The Joomla! Forum ™

Download

Demo


Board index » Joomla! Older Version Support » Joomla! 1.0 » Security - 1.0.x

Forum rules


Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.



Post new topic Reply to topic  Page 4 of 14
  [ 418 posts ]  Go to page Previous  1, 2, 3, 4, 5, 6, 7 ... 14  Next
  Print view Previous topic | Next topic 
Author Message
tyler
PostPosted: Sun Aug 27, 2006 7:43 am 
User avatar
Joomla! Intern
Joomla! Intern

Joined: Thu Jan 26, 2006 11:36 pm
Posts: 71
Location: Los Angeles, California, United States
okay, I just tested the latest round of changes (w/RG em Off) and the image & file uploads work fine.  So does the subscribe me option.

I did not test to see if something in excess of the configured filesize limits will still get through or not.  Was wondering 1st if it is even something that needs to be tested with respect to the other $_FILES vars in the component code.

_________________
-Tyler D.
Web Developer & Integrator: http://www.LasVegasExtremes.com
Top
 Profile  
 
t-spark
PostPosted: Sun Aug 27, 2006 7:51 am 
Joomla! Fledgling
Joomla! Fledgling

Joined: Wed Sep 14, 2005 12:22 pm
Posts: 3
Location: Vilnius
On my Joomlaboard forum the function "Mark all forums read" doesn't work afer apllying all fixes above. Anyone could test it as well?


Last edited by t-spark on Sun Aug 27, 2006 7:52 am, edited 1 time in total.

Top
 Profile  
 
JohnDubya
PostPosted: Sun Aug 27, 2006 9:22 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Fri Jul 21, 2006 6:11 am
Posts: 33
After turning register_globals off, I cannot use the Karma function for Joomlaboard 1.1.2.  It says this:

Quote:
You came to this page in error. Please inform the administrator on which links you clicked that got you here.
She or he can then file a bug report.

Thank you!

Error number to include in your report: : SB001-karma-01NLO


Anyone else notice this problem?  How do I fix this?


Last edited by JohnDubya on Sun Aug 27, 2006 10:28 pm, edited 1 time in total.

Top
 Profile  
 
kunglao
PostPosted: Mon Aug 28, 2006 2:06 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Fri Aug 25, 2006 7:40 pm
Posts: 8
Rob, Beat, thanks for the insights  :)  I appreciate it.

Tyler: from what I know, we don't need to check for the other 4 variables within XXX_upload.php because they're not where the problem is.  As Beat pointed out, the problem is really in the trigger within post.php, so this is just a patch for that trigger.  I think replacing 'name' with 'tmp_name' should also work.

t-spark: I can duplicate your problem :(
Top
 Profile  
 
kunglao
PostPosted: Mon Aug 28, 2006 2:19 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Fri Aug 25, 2006 7:40 pm
Posts: 8
t-spark wrote:
On my Joomlaboard forum the function "Mark all forums read" doesn't work afer apllying all fixes above. Anyone could test it as well?


This should fix it
Code:
if (!isset($markaction) && isset($_POST["markaction"]))    $markaction    = mosGetParam ( $_POST, 'markaction'  , '');


Please confirm.
Top
 Profile  
 
tyler
PostPosted: Mon Aug 28, 2006 3:05 am 
User avatar
Joomla! Intern
Joomla! Intern

Joined: Thu Jan 26, 2006 11:36 pm
Posts: 71
Location: Los Angeles, California, United States
kunglao wrote:
This should fix it
Code:
code ... code


Please confirm.




hmmm, i tried it and it popped the javascript saying they were all marked as read, but when I get back to the forum, it still maintains that many of the posts I'm viewing are still new.

_________________
-Tyler D.
Web Developer & Integrator: http://www.LasVegasExtremes.com


Last edited by tyler on Mon Aug 28, 2006 3:07 am, edited 1 time in total.

Top
 Profile  
 
kunglao
PostPosted: Mon Aug 28, 2006 4:58 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Fri Aug 25, 2006 7:40 pm
Posts: 8
Tyler: I can't reproduce your problem  !
It's working on different platforms for me ... don't know where the discrepancy is  ???
Top
 Profile  
 
t-spark
PostPosted: Mon Aug 28, 2006 5:59 am 
Joomla! Fledgling
Joomla! Fledgling

Joined: Wed Sep 14, 2005 12:22 pm
Posts: 3
Location: Vilnius
kunglao wrote:
t-spark wrote:
On my Joomlaboard forum the function "Mark all forums read" doesn't work afer apllying all fixes above. Anyone could test it as well?


This should fix it
Code:
if (!isset($markaction) && isset($_POST["markaction"]))    $markaction    = mosGetParam ( $_POST, 'markaction'  , '');


Please confirm.




Thanks, it works fine for me!
Top
 Profile  
 
tyler
PostPosted: Mon Aug 28, 2006 7:14 am 
User avatar
Joomla! Intern
Joomla! Intern

Joined: Thu Jan 26, 2006 11:36 pm
Posts: 71
Location: Los Angeles, California, United States
kunglao wrote:
don't know where the discrepancy is  ???

yeah, me either, I even tried changing it from POST to REQUEST and that didn't do the trick, even quadruple checked to make sure I wasn't mistakenly uploading to my test server either, so I'm still at a loss as far as my tests go.


UPDATE:
Just found out this is a personal problem I'm having.  Even w/RG on, I still experience the problems w/marking posts/forums as read.  I'll have to deal with this one on my own, but thanks for the fix, cuz it probably will resolve the RG issue for me when I do isolate this other problem I'm having.

_________________
-Tyler D.
Web Developer & Integrator: http://www.LasVegasExtremes.com


Last edited by tyler on Mon Aug 28, 2006 7:24 am, edited 1 time in total.

Top
 Profile  
 
crow
PostPosted: Mon Aug 28, 2006 12:21 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Mon Aug 29, 2005 5:17 pm
Posts: 304
Location: Austria
One off component that dont work when register globals are 0 is

mospjirc

Hier is my post in components section..

http://forum.joomla.org/index.php/topic,89631.0.html

Hope someone can fix this somehow :))

I turned globals to 1 again, with CB 1.0.1

_________________
BosanskoHercegovacki Chat Komjuniti
http://www.chat.ba
Top
 Profile  
 
Beat
PostPosted: Mon Aug 28, 2006 1:38 pm 
User avatar
Joomla! Guru
Joomla! Guru

Joined: Thu Aug 18, 2005 8:53 am
Posts: 824
Location: Switzerland
JohnDubya wrote:
After turning register_globals off, I cannot use the Karma function for Joomlaboard 1.1.2.  It says this:

Quote:
You came to this page in error. Please inform the administrator on which links you clicked that got you here.
She or he can then file a bug report.

Thank you!

Error number to include in your report: : SB001-karma-01NLO


Anyone else notice this problem?  How do I fix this?


This fixes that problem:
Code:
if (isset($_GET["userid"])) $userid  = mosGetParam ( $_GET, 'userid' , '' );   //BBTEMPFIX
if (isset($_GET["pid"])) $pid  = mosGetParam ( $_GET, 'pid' , '' );   //BBTEMPFIX




kunglao wrote:
t-spark wrote:
On my Joomlaboard forum the function "Mark all forums read" doesn't work afer apllying all fixes above. Anyone could test it as well?


This should fix it
Code:
if (!isset($markaction) && isset($_POST["markaction"]))    $markaction    = mosGetParam ( $_POST, 'markaction'  , '');


Please confirm.




Thanks for the fix, works as expected. Added to my post overview post above:
http://forum.joomla.org/index.php/topic ... #msg441456

_________________
Beat 8)
www.joomlapolis.com <= Community Builder + CBSubs Joomla membership payment system - team
hosting.joomlapolis.com <= Joomla! Hosting, by the CB Team
Top
 Profile  
 
Websmurf
PostPosted: Mon Aug 28, 2006 1:40 pm 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Fri Aug 19, 2005 2:23 pm
Posts: 2230
Location: The Netherlands
crow wrote:
One off component that dont work when register globals are 0 is

mospjirc

Hier is my post in components section..

http://forum.joomla.org/index.php/topic,89631.0.html

Hope someone can fix this somehow :))

I turned globals to 1 again, with CB 1.0.1

added it to the list :)

_________________
Adam van Dongen - Developer

- Blocklist, ODT Indexer, EasyFAQ, Easy Guestbook, Easy Gallery, YaNC & Redirect -
http://www.joomla-addons.org - http://www.bandhosting.nl
Top
 Profile  
 
JohnDubya
PostPosted: Mon Aug 28, 2006 2:37 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Fri Jul 21, 2006 6:11 am
Posts: 33
Beat wrote:
This fixes that problem:
Code:
if (isset($_GET["userid"])) $userid  = mosGetParam ( $_GET, 'userid' , '' );   //BBTEMPFIX
if (isset($_GET["pid"])) $pid  = mosGetParam ( $_GET, 'pid' , '' );   //BBTEMPFIX



Please confirm.

Thanks for the fix, works as expected. Added to my post overview post above:
http://forum.joomla.org/index.php/topic ... #msg441456


The Karma function works now.  Thanks so much, Beat!  You rock!
Top
 Profile  
 
tyler
PostPosted: Mon Aug 28, 2006 11:29 pm 
User avatar
Joomla! Intern
Joomla! Intern

Joined: Thu Jan 26, 2006 11:36 pm
Posts: 71
Location: Los Angeles, California, United States
JohnDubya wrote:
The Karma function works now.  Thanks so much, Beat!  You rock!


Ditto for me, Karma now works with Beat's fix :)

_________________
-Tyler D.
Web Developer & Integrator: http://www.LasVegasExtremes.com
Top
 Profile  
 
jonblazn
PostPosted: Tue Aug 29, 2006 6:50 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Tue Aug 23, 2005 6:55 am
Posts: 43
Beat-
I'm sorry for bothering but I don't quite follow your fix for akocomment. Exactly what files should I be editing? Thanks in advance-
Top
 Profile  
 
Beat
PostPosted: Tue Aug 29, 2006 7:33 am 
User avatar
Joomla! Guru
Joomla! Guru

Joined: Thu Aug 18, 2005 8:53 am
Posts: 824
Location: Switzerland
jonblazn wrote:
Beat-
I'm sorry for bothering but I don't quite follow your fix for akocomment. Exactly what files should I be editing? Thanks in advance-


Thanks for noticing that the edit instructions were a little short-cutted. Added filenames and clarified instructions. Please check my again my edited post:
http://forum.joomla.org/index.php/topic ... #msg450093

_________________
Beat 8)
www.joomlapolis.com <= Community Builder + CBSubs Joomla membership payment system - team
hosting.joomlapolis.com <= Joomla! Hosting, by the CB Team
Top
 Profile  
 
n0fear2
PostPosted: Tue Aug 29, 2006 9:09 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Tue May 23, 2006 3:33 pm
Posts: 34
Could anyone get any Coppermine Bridge to work with RG off and joomla 1.0.11? Everything works fine in 1.0.11 but when i turn RG Emulation to off i only get a blank page with the coppermine bridge =(
Top
 Profile  
 
novata
PostPosted: Tue Aug 29, 2006 10:15 am 
User avatar
Joomla! Ace
Joomla! Ace

Joined: Thu Oct 20, 2005 2:50 pm
Posts: 1144
thanks Adam for start this thread and thanks to beat for the fixes. fixing joomla while sleeping  :laugh:
hats off!!  :o
Top
 Profile  
 
sanni
PostPosted: Tue Aug 29, 2006 12:03 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Fri Aug 26, 2005 9:56 pm
Posts: 45
I am getting the alert when I upgrade to 1.0.11 that

PHP register_globals setting is `ON` instead of `OFF`

In globals.php I have

define( 'RG_EMULATION', 0 );

What else needs to be changed? 
Top
 Profile  
 
kunglao
PostPosted: Tue Aug 29, 2006 12:12 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Fri Aug 25, 2006 7:40 pm
Posts: 8
sanni wrote:
I am getting the alert when I upgrade to 1.0.11 that

PHP register_globals setting is `ON` instead of `OFF`

In globals.php I have

define( 'RG_EMULATION', 0 );

What else needs to be changed? 



I think you'll need to request your host to turn it off.
Top
 Profile  
 
sanni
PostPosted: Tue Aug 29, 2006 1:23 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Fri Aug 26, 2005 9:56 pm
Posts: 45
kunglao wrote:
sanni wrote:
I am getting the alert when I upgrade to 1.0.11 that

PHP register_globals setting is `ON` instead of `OFF`

In globals.php I have

define( 'RG_EMULATION', 0 );

What else needs to be changed? 



I think you'll need to request your host to turn it off.


So this alert is a warning that the host's system may not recognize when the register global is tuned off on individual sites.  Isn't this what the php.ini file was supposed to resolve if the host would not turn the global function off?  Nothing has really changed in the area other than there is now an alert. 
Top
 Profile  
 
annemari
PostPosted: Tue Aug 29, 2006 2:02 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Mon Jul 03, 2006 10:08 am
Posts: 27
Sanni,

register globals depends on the host. It's possible to turn it off for whole server, or just for the virtual server.
Check from the admin panel  > system info. If it says Register Globals:  OFF, it's off.
Top
 Profile  
 
sanni
PostPosted: Tue Aug 29, 2006 2:12 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Fri Aug 26, 2005 9:56 pm
Posts: 45
annemari wrote:
Sanni,

register globals depends on the host. It's possible to turn it off for whole server, or just for the virtual server.
Check from the admin panel  > system info. If it says Register Globals:  OFF, it's off.


Thanks. My accounts are on different servers with the same host and and on one the register globals are off and on another they are on. 
Top
 Profile  
 
penalty
PostPosted: Tue Aug 29, 2006 2:22 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Tue Aug 29, 2006 2:18 pm
Posts: 10
Location: Bulgaria
Hello, after  applying emulation 0, even though I applied all fixes to joomlaboard, threaded view stopped working. Can anybody post a fix for it?
Top
 Profile  
 
Beat
PostPosted: Tue Aug 29, 2006 2:52 pm 
User avatar
Joomla! Guru
Joomla! Guru

Joined: Thu Aug 18, 2005 8:53 am
Posts: 824
Location: Switzerland
penalty wrote:
Hello, after  applying emulation 0, even though I applied all fixes to joomlaboard, threaded view stopped working. Can anybody post a fix for it?


Fix is as follows:

Code:
if (isset($_GET["view"])) $view  = mosGetParam ( $_GET, 'view' , '' );   //BBTEMPFIX


updating my JoomlaBoard overview post:
http://forum.joomla.org/index.php/topic ... #msg441456

_________________
Beat 8)
www.joomlapolis.com <= Community Builder + CBSubs Joomla membership payment system - team
hosting.joomlapolis.com <= Joomla! Hosting, by the CB Team
Top
 Profile  
 
crow
PostPosted: Tue Aug 29, 2006 3:57 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Mon Aug 29, 2005 5:17 pm
Posts: 304
Location: Austria
Beat: is there a way that you could look in mospjirc.2.1.2?. Normal pjirc java applet work just fine, so i think it just need to be edited the login page that generete this component...

Thnx

_________________
BosanskoHercegovacki Chat Komjuniti
http://www.chat.ba
Top
 Profile  
 
Beat
PostPosted: Tue Aug 29, 2006 4:05 pm 
User avatar
Joomla! Guru
Joomla! Guru

Joined: Thu Aug 18, 2005 8:53 am
Posts: 824
Location: Switzerland
crow wrote:
Beat: is there a way that you could look in mospjirc.2.1.2?. Normal pjirc java applet work just fine, so i think it just need to be edited the login page that generete this component...

Thnx


Sorry, have to put priorities elsewhere right now, all of this should be task of the authors...

I'm sharing the results of the work done for JoomlaPolis and other websites, and giving fixes for the great testing done in the community.

I'm not using mospjirc anywhere...maybe the author or somebody else can pick that one...maybe even you...

it's not very hard: look at the urls used that don't work, and for posts in the html code at the names in

_________________
Beat 8)
www.joomlapolis.com <= Community Builder + CBSubs Joomla membership payment system - team
hosting.joomlapolis.com <= Joomla! Hosting, by the CB Team
Top
 Profile  
 
atrialis
PostPosted: Tue Aug 29, 2006 4:36 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice

Joined: Sun Aug 21, 2005 6:03 pm
Posts: 8
Location: Guadalajara, México
Hi,

RSGallery2 latest version 1.11.6 Alpha is also not compatible with RG_EMULATION = 0, but they are working in a security fix release.
Top
 Profile  
 
dayworks
PostPosted: Tue Aug 29, 2006 5:41 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice

Joined: Thu Aug 25, 2005 2:29 pm
Posts: 17
Location: Austin, TX
sanni wrote:
annemari wrote:
Sanni,

register globals depends on the host. It's possible to turn it off for whole server, or just for the virtual server.
Check from the admin panel  > system info. If it says Register Globals:  OFF, it's off.


Thanks. My accounts are on different servers with the same host and and on one the register globals are off and on another they are on. 


Sanni, you might try adding the following line toward the end of your .htaccess file to see if you can turn register_globals off locally for your sites.

Code:
php_flag register_globals off


This may or may not help, but if it does, then you will most likely be able to see the change reflected in both your Joomla! System Info and Php Info tabs in the Joomla! admin area. In the Php info tab, you will see a column for "Local Value" and a column for "Master Value". The Local value for registers_global should read "Off" while the Master value will still read "On".

_________________
I used to have a life. Now I have nameservers.


Last edited by dayworks on Tue Aug 29, 2006 5:59 pm, edited 1 time in total.

Top
 Profile  
 
dayworks
PostPosted: Tue Aug 29, 2006 5:46 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice

Joined: Thu Aug 25, 2005 2:29 pm
Posts: 17
Location: Austin, TX
mephistophele wrote:
Akobook doesn't work with RG_EMULATION at 0.... only to me?  :(


I confirm the same problem with the component. That's not a lot of help but at least you don't have to feel so lonely any more!  :laugh:

_________________
I used to have a life. Now I have nameservers.
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 4 of 14
  [ 418 posts ]  Go to page Previous  1, 2, 3, 4, 5, 6, 7 ... 14  Next


Board index » Joomla! Older Version Support » Joomla! 1.0 » Security - 1.0.x

Who is online

Users browsing this forum: No registered users and 5 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group