Get XOOPS XOOPS FAQ Forums News Themes Modules
News World of XOOPS Developers Hacks Modules Themes Archive Submit News

XOOPS vs. Herko Coomans

Make a donation

Please select an amount to donate


Do you want your username revealed with your donation?
Yes - List me as a Generous Donor
No - List my donation as from an Anonymous Donor


Search

Local Support Sites

Cumulus Tag Cloud

admin Arabic banner block Christmas comments cumulus DayDawn dhsoft e-Commerce E-Learning Google GUI hacks instant-zero jQuery module news Nordic Olédrion oxygen PageRank security SEO simple-XOOPS sport tag Theme wiki xoops

New Users

Registering user

# 96568

dvsshoescom

Welcome to XOOPS!

Archives

XOOPS Code hosted on SourceForge

XOOPS 2.0.9.3 Patch Released

Posted by Mithrandir on 2005/3/23 14:15:40 (6341 reads) | Posted on XOOPS
The XOOPS Core development team is pleased to announce that a patch addressing the vulnerability in the XoopsMediaUploader class has been released and is available in our Downloads Section

It contains three files:
/class/uploader.php - the new XoopsMediaUploader class, replacing the existing
/class/mimetypes.inc.php - a new file containing mimetypes and their extensions
/include/version.php - updates the version to 2.0.9.3

Upgrade Instructions: Upload the files to their respective folders, overwriting existing files.

Special thanks goes out to Pokleyzz for reporting this bug on sourceforge.net, to the Japanese community for reporting it a long time ago and to phppp for helping Skalpa addressing it. Also thank you to everyone testing this patch prior to its release.

Xoops 2.0.9.2 to 2.0.9.3 Patch (zip)
Xoops 2.0.9.2 to 2.0.9.3 Patch (tar.gz)

Mithrandir
Xoops Core Developer


Printer Friendly Page Send this Story to a Friend Create a PDF from the article


Bookmark this article at these sites

                   

The comments are owned by the poster. We aren't responsible for their content.

Will the module Articles work on this version ?
Posted: 2005/3/23 14:19 • Updated: 2005/3/23 14:19
Can you upload files through the Articles module?
Posted: 2005/3/23 14:24 • Updated: 2005/3/23 14:24
Many modules had problems with version 2.0.9.2 Open in new window
Posted: 2005/3/23 14:27 • Updated: 2005/3/23 14:27
It works fine for me!

Thanks again for being fast in finding a solution for all security issues reported!
Posted: 2005/3/23 14:30 • Updated: 2005/3/23 14:37
Well done!

And I must also give a pat on the back to the dev team. Not for fixing it, which should have happened in the first place so I see no reason to give credit there, but for going public and getting the word out so quickly about the issue.

That, at least for me, as appreciated more so then anything else on this topic.

Keep up the good work.
Posted: 2005/3/23 15:22 • Updated: 2005/3/23 15:22
I cannot agree with you Rhomal as this is not a paid software so I think there is a good reason for saying thanks for fixing the errors fast. They could simply say , damn it we are going to take a look at this in a year and come back then.

Sorry for the bad english and please understand that I am not trying to get into a discussion just to defend my opinion...
Posted: 2005/3/23 15:32 • Updated: 2005/3/23 15:32
Thank u all for this patch!
Great work
Posted: 2005/3/23 16:46 • Updated: 2005/3/23 16:46
Thanks for the patch. We've been patiently waiting and appreciate the dev teams work


(just a note, the top right block needs updateing, I've created xoops-2.0.9.3.zip and xoops-2.0.9.3.tar.bz2 for your convenience)
Posted: 2005/3/23 16:49 • Updated: 2005/3/23 16:49
Good job, all! New scripts seem to be working fine.
Posted: 2005/3/23 17:13 • Updated: 2005/3/23 17:13
Greetings - Thank you for the patch.
Regards,
Roberto Artigas
Posted: 2005/3/23 17:13 • Updated: 2005/3/23 17:13
Seems to work for me. Thanks again.

as for:
Quote:
And I must also give a pat on the back to the dev team. Not for fixing it, which should have happened in the first place so I see no reason to give credit there, but for going public and getting the word out so quickly about the issue.

just ignore that one... The drama never stops somedays.
Posted: 2005/3/23 17:17 • Updated: 2005/3/23 17:17
Your fixing something you put out that was 'broke' in the first place. While I, and I am sure everyone else appreciates it, I dont see why I should heap praise for something you, at the very least, are morally obligated, to correct.

But you didnt have to go public, nor do it in such a efficient way. And I think that deserves praise.

If you dont feel you have a responsibility to fix code that you release, that your doing us a favor by doing so, then we shall agree to disagee.
Posted: 2005/3/23 18:47 • Updated: 2005/3/23 18:47
As I said I hope you don t take it for a discussion that is not what i mean. The only thing I said was they had no obligation to have such a commitment with us and do that fast as we download it because we want...

If you want to talk about this pm me I ll give oyu my messenger.
Posted: 2005/3/23 19:10 • Updated: 2005/3/23 19:10
Rhomal, don't worry. I'll never do any favors for you.
Posted: 2005/3/23 20:27 • Updated: 2005/3/23 20:27
I for one appriciate any and all bug fixes. I even get a kick out of the drama queens that have less of a life than I do. Thanks, I needed a good ROFL moment.

"Let's not and say we did"
Posted: 2005/3/23 21:21 • Updated: 2005/3/23 21:21
Nice done,

Thanx for this patch!
Posted: 2005/3/23 21:28 • Updated: 2005/3/23 21:28
If drama queen = I don't kiss the arse of the dev team from here to high heaven every chance I get then I suppose I am one by your account.

I give appreciataion where it is due and for above and beyond work ethic. Not for something that should be done in the first place and part of ones standard responsibility.

I am sorry if some of you cant grasp such a simplistic concept.

*shrugs*
Posted: 2005/3/23 21:47 • Updated: 2005/3/23 21:47
>Rhomal, don't worry. I'll never do any favors for you.

ditto
Posted: 2005/3/23 21:48 • Updated: 2005/3/23 21:48
OK Rhomal I understand your point and i think the devellopers will be happy to not have their arses kissed , but I still maintain my thanks (without the kisses in the arses :D )
Posted: 2005/3/23 21:54 • Updated: 2005/3/23 21:55
everyone is entitled to an opinion, even those who do not kiss ass or express what seems to be, in view of some opinions an inappropriate or unpopular response. why can't we just leave it at that?
Posted: 2005/3/23 23:47 • Updated: 2005/3/23 23:48
I don't think it is that straight cut. It is a matter of cause and effect. If you display an opinion (even if you are entitled to it) that is against that of the majority and some people take offence to it, then it is unavoidable there will be some retort. Not saying it is right or wrong, just saying it is going to happen, same as if you kick a dog it is going to bite you.

Back on topic....

Thanks to the Dev team for putting in your spare time to making Xoops a better product for all .
Posted: 2005/3/24 0:24 • Updated: 2005/3/24 0:24
Two great FREE additions to the community (AMS 2.41 & 2.0.9.3 patch) and one member still has cause to gripe. Why must these conversations turn so negative.

If you have nothing nice to say then...


P.S.
Thanks to the developers for their work and time.
Posted: 2005/3/24 1:26 • Updated: 2005/3/24 1:26
Thanks Dev team for your hard work

Rhomal how much did you pay for service

I appreciate all work contributed here and like the honesty of letting us know a bug/security issue asap and then going hard out to get a patch sorted, 10 points for service.

I might just wander over to the donation sectiion......
Gecko
Posted: 2005/3/24 1:34 • Updated: 2005/3/24 1:34
Thanks for this security patch.
Works fine for me.
Posted: 2005/3/24 3:02 • Updated: 2005/3/24 3:02
Hi,

Thank you for the update.

Just one question, why can't we find a complete new version instead of "just" a patch ? I'm not sure that new users will have the reflex to download the 2.0.9.2 and after this, the patch.

Bye,
Hervé
Posted: 2005/3/24 5:03 • Updated: 2005/3/24 5:03
@hervet: Because there will be a 2.0.10 beta release soon, and because it is only 3 files.

Herko
Posted: 2005/3/24 5:21 • Updated: 2005/3/24 5:21
Then, since this is a security update, the information of the update should be entered into the 2.0.9.2 readme so that new users that do not see this news article know of the update.

Most new users will download the latest stable release, not the beta.

And....thanks for the quick work on this matter.
Posted: 2005/3/24 5:48 • Updated: 2005/3/24 5:50
@jdseymour: Good point. Will do so today.

Herko
Posted: 2005/3/24 6:27 • Updated: 2005/3/24 6:27
Thanks for addressing this issue and providing a fix. However, I confess I have to agree with Herve's comment. For the benefit of new users I don't understand why updated files cannot be added to the current stable download, or alternatively a new incremental version created. It must be simple to do compared to the hard work you've put into fixing the problem.

You can bet that many people will download 2.0.9.2 today and not apply this patch. Personally, I think if you've already fixed the problem, they shouldn't really have to.
Posted: 2005/3/24 7:13 • Updated: 2005/3/24 7:13
Quote:
Because there will be a 2.0.10 beta release soon, and because it is only 3 files.
Herko


1 file, 2 files, 20 files.........this shouldn't matter. It is an upgrade to a newer xoops version: 2.0.9.3 And this is the actuall stable version instead of 2.0.9.2

I also think there should be a compleet xoops version 2.0.9.3 download available. Otherwise the version numbering is getting confusing. Not to think of all the question of newbies who download 2.0.9.2 and read they should download a seperate patch to secure the core.....
- Where can I find this patch?
- How do I apply this patch?
- I downloaded version 2.0.9.2, do I need to download this patch or is it within this zipfile?


And euhm,...thanks for this quick patch

Grtz., Shine
Posted: 2005/3/24 8:20 • Updated: 2005/3/24 8:20
> OK Rhomal I understand your point and i think the devellopers will be happy to not have their arses kissed , but I still maintain my thanks (without the kisses in the arses :D )

First and foremost I appreciate your tactful words, more then some here are able to do.

I also am glad my very simple standards for praise wasnt beyond your ability to understand. I really didnt think it was all that complex.

But I do take issue with "i think the devellopers will be happy to not have their arses kissed ". I feel thats exactly the problem they have with someone like me. They are so used to getting a pat on the back and thread upon thread of 'your so great thank you!' for every little thing. So when someone acually holds them accountable and put some level of standards upon them they dont react well, as shown here.

Sense of entitlement? Perhaps. I really dont know any of them personally so cant say. I can only go by their reactions here. But certainly they dont take it well when someone does not blindly shower them in rose pedals for something that, IMO, they had a responsibility to do none the less.

My 2 coppers
Posted: 2005/3/24 12:40 • Updated: 2005/3/24 12:40
Very tiring. Zero value to the discussion.

The one and only thing I can agree with you on.::Quote:
I can only go by their reactions here

And your reactions here tell me that there is zero chance of anything constructive. Pats and kudos are one thing, helpful conversation regarding problems is another, and your comments are a third and valueless thing.

Please don't reply to this, I don't hear you.

Posted: 2005/3/24 13:00 • Updated: 2005/3/24 13:10
Well, I don't know if this arse kissing, but I do feel like giving the developers a pat on the back and telling them "your so great thank you for every little thing." I could not be doing the work I am doing without them and all that at an unbelievable price - FREE!

As a non-developer to the developers I do say "thanks for every little thing you do!"

mpowell
Posted: 2005/3/24 13:31 • Updated: 2005/3/24 13:31
Hmmm.... I have got a problem with this upgrade.

I just copied the three files to their respective locations.

When I try to uploed a normal jpg-file I get this message:

Could not get uploaded file %s

regards/falke
Posted: 2005/3/24 14:34 • Updated: 2005/3/24 14:34
Anybody else got this problem with the new image uploader?
regrads/falke
Posted: 2005/3/25 7:20 • Updated: 2005/3/25 7:20
Falke, how are you uploading? Through image manager? Through administration->images or through custom avatar upload?
Posted: 2005/3/25 7:48 • Updated: 2005/3/25 7:48
I have a small request. Can fellow Xoopsters please not add-to or change the title of a thread when they post a comment. Falke's title change is only minor, (appreciated) but this appears as a different issue in the recent comments block. Thx.
Posted: 2005/3/25 8:32 • Updated: 2005/3/25 8:32
I don t know why but now I am having this message when i try to load a new avatar, send an image to the forun in a attachment or using my imagemanager:

Errors Returned While Uploading
Error loading mimetypes definition

When i have downgraded the uploader.php file it works again.

Any idea of what this can be?
Posted: 2005/3/25 17:55 • Updated: 2005/3/25 19:26
i'm getting the same error message as well

"Could not get uploaded file 0"

i've checked through all my site preferences and everything seems alright. are there any file permissions that need to be changed? what else should i check to make sure that everything is set up alright? thanks!

-zimmi88 =)

p.s.: thank you thank you thank you for all that you do! i've found xoops to be a great management system and would proudly recommend it to any friend that would need a management system for their site.
Posted: 2005/3/26 2:00 • Updated: 2005/3/26 2:00
make sure you have copied the mimetypes.inc.php file to the class folder..

or re upload the file as it might have been corrupted during transfer.. & make sure it's chmod 644
Posted: 2005/3/26 4:46 • Updated: 2005/3/26 4:46
I did look at it and everything was ok , the problem seems to be in the uploader file as i have downgraded only this and now everythingworks fine again (but probably with the security issues :( )
Posted: 2005/3/26 5:15 • Updated: 2005/3/26 5:15
The "could not get file" error is usually when something is gone wrong in the physical upload of the file. I'll see what I can do to add more descriptive error messages here.

The "could not load mimetypes" error is when the mimetypes.inc.php file could not be loaded. Any php debug errors?
Posted: 2005/3/26 5:36 • Updated: 2005/3/26 5:36
ohhh I uploaded again the file mimetypes.inc.php and uploader from the new upgrade the 2.9.0.10 and now it works I am ashamed! Thanks again for your attention.
Posted: 2005/3/26 12:06 • Updated: 2005/3/26 12:06
Don't be ashamed. I've just solved the problem. File mimetypes.inc.php is in MAC format. Convert it to DOS or UNIX format or upload it as binary.
Posted: 2005/3/26 12:20 • Updated: 2005/3/26 12:20
Mithrandir, I use the Image uploader.

If the problem is that the file mimetypes.inc.php is in Mac formart, how do I convert it to Unix/Linux format?

regards/falke
Posted: 2005/3/28 5:12 • Updated: 2005/3/28 5:12
as I said, the "could not get uploaded file" suggests that there is something going wrong in the upload itself, not the mimetype checking.

I'm adding some more error-reporting code to the uploading processes in next release, so we can figure out what is going wrong.
Posted: 2005/3/28 5:29 • Updated: 2005/3/28 5:29
I turned on PHP debugger:

First I select Image categorie and the in the new window in the Image uploader I can read the following line at the bottom:

Notice [PHP]: Undefined variable: target in file imagemanager.php line 176

This happens directly the second window opens after I selected Add image file

regards/falke
Posted: 2005/3/28 6:23 • Updated: 2005/3/28 6:27
@Mithrandir. Do you write Xoops core files and patches with a Unix text editor, a Mac or a PC?
Posted: 2005/3/28 6:47 • Updated: 2005/3/28 6:47
Could you add:

$err 
.= '<br />'.implode('<br />'$uploader->getErrors(false));



right after

$err 
_FAILFETCHIMG;


around line 240 (+/-) and try again?
Posted: 2005/3/28 6:48 • Updated: 2005/3/28 6:48
Quote:
@Mithrandir. Do you write Xoops core files and patches with a Unix text editor, a Mac or a PC?

I write on Windows, but copy the files to my linux machine for compressing the .tar.gz archives and uploading them from there.

The mimetypes.inc.php file was made by Skalpa and it is possible that he is working on a Mac, I'm not sure. My knowledge about OS file formats is very limited, I'm afraid.
Posted: 2005/3/28 6:50 • Updated: 2005/3/28 6:50
OK, done that, Jan. This is what I got:

Kunde inte hämta den uppladdade filen %s
Error loading mimetypes definition


The first line is in Swedish because of the Multilanguage module from Marcan.... but I think you can understand that, Jan?

regards/falke
Posted: 2005/3/28 6:59 • Updated: 2005/3/28 6:59
Hmmm... does seem to be the mimetypes.inc.php file that is not loaded correctly.

Could the people, who experienced this and fixed it tell exactly how they did it? You say convert from Mac format to UNIX or something like that? How is that done?
Posted: 2005/3/28 7:00 • Updated: 2005/3/28 7:00
Well I just uploaded the mimetypes.inc.php from the 2.0.10 distribution and now everything seems to work fine.... even in IE where I hade problems before.

So maybe you should switch this file in the patch distribution?

regards/falke
Posted: 2005/3/28 7:08 • Updated: 2005/3/28 7:10
The line break convensions differ between Unix, Macs and PC text editors. I just wondered if mixing the types might cause a corruption during FTP transfer if the FTP software doesn't deal with it properly?. It's just a guess. Maybe irrelevant in this case. but I had problems decompressing Xoops and uploading it from a Mac last year. I'll see if I can find out more.
Posted: 2005/3/28 7:13 • Updated: 2005/3/28 7:13
... which might explain why falke could upload the one file on it's own successfully, but not so along with the others?
Posted: 2005/3/28 7:20 • Updated: 2005/3/28 7:20
Perhaps uploaded as non-binary when in a group of files, but auto-detected as binary when uploaded as single file?

It's just weird since there were only 3 files altogether...

Anyway if there are no problems with the 2.0.10 version of the file, the problem will be corrected with the final release of 2.0.10
Posted: 2005/3/28 7:38 • Updated: 2005/3/28 7:38
Sounds the most likely reason. I suspect it will simply depend on what FTP software you use, so some people may have no problems at all. If it's of any use to you, I posted some links regarding the Unix/PC line break issue in this post
Posted: 2005/3/28 8:03 • Updated: 2005/3/28 8:04
I am absolutely sure that it has nothing to do with the FTP software. Not for me anyway.... ;o)
I have been using a paid version of 3D FTP for years now and it has always worked correctly with a mixture of files.

However I opened the mimetypes.inc.php (locally on my harddrive not on the Linux server) supplied with the 2.0.9.3 patch in GVIM and compared it to the one in the 2.0.10 beta and there is definitely a difference in LF/CR as someone said in this thread. But as Jan said it will all work in 2.0.10... but maybe the file in the patch should be changed.

regards/falke
Posted: 2005/3/28 9:26 • Updated: 2005/3/28 9:28
@falke. Sorry, I mis-read your post. Thought you had uploaded the same file a second time on it's own. I see now it was a different one from the later distro.

@mithandrir. I downloaded the 2.0.9.3 patch (Zip) and the black blocks visible in mimetypes_inc.php when viewed using notepad on the PC would indicate that (at some time) the file was either uploaded from the Mac, or downloaded to a PC using FTP in binary mode.

Actually, if you decompress the TAR.GZ version instead using Winzip (with Options / Configuration / TAR File Smart CR/LF conversion 'on', which it is by default) Winzip sorts it out.

It is a problem though. A file with rogue CR/LF characters will upload properly... it just won't work!
Posted: 2005/3/28 12:09 • Updated: 2005/3/28 12:09
To clarify (with a slightly modified version of a very nice explanation I found on the forum at totalchoicehosting.com):
Quote:

Uploading a file in ASCII tells the FTP server to convert the line endings from the format the operating system on your computer uses to the format that the operating system on the server uses.

Window systems use a two character LF / CR (line feed + carriage return) line ending.

Mac systems use a one character CR line ending character.

Linux systems use a one character LF line ending character.

If you upload a text file from your Windows PC to a Linux server, all of the LF / CR character combinations in the Windows text file will be automatically converted to LF characters when the file is saved on the server, so the server will be able to read the lines in it correctly. (The reverse happens if you download a text file in ASCII mode from the Unix server to your Windows PC.)

This can be crucial for some types of text files, because if they have the wrong type of line ending, the server won't be able to read them properly. A multi-line script may be seen as one long line, because the server doesn't see proper line ending on each line.

Uploading a file in BINARY tells the FTP server NOT to convert any characters at all, to just store the file as it was uploaded. You want this for files such as .zip or .tar.gz compressed archives (altering bytes within them will corrupt them), and graphic file formats (altering bytes within them will change your image and possibly render it unviewable).

Since PHP files are generally text scripts, they should be uploaded and downloaded in ASCII mode so the line ending characters are converted to the correct format.

Posted: 2005/3/28 15:15 • Updated: 2005/3/28 15:15
My experience has been that the line terminators don't matter for PHP scripts, if PHP is run as an Apache module. I've only tested Windows (CR-LF) and Linux (LF) line terminators, so I'm not sure whether this applies to Mac (CR) files as well.

If PHP is run as CGI, rather than as an Apache module, then the #! line at the beginning may not get read properly, if that line doesn't have the right line terminator for the host platform.
Posted: 2005/3/28 18:02 • Updated: 2005/3/28 18:02
I am pretty certain it's uploading the file from a Mac to a Unix/Linux server in binary mode in the first place that causes the problem.

Try unzipping the problem file from the Zip version of the patch and you'll see it's full of black blocks, which are the un-decoded linefeed characters. I don't think it matters whether they are DOS, Mac or Unix linefeeds, they remain un-decoded. So even if you then correctly use ascii mode to upload to your Unix/Linux server, the FTP software will not see these chars as linefeeds, so it will not convert them to Unix format. It will just upload a file full of black block chars - which will stop it working.

The only software that does see them as 'foreign' linefeeds is Winzip, and then only if you decompress the TAR archive using it's 'TAR file, smart CR/LF option.

I think...
Posted: 2005/3/28 19:06 • Updated: 2005/3/28 19:06
i think winRAR does too.

although i've never had this problem and my ftp software is set so it uploads/downloads .php extensions in binary mode. i did the same with the 2.0.9.3 patch and had no problems.
Posted: 2005/3/28 22:47 • Updated: 2005/3/28 22:47
Hi m0nty. Did you decompress and upload from the Zip? The problem file in there was definitely full of rogue CR chars when I un-zipped it. I'm using winzip 6.3. Maybe later versions do the same to zip archives as they do to TAR and correct LF/CR issues? Maybe your server just doesn't care about them? Maybe I'm just imagining it!
Posted: 2005/3/29 9:07 • Updated: 2005/3/29 9:07
hi peekay, yes i decompressed the zip file on my pc using winRAR though not winzip, then uploaded all files in binary mode. i've always done it that way though and it made no difference what server i uploaded to, so i don't think that's an issue.. it could be the version of winzip that you use like you say, as i haven't used winzip in years.. i find winRAR a lot better at it's job than winzip.. hope you narrow the problem down though :)
Posted: 2005/3/29 13:21 • Updated: 2005/3/29 13:21
Thx. So, as far as automatically correcting CR/LF issues on decompression, using my version of winzip anyway, it appears that:

winzip + TAR =
winrar + ZIP =
winzip + ZIP =

... or, it was nothing to do with this in the first place!
Posted: 2005/3/29 14:31 • Updated: 2005/3/29 14:31