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z");
    $_FIELDS['points'] = str_replace($nonoarray, "", $_FIELDS['points']);
    
    if ($points < $_FIELDS['points']) {
        $message = "You cannot deposit more than you have!";
        uttstore_print_end_message($message);
    } 


Find:

PHP Code:

function uttstore_withdraw_sanity($bankdata,$mode=2,$amount=0) {
    global $vbphrase; 


Replace with:

PHP Code:

function uttstore_withdraw_sanity($bankdata,$mode=2,$amount=0) {
    global $vbphrase, $_FIELDS; 


Find:

PHP Code:

        if ($amount <= "0") {
            $message = "You may not withdraw a non-positive amount!";
            uttstore_print_end_message($message);
        }
        if ($bankdata['amount'] < $amount) {
            $message = "You cannot withdraw more than you have!";
            uttstore_print_end_message($message);
        } 


Replace with:

PHP Code:

        $nonoarray = array(" ", "'", "\"", ",", "+", "-", "=", "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z");
        $_FIELDS['points'] = str_replace($nonoarray, "", $_FIELDS['points']);
        
        if ($_FIELDS['points'] <= "0") {
            $message = "You may not withdraw a non-positive amount!";
            uttstore_print_end_message($message);
        }
        if ($bankdata['amount'] < $_FIELDS['points']) {
            $message = "You cannot withdraw more than you have!";
            uttstore_print_end_message($message);
        } 


action.donate.php:

Find:

PHP Code:

    global $DB_site, $bbuserinfo, $points, $action, $vbphrase; 


Replace with:

PHP Code:

    global $DB_site, $bbuserinfo, $points, $action, $vbphrase, $_FIELDS; 


Find:

PHP Code:

    if ($amount <= "0") {
        $message = "You may not donate a non-positive amount!";
        uttstore_print_end_message($message);
    } 


Replace with:

PHP Code:

    $nonoarray = array(" ", "'", "\"", ",", "+", "-", "=", "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z");
    $_FIELDS['points'] = str_replace($nonoarray, "", $_FIELDS['points']);
    if ($_FIELDS['points'] <= "0") {
        $message = "You may not donate a non-positive amount!";
        uttstore_print_end_message($message);
    } 


action.thief.php:

Find:

PHP Code:

    $totalcost = calculate_taxed_price($_FIELDS['points'], $action['tax']);
    $totalcost = uttpoints_number_format($totalcost); 


Add above:

PHP Code:

    $nonoarray = array(" ", "'", "\"", ",", "+", "-", "=", "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z");
    $_FIELDS['points'] = str_replace($nonoarray, "", $_FIELDS['points']); 


[Dorign]

Whatever the new "update" did, it's stopped me from taking points away from members who are being buttheads. :P I used to donate them a negative amount of points, that doesn't work now. Could an "Admin Remove" function be made, as opposed to "Admin Donate"? Thanks!

[Zachery]

Originally Posted by Dorign

Whatever the new "update" did, it's stopped me from taking points away from members who are being buttheads. :P I used to donate them a negative amount of points, that doesn't work now. Could an "Admin Remove" function be made, as opposed to "Admin Donate"? Thanks!

You can edit their points directly from the ACP. Ill poke matt about getting a radio button to select wich type it is (+/-) for admin donate