trying to mod download.php

[voogru]

trying to mod this download.php to reject members who havent been authed by the email.

heres what i got:

PHP Code:

<?
############################################
# Hack by: GameZilla                       #
# E-mail: [email]gamezilla@socal.rr.com[/email]           #
# Forum: [url]http://www.otakuforums.com[/url]        #
############################################

$file_name = "".basename($file);
include("config.inc");
$mysql['user']   = "voogru";
$mysql['pass']   = "password";
$mysql['db']     = "voogru_website";
$mysql['table']  = "user";

$link = mysql_connect("localhost",$mysql['user'],$mysql['pass']);
mysql_select_db($mysql['db']);

$user = ($HTTP_COOKIE_VARS['user']) ? $HTTP_COOKIE_VARS['user'] : $HTTP_POST_VARS['user'];
$pass = ($HTTP_COOKIE_VARS['pass']) ? $HTTP_COOKIE_VARS['pass'] : $HTTP_POST_VARS['pass'];

$r  = mysql_query("SELECT userid,username,password,usergroupid FROM $mysql[table] WHERE username='$user'");
while ($row = mysql_fetch_array($r))
{
    if(strtolower($user) == strtolower($row['username']) && md5($pass) == $row['password'])
    {

    if ($usergroupid == '3') {
    exit;
 }

    else
        setcookie("user","$user",time() + (120 * 120));
        setcookie("pass","$pass",time() + (120 * 120));
        header("location: $file");
        exit();
    }

}
$data = addslashes(implode("",file("http://www.voogru.com/files/login.phtml")));
eval("echo stripslashes(\"$data\");");
exit();
?>

however when i do that i did a test user and i was still able to download the file.

any ideas?

[Steve Machol]

Out of curiousity why don't you just set the appropriate permissions for the 'Users Awaiting Email Confirmation' group? Just set 'Can download attachments' to 'No'.

[voogru]

no, the download.php is an external file from vbulletin, my can download attachments is already at "no"

[Steve Machol]

Ah, ok. I should have noticed this wasn't a normal vB file!

[voogru]

especially with the

PHP Code:

############################################
# Hack by: GameZilla                       #
# E-mail: [email]gamezilla@socal.rr.com[/email]           #
# Forum: <a href="http://www.otakuforums.com" target="_blank">[url]http://www.otakuforums.com[/url]</a>        #
############################################ 


up top hehe

anyways still looking for a solution

[voogru]

I seemed to fix this by totally re-doing my download.php and putting it in my forums directory. anyways heres what i did:

PHP Code:

<?
require('global.php');
if ($bbuserinfo[usergroupid]==3) {
eval("dooutput(\"".show_nopermission()."\");");
exit;
}
if ($bbuserinfo[usergroupid]==0) {
eval("dooutput(\"".show_nopermission()."\");");
exit;
}
if ($bbuserinfo[userid]==0) {
eval("dooutput(\"".show_nopermission()."\");");
exit;
}
$file_name = "".basename($file);
echo "<META HTTP-EQUIV=\"refresh\" content=\"0;URL=http://www.voogru.com/files/$file\"> \n";
exit();
?>

i love meta refresh hehe anyways feel free to use it, just change the address, also the to link to the file:

Usage:

if you have www.domain.com/files/yap.zip you would make the link:
http://www.domain.com/forum/download.php?file=yap.zip
if you have a link like:
www.domain.com/files/coolstuff/yap.zip you would make the link:
http://forums.voogru.com/download.ph...lstuff/yap.zip and ect.

*wonder if this would qualify as a hack aranoid:

[Admin]

What's the point in this hack if you can see the filename in the URL? You can just go straight to it without using download.php.

[voogru]

you dont understand it, if you set the ure to refresh to like

PHP Code:

[b]echo "<META HTTP-EQUIV=\"refresh\" content=\"5;URL=http://www.voogru.com/files/secretfolderthatnoonewouldbeabletofigureout/$file\"> \n";[/b]
exit();
?> 


when you link to the file you would put.
download.php?file=yap.zip and it would access

files/secretfolderthatnoonewouldbeabletofigureout/yap.zip

i just put the main dir as an example, the file could be called from anywhere on the server only showing the path and file after the directory where the files are hiden, i cant really explain it that well :ermm:

[Admin]

In that case don't use META tags, it's very easy to find them out (just view the HTML source!). Use PHP's header() function. (i.e header('Location: yourfile');)

[voogru]

yeah but they will have to be quick if u set the refresh to 0