Security Release: XOOPS 2.0.12a - Security - XOOPS News - XOOPS Web Application System

XOOPS

News

News World of XOOPS Developers Hacks Themes Archive Submit News

Security: Security Release: XOOPS 2.0.12a

Posted by: MithrandirOn 2005/6/28 18:10:00 42100 reads

Just last Friday, we released XOOPS v2.0.11, but during the weekend, I had a great deal of communication with James from GulfTech Security Research, who helped me find and fix a couple of holes in the XML-RPC interface and the comment system.

Also, work done by XOOPS JP and JM2 and the zx team helped with a couple of other bugs and issues.

We therefore recommend everyone to upgrade to version 2.0.12a, available from this site.

Upgrade instructions:
1. Download patch
2. Extract patch
3. Upload patch to webserver (NOTE: ONLY upload modules/newbb/post.php if you use Newbb version 1.0)
4. Update System Module
5. That's it

Changes since 2.0.10:

============================
2005/06/29: Version 2.0.12a
============================
- Fixed bug in comments, where editing a comment would post a new one
- Removed PHP parsing in Saxparser's handleProcessingInstruction() method (Thanks to GIJOE)
- Fixed parse error in modules/newbb/post.php

============================
2005/06/28: Version 2.0.12
============================
- Fixed sanitation bug in include/comment_form.php and include/comment_post.php (Mithrandir/James@Gulftech)
- Fixed sanitation bug in class/xml/rpc/xmlrpcapi.php and class/criteria.php (Mithrandir/James@Gulftech/XOOPS JP)
- Changed admin.php to fetch news from xoops.org via Snoopy (Mithrandir/XOOPS JP)
- Fixed possible XSS hole in redirect_header (Mithrandir/XOOPS JP)
- Security fixes in pda.php and misc.php (Mithrandir/XOOPS JP)
- Fixed typos in kernel/object.php (Mithrandir/brandycoke)

============================
2005/06/24: Version 2.0.11
============================
- Fixed bug where lostpass.php would not accept emails and send new password (Ackbarr)
- Fixed bug where search result links would be wrong if the item was in another module than the searched one (Ackbarr)
- Fixed bug in groups admin where it was impossible to add users to a group if the site had 200+ users (Ackbarr)
- Fixed bug with uploading smilies (Ackbarr)

XOOPS 2.0.12 Stable
.zip | tarball

XOOPS 2.0.10 to 2.0.12 patch
.zip | tarball

XOOPS 2.0.12 to 2.0.12a patch
Kindly provided by LazyBadger

The comments are owned by the author. We aren't responsible for their content.

user

Re: Security Release: XOOPS 2.0.12

pratanet Published 06/28/2005 18:32 Just popping in Joined 05/30/2005 Comments 6

Hellow Mith, Which the URL to download? You with the XOOPS Nightly yesterday.Is this correct and fix ok?

user

Re: Security Release: XOOPS 2.0.12

Dave_L Published 06/28/2005 18:42 XOOPS is my life! Joined 11/07/2003 Comments 2277

Use the link at the top of the front page:

GET THE LATEST XOOPS VERSION / DOWNLOAD NOW! >> XOOPS 2.0.x full versions

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/28/2005 18:43 XOOPS is my life! Joined 06/21/2003 Comments 6320

Sorry - forgot about the download links. Added now.

Re: Security Release: XOOPS 2.0.12

indream Published 06/28/2005 18:45 Not too shy to talk Joined 09/21/2004 Comments 170

hah
nice news for me
but i'm changed my XOOPS 2.10 to 2.11 last night :)

where is XOOPS 2.0.11 to 2.0.12 patch ?

user

Re: Security Release: XOOPS 2.0.12

pratanet Published 06/28/2005 18:51 Just popping in Joined 05/30/2005 Comments 6

For who tah following XOOPS unstable versao of yesterday 27/06 of the error when it brings up to date with security fix

English by google

------------------------------

Para quem tah acompanhando o XOOPS unstable a versao de ontem 27/06 da erro quando atualiza com o security fix

user

Re: Security Release: XOOPS 2.0.12

Dave_L Published 06/28/2005 18:52 XOOPS is my life! Joined 11/07/2003 Comments 2277

indream, use the XOOPS-2.0.10-to-2.0.12 patch.

Re: Security Release: XOOPS 2.0.12

kapeman Published 06/28/2005 18:53 Updated 06/28/2005 18:54 Just popping in Joined 05/03/2005 Comments 87

edit:

Nevermind. Someone already posted the answer.

user

Re: Security Release: XOOPS 2.0.12

Herko Published 06/28/2005 18:53 XOOPS is my life! Joined 02/04/2002 Comments 4238

Pratanet: this is not a security fix for the unstable 2.1.x releases, but a fix for the stable 2.0.11 release. Don't mix these up please

XOOPS 2.1.x is still in active development, and the first stable release in the 2.x series will be XOOPS 2.2.

Herko

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/28/2005 18:54 XOOPS is my life! Joined 06/21/2003 Comments 6320

and... if I understand correctly...
no, you cannot apply this update to a 2.1.1 or CVS Nightly installation. It is for 2.0.10 or 2.0.11 only.

user

Re: Security Release: XOOPS 2.0.12

ClubNUKE Published 06/28/2005 18:57 Just popping in Joined 09/01/2004 Comments 83

XOOPS 2.0.10 to 2.0.12

You need change include/version.php (2.0.11 to 2.0.12).

user

Re: Security Release: XOOPS 2.0.12

m0nty Published 06/28/2005 18:57 XOOPS is my life! Joined 10/24/2003 Comments 3337

nice work guys :)

user

Re: Security Release: XOOPS 2.0.12

pratanet Published 06/28/2005 18:57 Just popping in Joined 05/30/2005 Comments 6

rsrsrs...
I perceived that of the error... tanks...

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/28/2005 18:59 XOOPS is my life! Joined 06/21/2003 Comments 6320

Quote:

You need change include/version.php (2.0.11 to 2.0.12).

Ah geez.. Sorry.

It is only in the update - will fix asap.

Re: Security Release: XOOPS 2.0.12

indream Published 06/28/2005 19:00 Updated 06/28/2005 19:02 Not too shy to talk Joined 09/21/2004 Comments 170

send new comment func not working and show a printer friendly page...
and i'm searhcing any new bugs :(

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/28/2005 19:06 XOOPS is my life! Joined 06/21/2003 Comments 6320

I can add comments... not sure I got all the information I need there.

And what is showing a printer friendly page?

Re: Security Release: XOOPS 2.0.12

indream Published 06/28/2005 19:10 Updated 09/21/2005 1:48 Not too shy to talk Joined 09/21/2004 Comments 170

delete this

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/28/2005 19:13 XOOPS is my life! Joined 06/21/2003 Comments 6320

It doesn't do that on my own installation.

Any php debug errors?

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/28/2005 19:18 XOOPS is my life! Joined 06/21/2003 Comments 6320

Just applied the patch to xoops.org

As you can see, it works fine

Re: Security Release: XOOPS 2.0.12

indream Published 06/28/2005 19:23 Not too shy to talk Joined 09/21/2004 Comments 170

oops i'm sorry

Re: Security Release: XOOPS 2.0.12

indream Published 06/28/2005 19:23 Not too shy to talk Joined 09/21/2004 Comments 170

hah
nice news for me
but i'm changed my XOOPS 2.10 to 2.11 last night :)

Re: Security Release: XOOPS 2.0.12

indream Published 06/28/2005 19:25 Not too shy to talk Joined 09/21/2004 Comments 170

wrong alert :)
pls delete this comment

user

Re: Security Release: XOOPS 2.0.12

m0nty Published 06/28/2005 19:28 XOOPS is my life! Joined 10/24/2003 Comments 3337

i heard u the 1st time. :s

user

Re: Security Release: XOOPS 2.0.12

JimLunsford Published 06/28/2005 19:30 Not too shy to talk Joined 10/26/2004 Comments 191

Thought there was a bug in the comment system lol!

Re: Security Release: XOOPS 2.0.12

indream Published 06/28/2005 19:35 Not too shy to talk Joined 09/21/2004 Comments 170

hehe

this not my error this error for my stupid ftp programs error :)

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/28/2005 19:38 XOOPS is my life! Joined 06/21/2003 Comments 6320

Glad you found it out.

user

Re: Security Release: XOOPS 2.0.12

tedsmith Published 06/28/2005 21:02 Home away from home Joined 06/02/2004 Comments 1151

If upgrading from 2.0.9.3 can you use the 2.0.10 to 2.0.12 patch?

user

Re: Security Release: XOOPS 2.0.12

tedsmith Published 06/28/2005 21:11 Home away from home Joined 06/02/2004 Comments 1151

Yes, you can. Just done it and it works.

user

Re: Security Release: XOOPS 2.0.12

m0nty Published 06/28/2005 21:50 XOOPS is my life! Joined 10/24/2003 Comments 3337

ted, you will need to do the 2093 - 2010 1st.. otherwise you'll be missing a lot of files..

user

Re: Security Release: XOOPS 2.0.12

Chainsaw Published 06/28/2005 23:06 Quite a regular Joined 09/28/2003 Comments 304

I was on 2.0.11. I uploaded the patch files and went to Admin Module. When I try to update the System module I get the message "Press the button below to update this module" BUT there is no button to press.

Re: Security Release: XOOPS 2.0.12 (multilanguages warning)

josecruz Published 06/29/2005 2:58 Just popping in Joined 03/28/2003 Comments 68

Hi all,

like a bonehead I applied the 2.0.12 patch to my installation while forgetting that I have the MultiLanguages module running.

As a warning to others with similar circumstances. Don't apply the 2.0.12 patch if you want to retain all your multilanguages functionality. I think the patch to the file: /kernel/object.php breaks the ML module's ability to make menu titles appear in their appropriate language.

I'll be waiting until Marcan and the others have an updated ML module ready to go for 2.0.12. I could go in and try to hack it myself, butI might as well wait as Marcan is good with his updates.

Otherwise if you're not running ML, then apply the security patch.

Jose

Re: Security Release: XOOPS 2.0.12 (multilanguages warning)

josecruz Published 06/29/2005 3:12 Just popping in Joined 03/28/2003 Comments 68

back again,

out of my own curiosity I found Marcan's hack in the file /kernel/object.php

Around line 282 of the file:

 case XOBJ_DTYPE_TXTBOX: 
            switch (strtolower($format)) { 
            case 's': 
            case 'show': 
            case 'e':

Changed that to reflect whatI found in the ML version of the same file. Thus it is now:

 case XOBJ_DTYPE_TXTBOX: 
            switch (strtolower($format)) { 
            case 's': 
            case 'show': 
                // ML Hack by marcan 
                $ts =& MyTextSanitizer::getInstance(); 
                $ret = $ts->htmlSpecialChars($ret);   
                return $ts->formatForML($ret); 
                break 1; 
                // End of ML Hack by marcan             
            case 'e':

If you choose to apply the same patch to your system after applying the 2.0.12 patch, you might get lucky and get your menu titles back like me. Otherwise, YMMV. Don't blame me if anything gets smoky. My best advice is to wait until Marcan comes outwith a new ML module.

Jose

user

Re: Security Release: XOOPS 2.0.12

Chainsaw Published 06/29/2005 4:02 Quite a regular Joined 09/28/2003 Comments 304

Quote:

I was on 2.0.11. I uploaded the patch files and went to Admin Module. When I try to update the System module I get the message "Press the button below to update this module" BUT there is no button to press.

Just a follow up - my webhost said it is a server side problem and they are fixing it....

phew...

user

Re: Security Release: XOOPS 2.0.12

GIJOE Published 06/29/2005 4:41 Quite a regular Joined 08/13/2003 Comments 265

hi Mith.

What a Good and Prompt work! :thumb:
Many thanks.

BTW, I can't find the place Mith patched against saxparser executable

And the almost contributes are not from "XOOPS JP", but from JM2 leading "zx team".
(Though only class/criteria.php is contributed by XOOPS JP team)

user

Re: Security Release: XOOPS 2.0.12 (multilanguages warning)

Mamba Published 06/29/2005 5:10 Moderator Joined 04/23/2004 Comments 11409

Quote:

Changed that to reflect whatI found in the ML version of the same file. Thus it is now:

Thanks, this did for me...

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/29/2005 9:37 XOOPS is my life! Joined 06/21/2003 Comments 6320

Quote:

the almost contributes are not from "XOOPS JP", but from JM2 leading "zx team".

Ah, sorry for confusing things.

Some things (pda.php, misc.php, admin.php) were taken from XOOPS JP 2.0.11-beta.

The saxparser.php, I was certain I had put in 2.0.x - but apparently I did only do that for 2.2, which will be out in 1½ weeks.

Re: Security Release: XOOPS 2.0.12

bwirum Published 06/29/2005 9:58 Just popping in Joined 01/16/2004 Comments 49

Quote:

I was on 2.0.11. I uploaded the patch files and went to Admin Module. When I try to update the System module I get the message "Press the button below to update this module" BUT there is no button to press.

How is this a server side problem?

I just updated from 2.0.10 and have the same thing?

Re: Security Release: XOOPS 2.0.12

ghbook Published 06/29/2005 10:20 Just popping in Joined 11/14/2003 Comments 21

i found a abnormality : an image from image manager in a category stored as blob/database cannot be displayed at all. Everything OK when the images are stroder a files.

This bug is included in /class/criteria.php (i experimentally upgraded (the second time) file by file). I'm not a hacker, so i cannot tell you what's wrong with it, and where....

user

Re: Security Release: XOOPS 2.0.12

tedsmith Published 06/29/2005 10:49 Home away from home Joined 06/02/2004 Comments 1151

Yes, you can. Just done it and it works.

============

Edit

Perhaps not, looking at Montys reply below! It seemed to have worked but I've perhaps done something wrong. Will apply the patches sequentially tonight!

Re: Security Release: XOOPS 2.0.12

bwirum Published 06/29/2005 12:15 Just popping in Joined 01/16/2004 Comments 49

The above fault obviously makes me get the following when trying to post something:

 Fatal error: Call to a member function on a non-object in /home/wirum/www/wow/include/functions.php on line 145

I use the newbb2 and news 1.21, but that should not be of any concern to this patch, should it? It hasn't updated anything in those respective mods, only the system as far as I can see.

Re: Security Release: XOOPS 2.0.12

kapeman Published 06/29/2005 13:52 Just popping in Joined 05/03/2005 Comments 87

originally posted by ClubNuke:

XOOPS 2.0.10 to 2.0.12

You need change include/version.php (2.0.11 to 2.0.12).

I just wanted to bump this as I did not see any answer.

Great work, Mith!!!

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/29/2005 14:23 XOOPS is my life! Joined 06/21/2003 Comments 6320

Quote:

I did not see any answer.

Look a little closer:

Quote:

Quote:
You need change include/version.php (2.0.11 to 2.0.12).

Ah geez.. Sorry.

It is only in the update - will fix asap.

I uploaded a new update patch with a fixed include/version.php - at least it should be.

user

Re: Security Release: XOOPS 2.0.12

hervet Published 06/29/2005 15:12 Friend of XOOPS Joined 11/04/2003 Comments 2267

How do you upgrade from 2.0.9.3 to this new one ?

user

Re: Security Release: XOOPS 2.0.12

hervet Published 06/29/2005 15:13 Friend of XOOPS Joined 11/04/2003 Comments 2267

How do you upgrade from 2.0.9.3 to this new one ?
Does someone have the full 2.0.10 and 2.0.11 ?

Re: Security Release: XOOPS 2.0.12

bwirum Published 06/29/2005 15:23 Just popping in Joined 01/16/2004 Comments 49

the 2.0.9.2 to 2.0.10 is on the download page.

Anyone know what's up with the fail I get on my site? 4 or so posts up, look please.

Thanks.

Re: Security Release: XOOPS 2.0.12

bwirum Published 06/29/2005 15:24 Just popping in Joined 01/16/2004 Comments 49

And how come every edit here becomes a new post?

Re: Security Release: XOOPS 2.0.12

tl Published 06/29/2005 15:25 Friend of XOOPS Joined 06/23/2002 Comments 999

hervé:
2.0.9.3 consists of 2 files that have new versions in the new package.

2.0.9.2->2.0.10 patch
2.0.10->2.0.12 patch

That was how I did for my upgrade.
tl

user

Re: Security Release: XOOPS 2.0.12

hervet Published 06/29/2005 15:25 Friend of XOOPS Joined 11/04/2003 Comments 2267

Quote:

the 2.0.9.3 to 2.0.10 is on the download page.

should be :
the 2.0.9.3 to 2.0.10 is not on the download page.

Re: Security Release: XOOPS 2.0.12

tl Published 06/29/2005 15:27 Friend of XOOPS Joined 06/23/2002 Comments 999

[remove] Do we have a newbb bug? Editing post creates a new post??

user

Re: Security Release: XOOPS 2.0.12

hervet Published 06/29/2005 15:28 Friend of XOOPS Joined 11/04/2003 Comments 2267

Thank you tl

user

Re: Security Release: XOOPS 2.0.12

hervet Published 06/29/2005 15:30 Friend of XOOPS Joined 11/04/2003 Comments 2267

Finally, I think that i will wait...

XOOPS 2.0.12 - Comment Post Bug

tl Published 06/29/2005 15:34 Friend of XOOPS Joined 06/23/2002 Comments 999

Mith:
It seems there is a bug in either include/comment_form.php or include/comment_post.php or both. User can't edit comments. Instead of overwriting the old version, the edited version is posted/created as a new comment.
tl

Re: XOOPS 2.0.12 - Comment Post Bug

bwirum Published 06/29/2005 15:40 Just popping in Joined 01/16/2004 Comments 49

Quote:

should be :
the 2.0.9.3 to 2.0.10 is not on the download page.

See my 'try to edit' post after that one. 2.0.9.2 to 2.0.10 is on there. Use that.

user

Re: XOOPS 2.0.12 - Comment Post Bug

Mithrandir Published 06/29/2005 16:24 XOOPS is my life! Joined 06/21/2003 Comments 6320

Quote:

It seems there is a bug in either include/comment_form.php or include/comment_post.php or both

I'll look into it.

user

Re: XOOPS 2.0.12 - Comment Post Bug

Mithrandir Published 06/29/2005 16:32 Updated 06/29/2005 16:33 XOOPS is my life! Joined 06/21/2003 Comments 6320

Found the bugger:

include/comment_post.php:

around line 50-55:

 } else { 
    $com_id = isset($_POST['com_id']) ? intval($_POST['com_id']) : 0; //<-- add this line 
    if (XOOPS_COMMENT_APPROVENONE == $xoopsModuleConfig['com_rule']) { 
    exit(); 
    }

That should work

Re: XOOPS 2.0.12 - Comment Post Bug

JamesSAEP Published 06/29/2005 16:53 Just can't stay away Joined 02/28/2005 Comments 732

Thanks Mith,

It works for me!

Re: Security Release: XOOPS 2.0.12

kapeman Published 06/29/2005 17:13 Just popping in Joined 05/03/2005 Comments 87

Thanks, Mith!

I fixed my issue.

The answer was too obvious!

No wonder I missed it.

Re: Security Release: XOOPS 2.0.12

Shelia Published 06/29/2005 17:30 Not too shy to talk Joined 06/22/2003 Comments 140

Quote:

I was on 2.0.11. I uploaded the patch files and went to Admin Module. When I try to update the System module I get the message "Press the button below to update this module" BUT there is no button to press.

Any answer to this question? Mine is not a server side error!

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/29/2005 17:36 XOOPS is my life! Joined 06/21/2003 Comments 6320

Please stick to one thread, Shelia. I'm trying to help you in the forum thread. Double-posting just increases the places you have to look for answers.

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/29/2005 20:22 XOOPS is my life! Joined 06/21/2003 Comments 6320

I will make and release XOOPS 2.0.12a in about 50 minutes (unless Argentina forces Brasil into extended time) - I'm sorry Shelia, but I simply don't know what is causing your trouble, except that I cannot see how it can come from 2.0.11/2.0.12 since the troublesome areas have not been touched since 2.0.10. So if 2.0.10 was working, I'm clueless on this.

Sorry.

Re: Security Release: XOOPS 2.0.12

ghbook Published 06/29/2005 20:42 Just popping in Joined 11/14/2003 Comments 21

A fresh install of XOOPS 2.0.12 have the same problem i previously talked about. In the image manager images of a blob/database stored category dont display at all. Only their name appear.
Mzybe it's the sanitazation of the sql request in /class/criteria.php that doesn't work.

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/29/2005 21:07 XOOPS is my life! Joined 06/21/2003 Comments 6320

any debug errors in MySQL debug?

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/29/2005 21:19 XOOPS is my life! Joined 06/21/2003 Comments 6320

Found something:

In /image.php, add this line:

include_once XOOPS_ROOT_PATH."/class/module.textsanitizer.php";

above these two lines:

 $xoopsLogger =& XoopsLogger::instance(); 
$xoopsLogger->startTime();

I've never used the blob feature, so I cannot say if this will work correctly, since my test installation corrupts the images during upload. But at least it will avoid the fatal error in Criteria::render()

user

Re: Security Release: XOOPS 2.0.12a

Mithrandir Published 06/29/2005 21:41 XOOPS is my life! Joined 06/21/2003 Comments 6320

News item updated
Download links updated

Hope this one works better for you all.

Re: Security Release: XOOPS 2.0.12a

Shelia Published 06/30/2005 1:09 Not too shy to talk Joined 06/22/2003 Comments 140

Mithrandir, thanks for your help. Do you have any idea why the update button doesn't show? Is there another way to update the system module?

Shelia

user

Re: Security Release: XOOPS 2.0.12a

smdcom Published 06/30/2005 5:33 Joined 04/27/2004 Comments 901

quick release... thanks...!

user

Re: Security Release: XOOPS 2.0.12a

nobunobu Published 06/30/2005 6:25 Updated 06/30/2005 6:26 Just popping in Joined 05/23/2004 Comments 60

Hi, Mith.

With 2.0.12x criteria.php, AddSlases is applied to $value.

But some module source like modules/xoopsmembers/index.php initializes Criteria class with Add-Slashed value.
(I also found this pattern in /modules/system/admin/findusers/main.php

It will cause imcompatbility error.

Don't you think, this change is a very important imcompatbility issue for 3rd Party Modules.
------
(This suggetion is made by NobuNobu as a WordPress XOOPS Module author , not as a JP Core developing member. )

user

Re: Security Release: XOOPS 2.0.12a

Mithrandir Published 06/30/2005 8:29 Updated 06/30/2005 8:30 XOOPS is my life! Joined 06/21/2003 Comments 6320

You mean that xoopsmembers doesn't work? I find that it does. There might be some trouble if you search for something that includes a ' or " - but how often does that happen?

I will look at improving it for 2.2 - but no, I don't find it extremely important.

Re: Security Release: XOOPS 2.0.12a

fdj Published 06/30/2005 9:54 Just popping in Joined 09/19/2002 Comments 51

I'd like to know which files are different between 2.0.12 and 2.0.12a because I made some changes and I would not like to upgrade all the files a second time ?

user

Re: Security Release: XOOPS 2.0.12a

Mithrandir Published 06/30/2005 10:04 XOOPS is my life! Joined 06/21/2003 Comments 6320

From memory:

include/comment_edit.php
include/comment_post.php
class/criteria.php
class/xml/saxparser.php
modules/system/include/update.php
modules/system/xoops_version.php
image.php

user

Re: Security Release: XOOPS 2.0.12a

nobunobu Published 06/30/2005 10:55 Just popping in Joined 05/23/2004 Comments 60

Quote:

if you search for something that includes a ' or " - but how often does that happen?

Mayby searching words contains " is very rare case.
But I found , there are 5 persons whose Real Name contains ' in XOOPS.ORG members.
(w/o people who use Real name as a description)
' is often used for shorten some words.

user

Re: Security Release: XOOPS 2.0.12a

Mithrandir Published 06/30/2005 11:14 XOOPS is my life! Joined 06/21/2003 Comments 6320

Sure, but do you actually search for them?

What would you suggest? I was thinking about adding a $myts->stripSlashesGPC() before the ->addSlashes() call - then it would only be a problem, if you actually did search for \'

Anyway, my point is that it is not a crucial problem and that I will therefore work on limiting it - or removing it - (it = the problem) for XOOPS 2.2
It doesn't require a XOOPS 2.0.12b rushed release, I mean.

Re: Security Release: XOOPS 2.0.12

ghbook Published 06/30/2005 12:03 Just popping in Joined 11/14/2003 Comments 21

Thanks a lot, Mithrandir,. I applied the 2.0.10 --> 2.0.12a patch with the image.php modifications. It worked perfectly on my sites with the blob/database stored image categories.

Thanks once again

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/30/2005 12:16 XOOPS is my life! Joined 06/21/2003 Comments 6320

Glad to hear it ghbook, it was a bit annoying that I couldn't test it, so I'm happy it works for you.

user

Re: Security Release: XOOPS 2.0.12

onokazu Published 06/30/2005 12:34 XOOPS Founder Joined 12/13/2001 Comments 617

Quote:

Mithrandir wrote:

You mean that xoopsmembers doesn't work? I find that it does. There might be some trouble if you search for something that includes a ' or " - but how often does that happen?

It starts to become a problem if you have your server with magic_quotes_gpc disabled and try to search for a exact match on a string containing ' or other chars escaped by addslashes().

user

Re: Security Release: XOOPS 2.0.12

frankblack Published 06/30/2005 12:49 Just can't stay away Joined 06/13/2005 Comments 830

I am wondering about xoops_module_system_update in modules / system / include / update.php. This function is nowhere called, but I can imagine what it is supposed for.

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/30/2005 12:55 XOOPS is my life! Joined 06/21/2003 Comments 6320

which is why I suggested changing
$myts->addSlashes($value); to
$myts->addSlashes($myts->stripSlashesGPC($value));

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/30/2005 12:56 XOOPS is my life! Joined 06/21/2003 Comments 6320

Quote:

This function is nowhere called

Ah bugger - typo in the function name. Well, it is "just" a fix for the duplicating templates.

Will nail it with 2.2 next week.

Re: Security Release: XOOPS 2.0.12a

indream Published 06/30/2005 14:27 Updated 06/30/2005 14:50 Not too shy to talk Joined 09/21/2004 Comments 170

i'm bored to change XOOPS versions.
2.0.11 2.0.12 2.012a blablabla

user

Re: Security Release: XOOPS 2.0.12

nobunobu Published 06/30/2005 15:12 Just popping in Joined 05/23/2004 Comments 60

Quote:

which is why I suggested changing
$myts->addSlashes($value); to
$myts->addSlashes($myts->stripSlashesGPC($value));

Maybe you are being confused between sanitizing input parameter and making exact SQL query string.

$myts->AddSlashes($value) method should be called only if $value is GET or POST parameter. Because $myts->addSlashes method only escape ' character to \' ,only if magic_quotes_gpc is set to "off".

But, string contains ' should always be escaped to \' for valid SQL query.

If you use $myts->addSlashes($value) in your render() and magic_quotes_gpc is set to "on", literal constant or DB field value contains ' will not be escaped.

If you use $myts->addSlashes($myts->stripSlashesGPC($value)); in your render() and magic_quotes_gpc is set to "on", input parameter string contains ' will not be escaped.

If you use $xoopsDB->quoteString() in your render() and magic_quotes_gpc is set to "on", input parameter string contains ' will be escaped twice.

If you use $xoopsDB->quoteString($myts->stripSlashesGPC($value)) in your render() and magic_quotes_gpc is set to "on", literal constant or DB field value contains \' will not be escaped.

Maybe there is no universal solution for escaping ' only modifying logic of render() method.
$myts->stripSlashesGPC shold be called when initializing Criteria object, and render() should call $xoopsDB->quoteString for making valid SQL query string.

(I'm also confusing now

)

user

Too many versions

Fastian Published 06/30/2005 16:01 Not too shy to talk Joined 06/06/2005 Comments 156

Too many versions r a bit confusing for a new person like me ..

But by reading all comments what i got is

At My test installation currentl with "XOOPS 2.0.10" I just neet to get "XOOPS 2.0.12patch"

And at my Site where i am going for a new installation i need to use "XOOPS 2.0.12 Stable"

But where comes "XOOPS 2.0.12a" ??

user

Re: Too many versions

JimLunsford Published 06/30/2005 16:10 Not too shy to talk Joined 10/26/2004 Comments 191

I understand how it could be confusing. The good part about it though is that the Core Dev team cares enough to release a fix when there is a problem.

Quote:

At My test installation currentl with "XOOPS 2.0.10" I just neet to get "XOOPS 2.0.12patch"

Get the 2.0.12a patch and install it and you will be fine.

Quote:

And at my Site where i am going for a new installation i need to use "XOOPS 2.0.12 Stable"

I don't know for sure if the .12a patch was applied to that package. Might want to apply the patch on that anyway to be safe.

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/30/2005 17:34 XOOPS is my life! Joined 06/21/2003 Comments 6320

Quote:

Maybe you are being confused between sanitizing input parameter and making exact SQL query string.

Granted, I was for a while. And forgot that magic_quotes would not affect non-GPC parameters (however that could happen

)

However, I still think that $myts->addSlashes($myts->stripSlashesGPC($value)); is the best alternative. Here is why:

Let's look at where parameters for a Criteria can come from:

1) GPC input
2) Database output (values fetched in DB)
3) literal constant (do you mean any constant? Or what is the "literal" part? just so we are not talking past each other)
4) String supplied by developer

With the suggested solution 1) is safe no matter whether magic_quotes are on or off and no matter if the developer escapes the string or not.
Since database values are escaped (in order to be stored) they are safe, too.
3) and 4) are - if I understand it correctly - input by the developer or possibly a translator.

Worst case scenario with 1) and 2) being unsanitised is an SQL injection.
Worst case scenario with 3) and 4) is that the code will not work.
1) and 2) can look like it is working until someone exploits the hole. 3) and 4) will not work at all until the developer fixes it.

Therefore I think that my suggestion is the best solution. It will not be a universal solution but it will be the next best thing, I think.

If I have overlooked something or made a mistake or misunderstood you, please say so. I'm very happy for this dialogue and feel we are really getting somewhere.

user

Re: Too many versions

Mithrandir Published 06/30/2005 17:36 XOOPS is my life! Joined 06/21/2003 Comments 6320

Quote:

I don't know for sure if the .12a patch was applied to that package

The full version is 2.0.12a

user

Re: Security Release: XOOPS 2.0.12

onokazu Published 06/30/2005 18:54 XOOPS Founder Joined 12/13/2001 Comments 617

Quote:

which is why I suggested changing
$myts->addSlashes($value); to
$myts->addSlashes($myts->stripSlashesGPC($value))

Do you mean

addSlashes($myts->stripSlashesGPC($value))

?

If magic_quotes_gpc is on, then $myts->addSlashes() will not escape anything.
$myts->addSlashes($myts->stripSlashesGPC($value)) will not escape $value if magic_quotes_gpc on and GPC values passed in direclty to Criteria.

MyTextsanitizer::addSlashes() and MyTextsanitizer::stipSlashesGPC() methods were not originally meant to be used simultaneously. MyTextsanitizer::addSlashes() was meant for escaping GPC variables before saving them to DB (though DB::quoteString() is preferred now) and MyTextsanitizer::stripSlashesGPC for displaying GPC values.

What I would recommend (and which is implemented in our RC version) is to use XoopsDB::quoteString() only within render() and let the magic_quotes_gpc thing taken care before passing in any value to Criteria - clear enough for devs to understand when using the class, IMHO.

Re: Security Release: XOOPS 2.0.12

krobi Published 06/30/2005 18:54 Quite a regular Joined 12/21/2003 Comments 290

is there a update pack for 2.0.12 to 2.0.12a?

we are using some kernel hacks and so i dont really want to research the files once again.

or is there a changelog where i can see what changes have been done from 2.0.12 to 2.0.12a so i do this changes by hand?

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/30/2005 19:02 XOOPS is my life! Joined 06/21/2003 Comments 6320

Quote:

If magic_quotes_gpc is on, then $myts->addSlashes() will not escape anything.
$myts->addSlashes($myts->stripSlashesGPC($value)) will not escape $value if magic_quotes_gpc on and GPC values passed in direclty to Criteria.

If magic_quotes_gpc is on, $myts->addSlashes() will not need to escape anything (except programmer-provided variables... but that would be the programmer's responsibility to do that).

If a GPC value is passed directly to Criteria with magic_quotes_gpc on, the GPC value will be escaped by magic_quotes. If a GPC value is passed directly to Criteria with magic_quotes_gpc off, the stripSlashesGPC() will not do anything (since there will not be slashes to remove) and addSlashes() will escape the string.

user

Re: Security Release: XOOPS 2.0.12

onokazu Published 06/30/2005 19:08 XOOPS Founder Joined 12/13/2001 Comments 617

Quote:

If a GPC value is passed directly to Criteria with magic_quotes_gpc on, the GPC value will be escaped by magic_quotes.

I am refering to what you suggested for the next change:

$myts->addSlashes($myts->stripSlashesGPC($value))

Escapes by magic quotes are removed with stripSlashesGPC() in the above code.

user

Re: Security Release: XOOPS 2.0.12

LazyBadger Published 06/30/2005 19:15 Home away from home Joined 06/07/2004 Comments 1187

Quote:

is there a update pack for 2.0.12 to 2.0.12a?

Yes, I prepared it here

Re: Security Release: XOOPS 2.0.12

krobi Published 06/30/2005 19:33 Quite a regular Joined 12/21/2003 Comments 290

thx thats great, should be linked in the news for all 2.0.12 users.

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/30/2005 19:45 Updated 06/30/2005 19:51 XOOPS is my life! Joined 06/21/2003 Comments 6320

Quote:

Escapes by magic quotes are removed with stripSlashesGPC() in the above code.

~~How?~~

Ahhh bugger. Had read that as
if (!get_magic_quotes_gpc()) {

Back to the drawing board, I guess. Perhaps the best solution is the one with quoteString().

Will think about it some more.

user

Re: Security Release: XOOPS 2.0.12

Mithrandir Published 06/30/2005 19:55 XOOPS is my life! Joined 06/21/2003 Comments 6320

btw. Thanks for the help

user

Re: Security Release: XOOPS 2.0.12a

Tabasco Published 07/01/2005 2:27 Quite a regular Joined 12/26/2003 Comments 203

Just upgraded from 2.0.10 to 2.0.12a Everything seems to working fine

Thanks for all the top notch geek work, dev team

Tabby

Re: Security Release: XOOPS 2.0.12a

dhdesign Published 07/01/2005 4:42 Updated 07/01/2005 4:44 Just popping in Joined 06/24/2005 Comments 5

I've done the upgrade and everything went smoothly. However, with debug mode on, I am getting the following at the bottom of some pages of the site, in the pop-up windows for Who's Online, etc., and in the admin control panel as well:

Warning [PHP]: ob_start(): output handler 'ob_gzhandler' cannot be used after 'URL-Rewriter' in file include/cp_functions.php line 33

Any ideas on how to fix this??

user

Re: Security Release: XOOPS 2.0.12a

Dave_L Published 07/01/2005 4:53 XOOPS is my life! Joined 11/07/2003 Comments 2277

Apparently, there's a conflict between gzip compression and PHP debug mode, so turn one of them off.

user

Re: Security Release: XOOPS 2.0.12a

m0nty Published 07/01/2005 5:27 XOOPS is my life! Joined 10/24/2003 Comments 3337

if you want gzip, then try this way.

turn off gzip in XOOPS admin..

then create an .htaccess file.. (if you can that is)

inside the htaccess file put

php_flag zlib.output_compression on
php_value zlib.output_compression_level 5

and save it to the xoops_root folder, the 1 with mainfile.php in..

then check your headers to see if it's actually working..

i use a program called iehttp headers to view header info..

user

Re: Security Release: XOOPS 2.0.12

Gambero[removed] Published 07/01/2005 13:10 Quite a regular Joined 01/13/2005 Comments 393

Having some problems with all themes on fresh install of 2.0.12a.

I have a blue border around logo and banner. I don't understand it!

Check here:

user

Re: Security Release: XOOPS 2.0.12

m0nty Published 07/01/2005 13:27 XOOPS is my life! Joined 10/24/2003 Comments 3337

check root/xoops.css

make sure

img {border: 0;} is included in it.

user

Re: Security Release: XOOPS 2.0.12

Gambero[removed] Published 07/01/2005 13:42 Quite a regular Joined 01/13/2005 Comments 393

That solved the problem, thanks!

In the zip package there are no user.php and style.css files.

Re: Security Release: XOOPS 2.0.12

dhdesign Published 07/01/2005 16:14 Just popping in Joined 06/24/2005 Comments 5

Monty and Dave_L - Thank you for your quick responses.

I've got debug mode on as I'm having some problems with a few modules, and wanted to check the error messages. From what you said, once I turn it off, the error that I listed will go away.

Re: Security Release: XOOPS 2.0.12a

pixelpusher Published 07/01/2005 22:35 Just popping in Joined 10/30/2004 Comments 42

I am running 2.0.9.2. How can I upgrage to 2.0.12a and is it worth the effort?

user

Re: Security Release: XOOPS 2.0.12a

jdseymour Published 07/02/2005 1:30 Friend of XOOPS Joined 11/11/2004 Comments 3782

security wise, yes. That is the reason for a security release.

Download the 2.0.9.2 to 2.0.10 patch and the 2.0.10 to 2.0.12a patch, overwrite the files in the 2.0.9.2 to 2.0.10 patch with the other patch. Copy all files to your XOOPS site directory.

See this: XOOPS System Upgrade Flash Tutorial to follow along with the process. It will explain updating templates and so on.

user

Re: Security Release: XOOPS 2.0.12a

giba Published 07/02/2005 1:39 Updated 07/02/2005 1:40 Just can't stay away Joined 04/26/2003 Comments 638

[edited Giba splanish version]

My version of XOOPS Before is 2.0.73
--------------------------------------

Sorry, after install version 2.0.12 my conection MySql not read.

mainfile.php is correct.
No found of problem, help-me

I using Xamp 1.14.14 in localhost for tests.

Sorry my stup question, one day and not found error.

user

Re: Security Release: XOOPS 2.0.12a

jdseymour Published 07/02/2005 1:54 Friend of XOOPS Joined 11/11/2004 Comments 3782

Did you follow the upgrade path? 2.0.7.3 to 2.0.9.2 to 2.0.10 to 2.0.12a?

What about news and newbb folders in the upgrade, did you remove them if your modules are upgraded?

Any error messages?

user

Re: Security Release: XOOPS 2.0.12a

Housefly Published 07/21/2005 12:02 Updated 07/21/2005 12:38 Just popping in Joined 03/29/2005 Comments 49

Poor me! :( I updated even module/newbb/post.php even though my newbb was newbb2, now I cannot post anymore in my site. In my frustration I re-upload post.php from version 2.0.10 but it doesn't work.

The problem seems to be not being able to overwrite updated post.php file, it is around 15kb while the previous version 2.0.10 was around 10kb. I'm not able to overwrite it.

1st Edit: And I have updated system mobule as well as newbb2 module after I could overwrite post.php old file with the new file. But Error still occurs and nothing is posted in my forum when tried. Should I carry on updating my site to patch 2.0.13 from 2.0.12a? But forum is a problem now.

Please help me. Thanks.

Login

Username

Password

Remember me

Register now! | Lost Password?

Search

Advanced Search

Recent Comments

Re: New Admin Theme for XOOPS (Beta)

Publisher liomj 10/28/2024 23:33
Sanford Pharmacy: Exceptional Pharmacy Services Tailored to You

Publisher donaldjohn 10/16/2024 9:53
Re: New Admin Theme for XOOPS (Beta)

Publisher walkero 10/15/2024 18:30
Re: XOOPS 2.5.12 Beta-2 available for Testing

Publisher cadch 08/30/2024 6:33
Re: XOOPS 2.5.12 Beta-2 available for Testing

Publisher cadch 08/30/2024 6:30

Who's Online

269 user(s) are online (26 user(s) are browsing XOOPS News)

Members: 0

Guests: 269

Donat-O-Meter

Stats
Goal:	$100.00
Due Date:	Nov 30
Gross Amount:	$0.00
Net Balance:	$0.00
Left to go:	$100.00

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

{{ record.commit.author.name }} {{ record.commit.author.date | formatDate }}

Archives

News archives