Incompatibility between Gallery and Sentinel

Posted: Tue Sep 06, 2005 12:19 pm

There is a bug or incompatibility (your choice) between Gallery 1.4.4 and Sentinel. If you go to change the highlight photograph in a Gallery album, you execute the following code in do_command.php in the Gallery module folder:

Code:

else if (!strcmp($cmd, "highlight")) {


   if ($gallery->user->canWriteToAlbum($gallery->album)) {


      $gallery->album->setHighlight($index);


      $gallery->album->save(array(i18n("Changed Highlight")));


   }

This eventually gets checked against the check filters section of nukesentinel.php in the /includes directory and specifically in the XSS attacks area as shown:

Code:

  // Check for XSS attack


  if ($name != "Gallery") { // this line added as well as closing brace 


  if (eregi("http\:\/\/", $name) OR (stristr($nsnst_const['query_string'], "cmd=") AND !stristr($nsnst_const['query_string'], "&cmd")) OR (stristr($nsnst_const['query_string'], "exec") AND !stristr($nsnst_const['query_string'], "execu")) OR stristr($nsnst_const['query_string'],"concat")) {


/*   echo '<table bgcolor="green"><tr><td>' . 'xss attack caught' . '</td></tr>';


  echo '<tr><td>' . $name . ' name' . '</td></tr></table>'; */


    block_ip($blocker_row); } // end of gallery exclusion


  }

The Gallery exclusion code is of course not in the original version of nukesentinel.php but I added it as a temporary workaround.

I'm nowhere near expert enough to tell whether this is a security vulnerability built into Gallery or an oversight in Sentinel but I can report that anyone who tries to execute the "change highlight" photo functions in Gallery will get banned.

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

This has been documented several times Smile

Search the forum for gallery highlight or just highlight.