Components not working with Register Globals Emulation off

Discussion regarding Joomla! security issues.

Moderator: General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.
Locked
User avatar
tyler
Joomla! Intern
Joomla! Intern
Posts: 71
Joined: Thu Jan 26, 2006 11:36 pm
Location: Los Angeles, California, United States
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!!

Post by tyler » Sun Aug 27, 2006 7:43 am

okay, I just tested the latest round of changes (w/RG em Off) and the image & file uploads work fine.  So does the subscribe me option.

I did not test to see if something in excess of the configured filesize limits will still get through or not.  Was wondering 1st if it is even something that needs to be tested with respect to the other $_FILES vars in the component code.
-Tyler D.
Web Developer & Integrator: http://www.LasVegasExtremes.com

 
t-spark
Joomla! Fledgling
Joomla! Fledgling
Posts: 3
Joined: Wed Sep 14, 2005 12:22 pm
Location: Vilnius
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by t-spark » Sun Aug 27, 2006 7:51 am

On my Joomlaboard forum the function "Mark all forums read" doesn't work afer apllying all fixes above. Anyone could test it as well?
Last edited by t-spark on Sun Aug 27, 2006 7:52 am, edited 1 time in total.

JohnDubya
Joomla! Apprentice
Joomla! Apprentice
Posts: 33
Joined: Fri Jul 21, 2006 6:11 am

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!!

Post by JohnDubya » Sun Aug 27, 2006 9:22 pm

After turning register_globals off, I cannot use the Karma function for Joomlaboard 1.1.2.  It says this:
You came to this page in error. Please inform the administrator on which links you clicked that got you here.
She or he can then file a bug report.

Thank you!

Error number to include in your report: : SB001-karma-01NLO
Anyone else notice this problem?  How do I fix this?
Last edited by JohnDubya on Sun Aug 27, 2006 10:28 pm, edited 1 time in total.

kunglao
Joomla! Apprentice
Joomla! Apprentice
Posts: 8
Joined: Fri Aug 25, 2006 7:40 pm

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by kunglao » Mon Aug 28, 2006 2:06 am

Rob, Beat, thanks for the insights  :)  I appreciate it.

Tyler: from what I know, we don't need to check for the other 4 variables within XXX_upload.php because they're not where the problem is.  As Beat pointed out, the problem is really in the trigger within post.php, so this is just a patch for that trigger.  I think replacing 'name' with 'tmp_name' should also work.

t-spark: I can duplicate your problem :(

kunglao
Joomla! Apprentice
Joomla! Apprentice
Posts: 8
Joined: Fri Aug 25, 2006 7:40 pm

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by kunglao » Mon Aug 28, 2006 2:19 am

t-spark wrote: On my Joomlaboard forum the function "Mark all forums read" doesn't work afer apllying all fixes above. Anyone could test it as well?
This should fix it

Code: Select all

if (!isset($markaction) && isset($_POST["markaction"])) 	$markaction 	= mosGetParam ( $_POST, 'markaction'  , ''); 
Please confirm.

User avatar
tyler
Joomla! Intern
Joomla! Intern
Posts: 71
Joined: Thu Jan 26, 2006 11:36 pm
Location: Los Angeles, California, United States
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by tyler » Mon Aug 28, 2006 3:05 am

kunglao wrote: This should fix it

Code: Select all

code ... code
Please confirm.

hmmm, i tried it and it popped the javascript saying they were all marked as read, but when I get back to the forum, it still maintains that many of the posts I'm viewing are still new.
Last edited by tyler on Mon Aug 28, 2006 3:07 am, edited 1 time in total.
-Tyler D.
Web Developer & Integrator: http://www.LasVegasExtremes.com

kunglao
Joomla! Apprentice
Joomla! Apprentice
Posts: 8
Joined: Fri Aug 25, 2006 7:40 pm

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by kunglao » Mon Aug 28, 2006 4:58 am

Tyler: I can't reproduce your problem  !
It's working on different platforms for me ... don't know where the discrepancy is  ???

t-spark
Joomla! Fledgling
Joomla! Fledgling
Posts: 3
Joined: Wed Sep 14, 2005 12:22 pm
Location: Vilnius
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by t-spark » Mon Aug 28, 2006 5:59 am

kunglao wrote:
t-spark wrote: On my Joomlaboard forum the function "Mark all forums read" doesn't work afer apllying all fixes above. Anyone could test it as well?
This should fix it

Code: Select all

if (!isset($markaction) && isset($_POST["markaction"])) 	$markaction 	= mosGetParam ( $_POST, 'markaction'  , ''); 
Please confirm.

Thanks, it works fine for me!

User avatar
tyler
Joomla! Intern
Joomla! Intern
Posts: 71
Joined: Thu Jan 26, 2006 11:36 pm
Location: Los Angeles, California, United States
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by tyler » Mon Aug 28, 2006 7:14 am

kunglao wrote: don't know where the discrepancy is  ???
yeah, me either, I even tried changing it from POST to REQUEST and that didn't do the trick, even quadruple checked to make sure I wasn't mistakenly uploading to my test server either, so I'm still at a loss as far as my tests go.


UPDATE:
Just found out this is a personal problem I'm having.  Even w/RG on, I still experience the problems w/marking posts/forums as read.  I'll have to deal with this one on my own, but thanks for the fix, cuz it probably will resolve the RG issue for me when I do isolate this other problem I'm having.
Last edited by tyler on Mon Aug 28, 2006 7:24 am, edited 1 time in total.
-Tyler D.
Web Developer & Integrator: http://www.LasVegasExtremes.com

User avatar
crow
Joomla! Explorer
Joomla! Explorer
Posts: 304
Joined: Mon Aug 29, 2005 5:17 pm
Location: Austria
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by crow » Mon Aug 28, 2006 12:21 pm

One off component that dont work when register globals are 0 is

mospjirc

Hier is my post in components section..

http://forum.joomla.org/index.php/topic,89631.0.html

Hope someone can fix this somehow :))

I turned globals to 1 again, with CB 1.0.1
BosanskoHercegovacki Chat Komjuniti
http://www.chat.ba

User avatar
Beat
Joomla! Guru
Joomla! Guru
Posts: 840
Joined: Thu Aug 18, 2005 8:53 am
Location: Switzerland
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!!

Post by Beat » Mon Aug 28, 2006 1:38 pm

JohnDubya wrote: After turning register_globals off, I cannot use the Karma function for Joomlaboard 1.1.2.  It says this:
You came to this page in error. Please inform the administrator on which links you clicked that got you here.
She or he can then file a bug report.

Thank you!

Error number to include in your report: : SB001-karma-01NLO
Anyone else notice this problem?  How do I fix this?
This fixes that problem:

Code: Select all

if (isset($_GET["userid"])) $userid  = mosGetParam ( $_GET, 'userid' , '' );	//BBTEMPFIX
if (isset($_GET["pid"])) $pid  = mosGetParam ( $_GET, 'pid' , '' );	//BBTEMPFIX

kunglao wrote:
t-spark wrote: On my Joomlaboard forum the function "Mark all forums read" doesn't work afer apllying all fixes above. Anyone could test it as well?
This should fix it

Code: Select all

if (!isset($markaction) && isset($_POST["markaction"])) 	$markaction 	= mosGetParam ( $_POST, 'markaction'  , ''); 
Please confirm.

Thanks for the fix, works as expected. Added to my post overview post above:
http://forum.joomla.org/index.php/topic ... #msg441456
Beat 8)
www.joomlapolis.com <= Community Builder + CBSubs Joomla membership payment system - team
hosting.joomlapolis.com <= Joomla! Hosting, by the CB Team

User avatar
Websmurf
Joomla! Hero
Joomla! Hero
Posts: 2230
Joined: Fri Aug 19, 2005 2:23 pm
Location: The Netherlands
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!!

Post by Websmurf » Mon Aug 28, 2006 1:40 pm

crow wrote: One off component that dont work when register globals are 0 is

mospjirc

Hier is my post in components section..

http://forum.joomla.org/index.php/topic,89631.0.html

Hope someone can fix this somehow :))

I turned globals to 1 again, with CB 1.0.1
added it to the list :)
Adam van Dongen - Developer

- Blocklist, ODT Indexer, EasyFAQ, Easy Guestbook, Easy Gallery, YaNC & Redirect -
http://www.joomla-addons.org - http://www.bandhosting.nl

JohnDubya
Joomla! Apprentice
Joomla! Apprentice
Posts: 33
Joined: Fri Jul 21, 2006 6:11 am

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!!

Post by JohnDubya » Mon Aug 28, 2006 2:37 pm

Beat wrote: This fixes that problem:

Code: Select all

if (isset($_GET["userid"])) $userid  = mosGetParam ( $_GET, 'userid' , '' );	//BBTEMPFIX
if (isset($_GET["pid"])) $pid  = mosGetParam ( $_GET, 'pid' , '' );	//BBTEMPFIX

Please confirm.

Thanks for the fix, works as expected. Added to my post overview post above:
http://forum.joomla.org/index.php/topic ... #msg441456
The Karma function works now.  Thanks so much, Beat!  You rock!

User avatar
tyler
Joomla! Intern
Joomla! Intern
Posts: 71
Joined: Thu Jan 26, 2006 11:36 pm
Location: Los Angeles, California, United States
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!!

Post by tyler » Mon Aug 28, 2006 11:29 pm

JohnDubya wrote: The Karma function works now.  Thanks so much, Beat!  You rock!
Ditto for me, Karma now works with Beat's fix :)
-Tyler D.
Web Developer & Integrator: http://www.LasVegasExtremes.com

jonblazn
Joomla! Apprentice
Joomla! Apprentice
Posts: 43
Joined: Tue Aug 23, 2005 6:55 am

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by jonblazn » Tue Aug 29, 2006 6:50 am

Beat-
I'm sorry for bothering but I don't quite follow your fix for akocomment. Exactly what files should I be editing? Thanks in advance-

User avatar
Beat
Joomla! Guru
Joomla! Guru
Posts: 840
Joined: Thu Aug 18, 2005 8:53 am
Location: Switzerland
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by Beat » Tue Aug 29, 2006 7:33 am

jonblazn wrote: Beat-
I'm sorry for bothering but I don't quite follow your fix for akocomment. Exactly what files should I be editing? Thanks in advance-
Thanks for noticing that the edit instructions were a little short-cutted. Added filenames and clarified instructions. Please check my again my edited post:
http://forum.joomla.org/index.php/topic ... #msg450093
Beat 8)
www.joomlapolis.com <= Community Builder + CBSubs Joomla membership payment system - team
hosting.joomlapolis.com <= Joomla! Hosting, by the CB Team

n0fear2
Joomla! Apprentice
Joomla! Apprentice
Posts: 34
Joined: Tue May 23, 2006 3:33 pm

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!!

Post by n0fear2 » Tue Aug 29, 2006 9:09 am

Could anyone get any Coppermine Bridge to work with RG off and joomla 1.0.11? Everything works fine in 1.0.11 but when i turn RG Emulation to off i only get a blank page with the coppermine bridge =(

User avatar
novata
Joomla! Ace
Joomla! Ace
Posts: 1144
Joined: Thu Oct 20, 2005 2:50 pm

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by novata » Tue Aug 29, 2006 10:15 am

thanks Adam for start this thread and thanks to beat for the fixes. fixing joomla while sleeping  :laugh:
hats off!!  :o

sanni
Joomla! Apprentice
Joomla! Apprentice
Posts: 45
Joined: Fri Aug 26, 2005 9:56 pm

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!!

Post by sanni » Tue Aug 29, 2006 12:03 pm

I am getting the alert when I upgrade to 1.0.11 that

PHP register_globals setting is `ON` instead of `OFF`

In globals.php I have

define( 'RG_EMULATION', 0 );

What else needs to be changed? 

kunglao
Joomla! Apprentice
Joomla! Apprentice
Posts: 8
Joined: Fri Aug 25, 2006 7:40 pm

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by kunglao » Tue Aug 29, 2006 12:12 pm

sanni wrote: I am getting the alert when I upgrade to 1.0.11 that

PHP register_globals setting is `ON` instead of `OFF`

In globals.php I have

define( 'RG_EMULATION', 0 );

What else needs to be changed? 
I think you'll need to request your host to turn it off.

sanni
Joomla! Apprentice
Joomla! Apprentice
Posts: 45
Joined: Fri Aug 26, 2005 9:56 pm

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by sanni » Tue Aug 29, 2006 1:23 pm

kunglao wrote:
sanni wrote: I am getting the alert when I upgrade to 1.0.11 that

PHP register_globals setting is `ON` instead of `OFF`

In globals.php I have

define( 'RG_EMULATION', 0 );

What else needs to be changed? 
I think you'll need to request your host to turn it off.
So this alert is a warning that the host's system may not recognize when the register global is tuned off on individual sites.  Isn't this what the php.ini file was supposed to resolve if the host would not turn the global function off?  Nothing has really changed in the area other than there is now an alert. 

annemari
Joomla! Apprentice
Joomla! Apprentice
Posts: 27
Joined: Mon Jul 03, 2006 10:08 am

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by annemari » Tue Aug 29, 2006 2:02 pm

Sanni,

register globals depends on the host. It's possible to turn it off for whole server, or just for the virtual server.
Check from the admin panel  > system info. If it says Register Globals:  OFF, it's off.

sanni
Joomla! Apprentice
Joomla! Apprentice
Posts: 45
Joined: Fri Aug 26, 2005 9:56 pm

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by sanni » Tue Aug 29, 2006 2:12 pm

annemari wrote: Sanni,

register globals depends on the host. It's possible to turn it off for whole server, or just for the virtual server.
Check from the admin panel  > system info. If it says Register Globals:  OFF, it's off.
Thanks. My accounts are on different servers with the same host and and on one the register globals are off and on another they are on. 

penalty
Joomla! Apprentice
Joomla! Apprentice
Posts: 10
Joined: Tue Aug 29, 2006 2:18 pm
Location: Bulgaria
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by penalty » Tue Aug 29, 2006 2:22 pm

Hello, after  applying emulation 0, even though I applied all fixes to joomlaboard, threaded view stopped working. Can anybody post a fix for it?

User avatar
Beat
Joomla! Guru
Joomla! Guru
Posts: 840
Joined: Thu Aug 18, 2005 8:53 am
Location: Switzerland
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by Beat » Tue Aug 29, 2006 2:52 pm

penalty wrote: Hello, after  applying emulation 0, even though I applied all fixes to joomlaboard, threaded view stopped working. Can anybody post a fix for it?
Fix is as follows:

Code: Select all

if (isset($_GET["view"])) $view  = mosGetParam ( $_GET, 'view' , '' );	//BBTEMPFIX
updating my JoomlaBoard overview post:
http://forum.joomla.org/index.php/topic ... #msg441456
Beat 8)
www.joomlapolis.com <= Community Builder + CBSubs Joomla membership payment system - team
hosting.joomlapolis.com <= Joomla! Hosting, by the CB Team

User avatar
crow
Joomla! Explorer
Joomla! Explorer
Posts: 304
Joined: Mon Aug 29, 2005 5:17 pm
Location: Austria
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by crow » Tue Aug 29, 2006 3:57 pm

Beat: is there a way that you could look in mospjirc.2.1.2?. Normal pjirc java applet work just fine, so i think it just need to be edited the login page that generete this component...

Thnx
BosanskoHercegovacki Chat Komjuniti
http://www.chat.ba

User avatar
Beat
Joomla! Guru
Joomla! Guru
Posts: 840
Joined: Thu Aug 18, 2005 8:53 am
Location: Switzerland
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by Beat » Tue Aug 29, 2006 4:05 pm

crow wrote: Beat: is there a way that you could look in mospjirc.2.1.2?. Normal pjirc java applet work just fine, so i think it just need to be edited the login page that generete this component...

Thnx
Sorry, have to put priorities elsewhere right now, all of this should be task of the authors...

I'm sharing the results of the work done for JoomlaPolis and other websites, and giving fixes for the great testing done in the community.

I'm not using mospjirc anywhere...maybe the author or somebody else can pick that one...maybe even you...

it's not very hard: look at the urls used that don't work, and for posts in the html code at the names in <input fields, and do accordingly the mosGetParam at the begin of the corresponding file. Then publish work back here so others can make use of it and send you back results of their testings - a win-win :)
Beat 8)
www.joomlapolis.com <= Community Builder + CBSubs Joomla membership payment system - team
hosting.joomlapolis.com <= Joomla! Hosting, by the CB Team

User avatar
atrialis
Joomla! Apprentice
Joomla! Apprentice
Posts: 8
Joined: Sun Aug 21, 2005 6:03 pm
Location: Guadalajara, México

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by atrialis » Tue Aug 29, 2006 4:36 pm

Hi,

RSGallery2 latest version 1.11.6 Alpha is also not compatible with RG_EMULATION = 0, but they are working in a security fix release.

User avatar
dayworks
Joomla! Apprentice
Joomla! Apprentice
Posts: 17
Joined: Thu Aug 25, 2005 2:29 pm
Location: Austin, TX
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by dayworks » Tue Aug 29, 2006 5:41 pm

sanni wrote:
annemari wrote: Sanni,

register globals depends on the host. It's possible to turn it off for whole server, or just for the virtual server.
Check from the admin panel  > system info. If it says Register Globals:  OFF, it's off.
Thanks. My accounts are on different servers with the same host and and on one the register globals are off and on another they are on. 
Sanni, you might try adding the following line toward the end of your .htaccess file to see if you can turn register_globals off locally for your sites.

Code: Select all

php_flag register_globals off
This may or may not help, but if it does, then you will most likely be able to see the change reflected in both your Joomla! System Info and Php Info tabs in the Joomla! admin area. In the Php info tab, you will see a column for "Local Value" and a column for "Master Value". The Local value for registers_global should read "Off" while the Master value will still read "On".
Last edited by dayworks on Tue Aug 29, 2006 5:59 pm, edited 1 time in total.
I used to have a life. Now I have nameservers.

User avatar
dayworks
Joomla! Apprentice
Joomla! Apprentice
Posts: 17
Joined: Thu Aug 25, 2005 2:29 pm
Location: Austin, TX
Contact:

Re: !!! Don't forget to turn off register global emulation of Joomla as well !!!

Post by dayworks » Tue Aug 29, 2006 5:46 pm

mephistophele wrote: Akobook doesn't work with RG_EMULATION at 0.... only to me?  :(
I confirm the same problem with the component. That's not a lot of help but at least you don't have to feel so lonely any more!  :laugh:
I used to have a life. Now I have nameservers.

 

Locked

Return to “Security - 1.0.x”