Hacked again...

[Steve Machol]

Originally posted by Link14716
Unfortunetly, I had left debug on while doing some hacks and of course the hacker took out all of the settings (almost).

That's a security risk as you probably have figured out by now.

[Boofo]

How do you restrict the setting.php file?

Originally posted by g-force2k2
if the hacker was trying to cripple through the admin cp then he must've just hacked the forums then... if thats they case the just define yourself as the only person able to access admin cp... and restrict the setting.php file... just some ideas of course...

g-force2k2

[NTLDR]

Originally posted by Boofo
How do you restrict the setting.php file?

Its allready protected by:

PHP Code:

cpheader(); 


So only admins can use it, you could of course restrict it to a specified userid:

PHP Code:

if ($bbuserinfo[userid]!=1) {
exit;
} 


After cpheader(); so that the script exits if you don't have the userid 1.

The safest option though is to put the entire admin directory behind a .htaccess block and uses a different username / password combo then you do for your forums.

[Link14716]

Originally posted by smachol
That's a security risk as you probably have figured out by now.

I have always know that it was a security risk, I used it mostly to add templates into the global set.

[Link14716]

I can get back my settings, but don't get these errors......

Parse error: parse error, expecting `T_VARIABLE' or `'$'' in /home/sites/site68/web/forums/admin/global.php(125) : eval()'d code on line 1

Warning: Cannot add header information - headers already sent by (output started at /home/sites/site68/web/forums/admin/global.php(125) : eval()'d code:1) in /home/sites/site68/web/forums/admin/functions.php on line 1628

Warning: Cannot add header information - headers already sent by (output started at /home/sites/site68/web/forums/admin/global.php(125) : eval()'d code:1) in /home/sites/site68/web/forums/admin/functions.php on line 1628

Warning: Cannot add header information - headers already sent by (output started at /home/sites/site68/web/forums/admin/global.php(125) : eval()'d code:1) in /home/sites/site68/web/forums/admin/functions.php on line 1628

Every other page has that on it, with the global.php, and I am wondering if when I get my settings back from the grave if it'll fix......

[Dark_Wizard]

Make sure there is no white space at the end of functions.php after the ?>

[Link14716]

If only it were that easy...

The global.php line:

eval($optionstemp[template]);

functions.php line 1628:

    setcookie($name, $value, $expire, $cookiepath, $cookiedomain, $secure);

[Dark_Wizard]

Change this:

eval($optionstemp[template]);

to this:

eval($optionstemp['template']);

[Link14716]

Once again..... if only it were that easy.... I tried it and still get the exact same error in all 3 global.php and function.php's

[Link14716]

BTW, I got the settings up, but it still has same error, nthing has changed. I am going to go ahead and ban the corrupt admin so I don't have to deal with his ass whining and +++++ing...