Bug in phpbb..?

Sells PC To Pay For Divorce Joined: Posts: 5661

A friend of mine discovered a weird bug in the phpbb forum when he was looking at my forum.
when you go to all posts of a person (find all posts of..) that goes to this url..
ftopict-51-.html

you get "Possible Santy Worm Attack!" with a white screen and nothing more.
So the friend checked his site and i did exactly the same...
Where does this comes from ?

Hangin' Around Joined: Jun 25, 2004 Posts: 32

Quote:

Where does this comes from ?

From the highlight part of the URL. Santy uses a flaw in the PHP highlight function which has seen many PHP-Nuke/phpBB sites exploited. A fix was made but is a blanket one that has the undersirable effect of thinking highlight in phpBB search strings are also exploits.
Best you do a search here or at the phpBB website on the subject as I'm sure there is a better fix available now.

Posted: Sat Apr 23, 2005 3:20 am

i dont understand realy.
i haven a completely updated forum ,so i dont understand why i get this error.

Posted: Sat Apr 23, 2005 3:30 am

yeah it was this...

Code:




From includes/nukesentinel.php 





Code: 





// Stop Santy Worm 


// If you have problems with forums remove ,highlight from the string below 


if($ab_config['santy_protection'] == 1) { 


  $bad_uri_content=array("rush","highlight","perl","chr(","pillar","visualcoder","sess_"); 


  while(list($stid,$uri_content)=each($bad_uri_content)) { if(stristr($_SERVER['REQUEST_URI'], $uri_content)) { die(_AB_SANTY); } } 


}

registered · Posted: Sat Apr 23, 2005 8:17 am

According to Raven's posts here, if you have the Santy worm mod_rewrite statements in your .htaccess file, you can comment out the Sentinel code. It affects Menalto's Gallery too. I don't have time to find the posts, but I do remember them here.

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

That is correct. Also, if you are using the latest version of NukeSentinel(tm), the Santy worm protection in NukeSentinel(tm) is now controlled in the Administration panel.

Posted: Sat Apr 23, 2005 8:36 am

yeah i knew that but i couldnt figure out where it came from..
but its solved... Smile