XOOPS Uploader Security Patch Released - XOOPS - XOOPS News

XOOPS

News

News World of XOOPS Developers Hacks Themes Archive Submit News

XOOPS: XOOPS Uploader Security Patch Released

Posted by: phpppOn 2007/10/1 6:46:56 19948 reads

There is potential vulnerability identified in uploader class in case upload configuration is not set properly by modules.
The patch is applicable to all XOOPS versions.

Download from SourceForge XOOPS.

Instructions:
Upload the two files /class/uploader.php and /class/mimetypes.inc.php to your /class/ folder and overwrite existent files.

You are highly encouraged to implement the patch to your existent XOOPS system.

The comments are owned by the author. We aren't responsible for their content.

Re: XOOPS Uploader Security Patch Released

hervet Published 10/01/2007 7:27 Friend of XOOPS Joined 11/04/2003 Comments 2267

What are the versions of XOOPS affected by this ?

Re: XOOPS Uploader Security Patch Released

McDonald Published 10/01/2007 8:39 Home away from home Joined 08/15/2005 Comments 1072

Quote:

hervet wrote:

What are the versions of XOOPS affected by this ?

Quote:

The patch is applicable to all XOOPS versions.

Probably all XOOPS versions released so far are affected.

Re: XOOPS Uploader Security Patch Released

Published 10/01/2007 15:44 Joined Comments

Quote:

Probably all XOOPS versions released so far are affected.

I suspect that Hervé was referring to the newly announced 2.0.17.1RC2........... has this fix made it into it?

Will it be included in the "2.0.17.1 Final" and all subsequent releases?

Just so we know if folks ask in the future, which they are sure to do

Re: XOOPS Uploader Security Patch Released

McDonald Published 10/01/2007 16:23 Home away from home Joined 08/15/2005 Comments 1072

The files /class/uploader.php and /class/mimetypes.inc.php are the same in the uploader patch as they are in XOOPS 2.0.17 RC2.
So the patch made it into 2.0.17.1 RC2.

I think we can assume that this security patch will be included in the 2.0.17.1 final version too.

Re: XOOPS Uploader Security Patch Released

Dave_L Published 10/01/2007 18:20 XOOPS is my life! Joined 11/07/2003 Comments 2277

McDonald is correct.

Re: XOOPS Uploader Security Patch Released

Published 10/01/2007 18:39 Updated 10/01/2007 18:50 Joined Comments

Quote:

McDonald is correct.

So it's not applicable to all versions

The above comment is made with humorius intent. The comment below is sincere.

Thanks for the update - much appreciated

Re: XOOPS Uploader Security Patch Released

hervet Published 10/01/2007 20:27 Friend of XOOPS Joined 11/04/2003 Comments 2267

My question was asked to know if it was for the 2.0.17 version or ALL the versions but I had the answer.

Re: XOOPS Uploader Security Patch Released

frankblack Published 10/02/2007 7:53 Just can't stay away Joined 06/13/2005 Comments 830

I wonder if the patched uploader IS secure? If I get this right mimetype checking is relying on what the browser delivers on mimetype information.

Maybe there should be checks made afterwards with THIS or even better THIS.

But as a drawback, certain things have to be properly set resp. installed. Maybe we can see this in the next version?

Re: XOOPS Uploader Security Patch Released

hervet Published 10/02/2007 9:25 Updated 10/02/2007 10:09 Friend of XOOPS Joined 11/04/2003 Comments 2267

Frank,

That's just a comment from myself, I've been playing with mime_content_type, it relies on a file that is not always installed and not always up to date and I did not get much more success with the finfo functions.

But you are true, the information coming from the browser is not trusty.

** EDIT by myself **
If you use this patch with a version of XOOPS older than the 2.0.17 you will have some problems because this class uses some defines that don't exist in older versions (for example in the 2.0.16)

Other point, when the file size is not set by the module, the class returns true (in checkMaxFileSize()) as if everything was ok. I think it will be disturbing for users to have a module that is telling them that the upload was ok when it's not true no ?

Hervé.

Re: XOOPS Uploader Security Patch Released

phppp Published 10/02/2007 9:53 XOOPS Contributor Joined 01/25/2004 Comments 2857

Perhaps we should focus 2.0.18 on all possible vuln

Re: XOOPS Uploader Security Patch Released

Marco Published 10/02/2007 16:38 Updated 10/02/2007 16:57 Home away from home Joined 03/15/2004 Comments 1256

Quote:

Perhaps we should focus 2.0.18 on all possible vuln

come on, guys, is the "patch of the patch" process going to be a new dev rule? do the core dev test their work?
please don't make again old mistakes, and learn from past. it's really not time to play again old bad errors, this will confuse community.

Moreover, i hope you will add in the 2.0.17.1 changelog some informations about the hervet's comment ("Other point, when the file size is not set by the module, the class returns true (in checkMaxFileSize()) as if everything was ok. I think it will be disturbing for users to have a module that is telling them that the upload was ok when it's not true no ?")

Re: XOOPS Uploader Security Patch Released

psaxtiri Published 10/02/2007 18:24 Not too shy to talk Joined 06/17/2007 Comments 185

good evening.

Is it necessary for XOOPS 2.0.16?

Do you recommend to take a backup first?

Re: XOOPS Uploader Security Patch Released

MS-2001 Published 10/03/2007 9:11 Quite a regular Joined 07/27/2004 Comments 204

Quote:

If you use this patch with a version of XOOPS older than the 2.0.17 you will have some problems because this class uses some defines that don't exist in older versions (for example in the 2.0.16)

I'm using the patch with 2.0.7.3

and up to now it seems not to make any problems.
What defines do you talk about? Language defines? (I also did an update of them).

Re: XOOPS Uploader Security Patch Released

Peekay Published 10/04/2007 8:28 Updated 10/04/2007 8:29 XOOPS is my life! Joined 11/20/2004 Comments 2335

I know the announcement says all versions, but in response to Hervet's comment, can we have a definitive confirmation from core team - is this patch suitable to apply to all versions of XOOPS (2.0.7. 10, 13, 14 etc..)?

Re: XOOPS Uploader Security Patch Released

MS-2001 Published 10/04/2007 9:55 Quite a regular Joined 07/27/2004 Comments 204

Well, as I said it seems to work well with 2.0.7.3. I couldn't make out any problems so far.

Re: XOOPS Uploader Security Patch Released

hervet Published 10/04/2007 14:13 Friend of XOOPS Joined 11/04/2003 Comments 2267

Quote:

Well, as I said it seems to work well with 2.0.7.3. I couldn't make out any problems so far.

If you upload a file and something is going wrong, you will see some defines like (just an example) _ER_UP_MIMETYPELOAD instead of the text (because those defines only exist in 2.0.17 in a new file /xoops/language/mylang/uploader.php)

Re: XOOPS Uploader Security Patch Released

Peekay Published 10/04/2007 15:55 XOOPS is my life! Joined 11/20/2004 Comments 2335

Thx Hervet. So, the file /xoops/language/mylang/uploader.php and some instruction where to put it should really be added to the patch downloads, yes?

Re: XOOPS Uploader Security Patch Released

hervet Published 10/04/2007 16:17 Friend of XOOPS Joined 11/04/2003 Comments 2267

There's only the core team which can give you an answer.

Re: XOOPS Uploader Security Patch Released

MS-2001 Published 10/05/2007 14:17 Quite a regular Joined 07/27/2004 Comments 204

Quote:

If you upload a file and something is going wrong, you will see some defines like (just an example) _ER_UP_MIMETYPELOAD instead of the text (because those defines only exist in 2.0.17 in a new file /xoops/language/mylang/uploader.php)

I considered that with the update.

Re: XOOPS Uploader Security Patch Released

Peekay Published 10/06/2007 8:20 XOOPS is my life! Joined 11/20/2004 Comments 2335

It appears that this security patch is incomplete to qualify for use with all versions of Xoops. Not a big deal to add the missing file to the download, surely?

Re: XOOPS Uploader Security Patch Released [necessary for me?]

allnewtome Published 10/06/2007 10:11 Not too shy to talk Joined 11/30/2005 Comments 175

This might seem like a silly question but...

I have php safe mode on, and none of my modules are set to allow uploads at all.

Do I need to use this patch?

Or am I safe waiting until XOOPS 2.0.17.1 comes out (I am using 2.0.16 now)?

Thank you.

Login

Username

Password

Remember me

Search

Advanced Search

Donat-O-Meter

Stats
Goal:	$100.00
Due Date:	Nov 30
Gross Amount:	$0.00
Net Balance:	$0.00
Left to go:	$100.00

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

{{ record.commit.author.name }} {{ record.commit.author.date | formatDate }}

XOOPS: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released

Re: XOOPS Uploader Security Patch Released [necessary for me?]

Login

Search

Recent Comments

Re: New Admin Theme for XOOPS (Beta)

Sanford Pharmacy: Exceptional Pharmacy Services Tailored to You

Re: New Admin Theme for XOOPS (Beta)

Re: XOOPS 2.5.12 Beta-2 available for Testing

Re: XOOPS 2.5.12 Beta-2 available for Testing

Who's Online

Donat-O-Meter

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

Archives

News archives