272401
DonXoop
Re: EMERGENCY: security hole of Agenda-X

After a lot of log investigating and translation of the comments I can say I was not cracked.

Lots of attempts though. First line of defence was register_globals = Off. If a module won't work without it then it doesn't exist on my server.
Next I specificaly disallow certain files from being called in the URL. I don't depend on the module's security only.
I also use a php log so I can see any problems. Indeed this shows up there too.
Next is careful setting of permissions.
And careful set-up of Apache/PHp/MySQL.

All is well and agenda-x is still functional.

Now, you competting coders in Asia please stop fighting...



272402
dheltzel
Re: EMERGENCY: security hole of Agenda-X
  • 2004/2/14 15:50

  • dheltzel

  • Not too shy to talk

  • Posts: 164

  • Since: 2003/1/8 1


I have register_globals = Off, which is the only sane setting. So, I'm not worried about this, and don't think anyone else should be. Just check that register_globals is off and most of your security holes in PHP are closed.

This doesn't make you site invincible, but secure enough.

Dennis



272403
Kent
Re: Background image
  • 2004/2/14 15:23

  • Kent

  • Just popping in

  • Posts: 15

  • Since: 2002/4/19


Okay, going to write this real quick to show how to set the width and height for loading a specific graphic.

<script language="javascript1.2" type="text/javascript">
  <!--
    function 
getWindowSize() {
      var 
winW 784;
      var 
winH 632;

      if (
parseInt(navigator.appVersion) > 3) {
        if (
navigator.appName == "Netscape" || navigator.appName == "Opera") {
          
winW window.innerWidth;
          
winH window.innerHeight;
        }
        if (
navigator.appName.indexOf("Microsoft") != -1) {
          
winW document.body.offsetWidth;
          
winH document.body.offsetHeight;
        }
        
// Additional browser check here.
      
}
      return 
winW;
    }
    
// A change to the original setBackgrondImage()
    
function setBackgroundImage() {
      if (
getWindowSize() <= 600) {
        
document.body.style.background "images/background600.jpg";
      } 
// ... insert the rest here accordingly
    
}
  
//-->
</script>
< /
head>
body>
  <!-- 
your html page here //-->


Browsers not supporting CSS will still display the pages just fine without the background image. The only concern you should think about is finding the average color of the background image and use that as the background color (< body bgcolor="#xxxxxx"). That way you don't end up with white text on a white background for people who surf without loading images.

When it comes down to JavaScript, I like taking a much more object driven approach rather than putting the script into the html pages. Use the attribute "src=" to set where the external ".js" file is located. If you go about using the preload method than just change the lines to something similar to this:

document.body.style.background image600.src;


I haven't tested this script... but it should work without any problems.




272404
jmass
Help with array please
  • 2004/2/14 15:23

  • jmass

  • Friend of XOOPS

  • Posts: 524

  • Since: 2003/12/18


I need to make a list pulled from a MySQL table usable for options in a drop down box.

When I put the HTML in the class (I know it should not really be there) is pulls the data and formats is correctly. It then throws it at the top of my page, before the Smarty template kicks in.

When I try to pass the results to a Smarty variable and let the template handle the HTML, it generates "Array" on the HTML output.

I am sure that I am way off base in how I am trying to do this. This is my first module. Is there a good example of the proper way to do this?

Thanks,

JMass



272405
sum
Re: EMERGENCY: security hole of Agenda-X
  • 2004/2/14 15:15

  • sum

  • Just popping in

  • Posts: 10

  • Since: 2002/11/12


It is so. In the great factor in this matter a loose setting
of non-safe mode, the mistake is not found.
# And, I strongly felt that it was not possible to tell various attention
# of an environmental setting in the XOOPS.jp site.

However, it is suddenly posted that crack was done by using XOOPS in SF.jp
and it is submitted to slashdot.jp.
I was considerably surprised because there is no preliminary information, too.



272406
tmbutt
Re: Problem in Newbb and Newbbex
  • 2004/2/14 15:08

  • tmbutt

  • Just popping in

  • Posts: 5

  • Since: 2004/1/14


I did't ungarde but I tried to Install both but when I want to make new category or add new fourm, error comes
and in IE url palce it coing to creat new fourm with this addresshttp://modules/newbb/admin/admin_forums.php
but it have to behttp://mydomain/modules/newbb/admin/admin_forums.php



272407
Kent
Re: Background image
  • 2004/2/14 15:01

  • Kent

  • Just popping in

  • Posts: 15

  • Since: 2002/4/19


Instead of using the document.write() you should just change the element you want to work with. Here's how you can change it without breaking an html page for someone who's Javascript is turned off:

<script language="javascript1.2" type="text/javascript">
function 
setBackgroundImage() {
  if (
screen.height <= 600) {
    
document.body.style.background="images/background600.jpg";
  } else if (
screen.height 600 && screen.height 768) {
    
document.body.style.background="images/background768.jpg";
  } else {
    
document.body.style.background="images/background1024.jpg";
  }
}
</
script>


Note the compression in the JavaScript. Now you can use onLoad="setBackgroundImage()" in the body tag to call it. Doing this won't remove the body tag from the html. The only problem using this method is the image won't load with until the entire page has been loaded already; however, there is a workaround by using this method:

image600 = new Image();
image600.src "images/background600.jpg";


However, this also has a problem. Using the preloading of images will load other useless images wasting download time. A way around that would be to only use the onLoad functionality.

Now then...
- DO NOT USE the screen height.
- DO NOT MAXIMIZE the window for the screen.
- DO NOT USE popups unless it's from a link the user clicks on.
- DO NOT MOVE the window.

Taking control away from a user only pushes people away from your web site. I don't know how may sites try to do this to make their web site look "cool". Instead set the initial table width to 784 (default width of 800x600 display size with a maximized browser window with margin set at 5). Then, gather the current width of the window using window.innerWidth (or document.body.offsetWdith if you are using IE). Using the current width of the screen you can then safely set the table or div size. I would recommend using table over div as there are still some browsers out there which do not support span or div properly. I've been a web developer since before html became a standard.




272408
LilDevil
Re: Problem with Xoops Gallery
  • 2004/2/14 14:37

  • LilDevil

  • Just popping in

  • Posts: 11

  • Since: 2003/11/29


Thank you ever so much! And such a quick reply. I figured it was something like that but didn't know what files to give permissions too!



272409
SirTanksAlot
Re: Problem with Xoops Gallery

Make sure that the XoopsGallery\cache, XoopsGallery\cache\albums, and XoopsGallerycache\tmp are all writable by the webserver. This most likely means changing perms to 777 on all these folders and thier contents.



272410
LilDevil
Problem with Xoops Gallery
  • 2004/2/14 14:15

  • LilDevil

  • Just popping in

  • Posts: 11

  • Since: 2003/11/29


I am trying to add an album to my gallery and I am getting this error.
Error: Could not open lock file (/home/creativ/public_html/xoops/modules/xoopsgallery/cache/albums/album06/photos.dat.lock)!Error: Could not open lock file (/home/creativ/public_html/xoops/modules/xoopsgallery/cache/albums/album06/album.dat.lock)!Error: Could not open lock file (/home/creativ/public_html/xoops/modules/xoopsgallery/cache/albums/albumdb.dat.lock)!

I found an answer to this in the forums, but now I am not getting the error.. but I am also not getting a new album.
Now what?








Login

Who's Online

210 user(s) are online (92 user(s) are browsing Support Forums)


Members: 0


Guests: 210


more...

Donat-O-Meter

Stats
Goal: $100.00
Due Date: May 31
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $100.00
Make donations with PayPal!

Latest GitHub Commits