Joomla! Discussion Forums

Author: h4ntu
version: mospray_18RC1

idem..

Have a nice day
Gustavo

We have had a number of sites get hit since 7-12-06. We upgraded all sites to 1.0.10 on that date and we had another round on 7-16-06. So just upgrading to 1.0.10 doesnt fix everything. You have to go back and check your sites and look for a file named shell.php in the root of your site. If you are running multiple sites, check ALL of them. If it is on one site on a server, they have full access to the entire server and it doesnt matter what version of Joomla you are using at that point. Once you have found and removed the shell.php file, make sure all sites on the server are upgraded to 1.0.10. If you are using a shared server, you can still be vulnerable if someone else has the file on their portion of the server.

We are working on finding all the details and will let you know more as we find them.

Hope this helps.

I couldn't find any contact information or website for this component either.  Do any of you guys have contact information for this components developers?

Thanks

The file is here:

http://mamboxchange.com/projects/mospray/

The developer is here:

http://www.caneblu.com

I didn't see the component listed on his site, my guess is that this is abandoned.

Hi i'm Walter, creator of Mospray.
Actually Mospray (mambo + flyspray) is not longer supported because i'm (re)writing a Jospray, but is far to complete.
So, can i have more details about this Remote Inclusion, i'll try to fix-it

Regards
Walter Tosolini

Firstly, check to make sure that your components files check that they are not being accessed directly.  They should have a line like:

This is what has caused many of the recent vulnerabilities.  Additionally, you should not use the $GLOBALS array as this often facilitates turning bugs into major vulnerabilities.  That would be a good start, then I suggest you have a look at the Developers Forum found here: http://forum.joomla.org/index.php/board,126.0.html  There is some good information there on how to write more secure code.

thx,
so this component is not for Joomla, i think the installer is not working into J, db tables_prefix are not like #__ but older mos_ (so the component dont work if you dont make change into the code)
I strongly recommed do not install this component in Joomla.
I'm working (but i havent much time now) to new component with code complety rewrite and not adapted like this one.

I have been using mospray in Joomla for quite a while now and really like it. I had to make the necessary changes to the code to port it from mambo but it works fine 

With regard to the security issues outlined about am i correct that the fix would be to
a) add "defined( '_VALID_MOS' ) or die( 'Restricted access' );" to all php scripts where it is missing
b) in newtask.php
    i) insert "global $mosConfig_absolute_path;" at the top of the script
    ii) replace
        require_once( $GLOBALS['mosConfig_absolute_path'] . '/includes/HTML_toolbar.php' );
      with
      require_once( $mosConfig_absolute_path . '/includes/HTML_toolbar.php' );

Walter :- can you give any indication of a release date for Jospray?

Anyone :- is there a Joomla alternative which give similar functionality? The others listed in extensions dont seem to give the same flexibility that i like in mospray

Thanks
Dave

No idea when ready...
i'm starting at begin of year to adapt flyspray into joomla, but the final work was not good at all... so i recently re-start from zero, only table of database are similar to flyspray, my intention is make a php script fully "joomled".

Did you try Flyspray ME ?

Krishan

No i havent - it is for M@mbo and i am using Joomla

Well, the component just has the old name but works very well in Joomlal (my own page works with Joomla 1.0.11 and Flyspray ME 1.0.2 - without any problem).

well spotted, i took this out of my site a while back anyways.