How to patch against remote users creating admins (v6.5)

VinDSL · Posted: Fri Jul 29, 2005 6:52 pm

You may have seen this 'fix' on NukeResources:

Only registered users can see links on this board!
Get registered or login to the forums!

. It's a nice one!
Here's how to make it work with PHP-Nuke 6.5 (basically a copy 'n' paste with some notes added and a file change...) Wink

open auth.php (not includes/auth.php)

FIND:

Code:

$result2 = $db->sql_query("SELECT pwd FROM ".$prefix."_authors WHERE aid='$aid'");

CHANGE TO:

Code:

//Query added. Used for fix in 'admin.php'&'mainfile.php'.
//Fix by Quake
$result2 = $db->sql_query("SELECT name, pwd FROM ".$prefix."_authors WHERE aid='$aid'");

open admin.php

FIND:

Code:

if(!isset($op)) { $op = "adminMain"; }

AFTER ADD:

Code:

//Only 'god' user can 'Edit Admins' in 'Administration Menu' now.
//Fix by Quake & Chatserv
if(isset($op) AND ($op=="mod_authors" OR $op=="modifyadmin" OR $op=="UpdateAuthor" OR $op=="AddAuthor" OR $op=="deladmin2" OR $op=="deladmin" OR $op=="assignstories" OR $op=="deladminconf") AND ($row2['name'] != "God")) {
die("Illegal Operation");
}

open mainfile.php

FIND:

Code:

foreach ($_POST as $secvalue) {
if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || (eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*body*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {
die ($htmltags);
}
}
}

AFTER ADD:

Code:

//Posting from other servers not allowed now.
//Bug found by PeNdEjO
//Fix by Quake
if ($_SERVER["REQUEST_METHOD"] == "POST") {
if (strlen($_SERVER["HTTP_REFERER"]) > 0) {
if (!ereg("(http://$_SERVER[HTTP_HOST])", $_SERVER["HTTP_REFERER"]) && !ereg("(https://$_SERVER[HTTP_HOST])", $_SERVER["HTTP_REFERER"])) {
die('Posting from another server not allowed!');
}
}
}

sting · Posted: Tue Aug 02, 2005 8:20 am

Nice.... Thanks Vin

-sting