The Arcive of vBulletin Modifications Site.

Ryan Ashbrook · #1 03-11-2004, 05:01 PM

I had this idea for a hack that will allow the users listed in the undeletable users variable in config.php will be allowed to edit themselves.

I attempted this hack, but I got a Fatal error in PHP.

If you would like to help or make this hack then please, do so.

Gary King · #2 03-11-2004, 08:58 PM

Okay I'm almost done give me 5 minutes for instructions

Boofo · #3 03-11-2004, 09:04 PM

Then if someone ever does hack your account, they can really mess things up. I would be wary about any hack that does this.

Gary King · #4 03-11-2004, 09:05 PM

It's a 'use-at-your-own-risk' hack.

Also if someone managed to hack your account then I'd think you have worse things to worry about

Gary King · #5 03-11-2004, 09:11 PM

<a href="https://vborg.vbsupport.ru/showthread.php?p=484488#post484488" target="_blank">https://vborg.vbsupport.ru/showt...488#post484488</a>

Boofo · #6 03-12-2004, 07:04 AM

Quote:

Originally Posted by Gary W

It's a 'use-at-your-own-risk' hack.

Also if someone managed to hack your account then I'd think you have worse things to worry about

Yeah, like how (with your hack for this) to get my access back when they change my password. And it doesn't have to be a hacker. It can be one of your "trusted" co-Admins that you shared things you shouldn't have with.

Natch · #7 03-12-2004, 07:06 AM

Quote:

Originally Posted by Boofo

Yeah, like how (with your hack for this) to get my access back when they change my password. And it doesn't have to be a hacker. It can be one of your "trusted" co-Admins that you shared things you shouldn't have with.

phpMyAdmin, or telnet/SSH> mysql CLI ...

In addition, as Jasper Johannsen [Security Engineer with microsoft] says ...

"The best solution to an employee who is doing things they shouldn't - make them an ex-employee."

Boofo · #8 03-12-2004, 07:12 AM

True, but how much damage can they do before you find out about it? That's the reason they made the $nodelete variable in the config.php. All it takes is once for things to be unrecoverable. Better safe than sorry.

Gary King · #9 03-12-2004, 11:07 AM

Quote:

Originally Posted by Boofo

True, but how much damage can they do before you find out about it? That's the reason they made the $nodelete variable in the config.php. All it takes is once for things to be unrecoverable. Better safe than sorry.

I'm betting that many admins who trust another admin will also give their FTP info. Once you have FTP info, you basically can do anything you want, even remove the admin from $nodelete variable.

Boofo · #10 03-12-2004, 02:59 PM

Quote:

Originally Posted by Gary W

I'm betting that many admins who trust another admin will also give their FTP info. Once you have FTP info, you basically can do anything you want, even remove the admin from $nodelete variable.

Then you'd lose that bet. Most Admins won't go that far, for just that reason. But a few of them were surprised to see they couldn't log on after one of their co-Admins turned on them and changed the password in their account. Didn't you read any of the pre-vB3 messages here?