How to patch against remote users creating admins (v6.5)

registered · Posted: Fri Jul 29, 2005 6:52 pm

You may have seen this 'fix' on NukeResources: http://www.nukefixes.com/ftopicp-6966.html#6966 . It's a nice one!
Here's how to make it work with PHP-Nuke 6.5 (basically a copy 'n' paste with some notes added and a file change...) Wink

open auth.php (not includes/auth.php)

FIND:

Code:

  $result2 = $db->sql_query("SELECT pwd FROM ".$prefix."_authors WHERE aid='$aid'");

CHANGE TO:

Code:

  //Query added. Used for fix in 'admin.php'&'mainfile.php'.


  //Fix by Quake


  $result2 = $db->sql_query("SELECT name, pwd FROM ".$prefix."_authors WHERE aid='$aid'");

open admin.php

FIND:

Code:

if(!isset($op)) { $op = "adminMain"; }

AFTER ADD:

Code:

//Only 'god' user can 'Edit Admins' in 'Administration Menu' now.


//Fix by Quake & Chatserv


if(isset($op) AND ($op=="mod_authors" OR $op=="modifyadmin" OR $op=="UpdateAuthor" OR $op=="AddAuthor" OR $op=="deladmin2" OR $op=="deladmin" OR $op=="assignstories" OR $op=="deladminconf") AND ($row2['name'] != "God")) {


    die("Illegal Operation");


}

open mainfile.php

FIND:

Code:

 foreach ($_POST as $secvalue) {


    if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || (eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*body*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {


      die ($htmltags);


    }


  }


}

AFTER ADD:

Code:

//Posting from other servers not allowed now.


//Bug found by PeNdEjO


//Fix by Quake


if ($_SERVER["REQUEST_METHOD"] == "POST") {


if (strlen($_SERVER["HTTP_REFERER"]) > 0) {


if (!ereg("(http://$_SERVER[HTTP_HOST])", $_SERVER["HTTP_REFERER"]) && !ereg("(https://$_SERVER[HTTP_HOST])", $_SERVER["HTTP_REFERER"])) {


    die('Posting from another server not allowed!');


  }


 }


}

Posted: Tue Aug 02, 2005 8:20 am

Nice.... Thanks Vin

-sting