Major security problem I just found (only on my site)

Worker Joined: Dec 22, 2004 Posts: 135

Ok, I have been making this site for a long time now... tweaking here and there etc. At first I was only putting benign info in the "Content" pages for anoymouse visitors. I started putting private info on them too and other sensitive info on them (without thinking) and I have put a lot of work into it. I just realized that I can't tell nuke which ones to show only to registered users.... does anyone know how I can fix this problem?? I've got some sensitive stuff on this page. Can I create a "Content2" and make it registered only or something? How about a hack to create privelages for Content's Categories?

registered · Site Admin Joined: Jun 04, 2004 Posts: 6437

There are a couple of options. You could:

There are probably other ways, too, but this should give you some things to consider.

Posted: Wed Sep 28, 2005 11:29 am

yeah, those all require a lot more grasp of the language than I have. I wish there was an easy way to give privelages to Content Categories instead of all-or-nothing that is is now.

Posted: Wed Sep 28, 2005 11:42 am

Why not store the sensitive content in a private forum? That shouldn't require any code changes.

Posted: Wed Sep 28, 2005 12:51 pm

because I want the pages to look cohesive and not change around like that. I'm dealing with guys who are not computer geeks.... odler gentlemen who do not use computers too often.

Involved Joined: Oct 09, 2004 Posts: 293

Quote:

I'm dealing with guys who are not computer geeks.... odler gentlemen who do not use computers too often.

I had the same problem....members accessing hidden members section and staff accessing admin sections.
These did not show up in the scrolling forum block which from logs I was able to establish they used, by passing the forum index.
I bumbled thru made a custom user info out of others user info. When a user is logged in, just under the log out button, with the PM link, I put a link to posts since last visited, that appears only when logged in. this shows all posts since last visit that they have permissin to veiw.
From the logs I now see that this link is now commonly used.
Unfortunately my code is rather messy, (althu works)as I do not realy know what Im doing. therefore it would be irresponsable to release the user info in its current condition. It needs a coder to clean up and them to release.

Posted: Wed Sep 28, 2005 5:50 pm

NSN Groups.

Regular Joined: Jun 15, 2005 Posts: 78 Location: AR

Here you go man.. Here is "Content2"... All I did was change the SQL so that it looks for a different second DB... It is the exact same module just # 2... No that wasn't a restroom joke Razz

.

It is based off 7.6.3.1....

All you have to do is upload the contents of the "html" folder...

Then go into phpmyadmin and run the sql querry....

I take no credit for this, use at your own risk blah blah.... So on... You know man. If you don't you should.

http://www.xiodestudios.com/temp/Content2.zip

Posted: Thu Sep 29, 2005 6:52 am

wow, thanks. I'll let you know how it goes.

Posted: Sat Oct 01, 2005 4:06 pm

did everything work out for you?

registered · Posted: Sun Oct 02, 2005 7:08 am

64bitguy wrote:

NSN Groups.

On that "note", it might be another good "After-Patched" value-add to include more core group "awareness" within certain core nuke modules similar, I think, to NSN News to attach groups to specific articles?

Posted: Mon Oct 03, 2005 10:06 am

worked very well, thank you. Now, how do I go about moving the private Content from old "nuke_pages" to "nuke_pages2"? What's the SQL code so I can do it in the DB and not by hand.

Posted: Mon Oct 03, 2005 10:49 am

nm, exported and just changed one number and then inserted into new pages... THANKS!

Posted: Mon Oct 03, 2005 12:48 pm

oops, spoke too soon... The links to the content pages in "Content2" have "name=Content" in them, how do I change that so it says "name=Content2"?

Posted: Mon Oct 03, 2005 9:01 pm

ThePiston wrote:

oops, spoke too soon... The links to the content pages in "Content2" have "name=Content" in them, how do I change that so it says "name=Content2"?

Since you already have the export/import process down pat, if you still have the file that you imported, I would change all references of "Content" to "Content2", truncate the table, and then re-import. However, if you no longer have the import file, I would export the table to file first, then change the data, truncate the table, and then re-import.

Regards,
montego

Posted: Mon Oct 03, 2005 11:00 pm

yep, I exported all the tables and then replaced "pages" with pages2" and insterted. My problem now is that when I admin "Content2" pages, they all have links to "Content". How can I change that?

Posted: Tue Oct 04, 2005 4:43 am

ThePiston wrote:

yep, I exported all the tables and then replaced "pages" with pages2" and insterted. My problem now is that when I admin "Content2" pages, they all have links to "Content". How can I change that?

Depending upon your version of nuke (which you should always provide by the way in your up-front posts), you need to find the appropriate admin case.php and link.php for your new "Content2" module. You have to also make the case statements unique, such as changing "content" to "content2" and "content_edit" to "content_edit2", etc... You have to match those changes in your Content2 index.php as well.

Also in the Content2's admin index.php and possibly other scripts you need to look for the hardcoding of the url to "content" to be "content2". It looks like FB wasn't consistent in his use of the variable "$module_name" in the admin scripts.

Lastly, you need to change the admin's link.php script to also use "contents2" instead of "contents".

Unfortunately, cloning a module isn't as simple as copying it to another directory. If you run into any more issues, just post the details of what you are seeing and/or any error messages and we'll try and help you out.

Regards,
montego

Posted: Tue Oct 04, 2005 8:05 am

got it, there was one instance in the admin/index.php file hat still had "content" and not "content2"... all aothers were fixed. DONE, thanks!

Posted: Tue Oct 04, 2005 7:48 pm

u r welcome.

RavensScripts