Firewall problems and XOOPS_DB_CHKREF [XOOPS general usage questions]

1

Firewall problems and XOOPS_DB_CHKREF

2003/12/4 17:01
petzan
Just popping in
Posts: 11
Since: 2003/11/19

Hi!
I think it is a bit anoying that I have to inform my visitors how to setup their firewall. So I found this change in a post.
But my qestion is, what harm could be done to my site if I make the change?

in include/common.php
change

if (!defined('XOOPS_XMLRPC')) { define('XOOPS_DB_CHKREF', 1);} else { define('XOOPS_DB_CHKREF', 0);}

to

define('XOOPS_DB_CHKREF', 0);

As sugested in
https://xoops.org/modules/newbb/viewtopic.php?topic_id=6594&forum=20

2

Re: Firewall problems and XOOPS_DB_CHKREF

2003/12/4 17:05
CBlue
Posts: 1244
Since: 2003/6/28

The webmaster of this site posted the solution in that post you added. So I would think that it would be safe as long as you trust your visitors as he said.

3

Re: Firewall problems and XOOPS_DB_CHKREF

2003/12/4 17:19
petzan
Just popping in
Posts: 11
Since: 2003/11/19

But, if my site is on internet I can not trust all visitors. So could this change make it possible for anonymous (not logged in) users to harm my site?

4

Re: Firewall problems and XOOPS_DB_CHKREF

2003/12/4 17:23
CBlue
Posts: 1244
Since: 2003/6/28

You will have to ask the webmaster who posted that fix. Personally, I see no problem with users configuring their firewalls to work right with my site. I've had no users complain about it and I use a firewall myself.

5

Re: Firewall problems and XOOPS_DB_CHKREF

2003/12/4 18:43
Mithrandir
XOOPS is my life!
Posts: 6320
Since: 2003/6/21

Quote:

petzan wrote:
But, if my site is on internet I can not trust all visitors. So could this change make it possible for anonymous (not logged in) users to harm my site?

anonymous or logged in - they both have to live under the same rules regarding the database.

The Referrer-check checks if form requests came from the webserver. If you disable the check, you cannot be certain that visitors aren't making their own versions of forms and send them via the POST method. This could leave your site open for e.g. SQL injection from custom made forms.

I use a custom form for accessing an email account - which makes life easier for me, but it might be possible to exploit that (I just don't)

6

Re: Firewall problems and XOOPS_DB_CHKREF

2003/12/4 19:08
petzan
Just popping in
Posts: 11
Since: 2003/11/19

Thanx for your reply, so it could be a bit dangerous to make the change. I will try to convince my users to disable their firewalls.

Stats
Goal:	$100.00
Due Date:	May 31
Gross Amount:	$0.00
Net Balance:	$0.00
Left to go:	$100.00

Firewall problems and XOOPS_DB_CHKREF

Re: Firewall problems and XOOPS_DB_CHKREF

Re: Firewall problems and XOOPS_DB_CHKREF

Re: Firewall problems and XOOPS_DB_CHKREF

Re: Firewall problems and XOOPS_DB_CHKREF

Re: Firewall problems and XOOPS_DB_CHKREF

Login

Search

Recent Posts

Re: Rebuilding and Updating a 20 years old Xoops Website from 2.0.18? to 2.5.11

Rebuilding and Updating a 20 years old Xoops Website from 2.0.18? to 2.5.11

Re: NewBB v 5.1.0 b 6

Re: NewBB v 5.1.0 b 6

NewBB v 5.1.0 b 6

Re: XOOPS 2.5.11 search user is not working

Re: oledrion

Re: oledrion

Re: oledrion

Re: oledrion

Who's Online

Donat-O-Meter

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}