From dhaun at qs1489.pair.com Mon Sep 1 05:21:13 2008 From: dhaun at qs1489.pair.com (Dirk Haun) Date: Mon, 01 Sep 2008 09:21:13 +0000 Subject: [geeklog-cvs] Geeklog-1.x/public_html lib-common.php,1.725,1.726 Message-ID: <20080901092113.CBF66F740E@qs1489.pair.com> Update of /cvsroot/geeklog/Geeklog-1.x/public_html In directory qs1489.pair.com:/tmp/cvs-serv44667/public_html Modified Files: lib-common.php Log Message: Cosmetics - some language files have an extra blank here, some don't Index: lib-common.php =================================================================== RCS file: /cvsroot/geeklog/Geeklog-1.x/public_html/lib-common.php,v retrieving revision 1.725 retrieving revision 1.726 diff -C2 -d -r1.725 -r1.726 *** lib-common.php 17 Aug 2008 14:16:02 -0000 1.725 --- lib-common.php 1 Sep 2008 09:21:04 -0000 1.726 *************** *** 1069,1073 **** $header->set_var( 'rss_url', $rdf ); ! $msg = $LANG01[67] . ' ' . $_CONF['site_name']; if( !empty( $_USER['username'] )) --- 1069,1073 ---- $header->set_var( 'rss_url', $rdf ); ! $msg = rtrim($LANG01[67]) . ' ' . $_CONF['site_name']; if( !empty( $_USER['username'] )) From dhaun at qs1489.pair.com Tue Sep 2 15:02:49 2008 From: dhaun at qs1489.pair.com (Dirk Haun) Date: Tue, 02 Sep 2008 19:02:49 +0000 Subject: [geeklog-cvs] Geeklog-1.x/public_html/docs history,1.717,1.718 Message-ID: <20080902190249.6B9BFF740E@qs1489.pair.com> Update of /cvsroot/geeklog/Geeklog-1.x/public_html/docs In directory qs1489.pair.com:/tmp/cvs-serv85011/public_html/docs Modified Files: history Log Message: Prevent direct execution of the FCKeditor upload script (reported by t0pP8uZz) Index: history =================================================================== RCS file: /cvsroot/geeklog/Geeklog-1.x/public_html/docs/history,v retrieving revision 1.717 retrieving revision 1.718 diff -C2 -d -r1.717 -r1.718 *** history 31 Aug 2008 19:17:39 -0000 1.717 --- history 2 Sep 2008 19:02:46 -0000 1.718 *************** *** 4,7 **** --- 4,8 ---- ------------ + - Prevent direct execution of the FCKeditor upload script (reported by t0pP8uZz) [Dirk] - Renamed the "Restore" option in the Configuration to "Enable" [Dirk] - Provided better error handling for database backups (bug 0000714) [Mike] From dhaun at qs1489.pair.com Tue Sep 2 15:02:49 2008 From: dhaun at qs1489.pair.com (Dirk Haun) Date: Tue, 02 Sep 2008 19:02:49 +0000 Subject: [geeklog-cvs] Geeklog-1.x/public_html/fckeditor/editor/filemanager/connectors/php upload.php, 1.2, 1.3 Message-ID: <20080902190249.66F19F740F@qs1489.pair.com> Update of /cvsroot/geeklog/Geeklog-1.x/public_html/fckeditor/editor/filemanager/connectors/php In directory qs1489.pair.com:/tmp/cvs-serv85011/public_html/fckeditor/editor/filemanager/connectors/php Modified Files: upload.php Log Message: Prevent direct execution of the FCKeditor upload script (reported by t0pP8uZz) Index: upload.php =================================================================== RCS file: /cvsroot/geeklog/Geeklog-1.x/public_html/fckeditor/editor/filemanager/connectors/php/upload.php,v retrieving revision 1.2 retrieving revision 1.3 diff -C2 -d -r1.2 -r1.3 *** upload.php 5 May 2008 00:35:25 -0000 1.2 --- upload.php 2 Sep 2008 19:02:46 -0000 1.3 *************** *** 23,26 **** --- 23,30 ---- */ + if (strpos($_SERVER['PHP_SELF'], 'upload.php') !== false) { + die('This file can not be used on its own!'); + } + require('./config.php') ; require('./util.php') ; From mjervis at qs1489.pair.com Tue Sep 2 15:08:58 2008 From: mjervis at qs1489.pair.com (Michael Jervis) Date: Tue, 02 Sep 2008 19:08:58 +0000 Subject: [geeklog-cvs] Geeklog-1.x/public_html/docs history,1.718,1.719 Message-ID: <20080902190858.EE10DF740E@qs1489.pair.com> Update of /cvsroot/geeklog/Geeklog-1.x/public_html/docs In directory qs1489.pair.com:/tmp/cvs-serv85721/public_html/docs Modified Files: history Log Message: Hide passwords with rootdebug on [1]. (Bug 0000722) [1] - What part of rootdebug was hard to understand? Index: history =================================================================== RCS file: /cvsroot/geeklog/Geeklog-1.x/public_html/docs/history,v retrieving revision 1.718 retrieving revision 1.719 diff -C2 -d -r1.718 -r1.719 *** history 2 Sep 2008 19:02:46 -0000 1.718 --- history 2 Sep 2008 19:08:55 -0000 1.719 *************** *** 4,10 **** ------------ - Prevent direct execution of the FCKeditor upload script (reported by t0pP8uZz) [Dirk] - Renamed the "Restore" option in the Configuration to "Enable" [Dirk] ! - Provided better error handling for database backups (bug 0000714) [Mike] - Provided auto-detection of -left and -right overrides for any given block template. This allows any block to auto-style to left and right for themes --- 4,13 ---- ------------ + - If root debugging is enabled, hide anything in the array stack that has a key + containing 'cookie' or 'pass'. And added option to override this. + (bug #0000722) [Mike] - Prevent direct execution of the FCKeditor upload script (reported by t0pP8uZz) [Dirk] - Renamed the "Restore" option in the Configuration to "Enable" [Dirk] ! - Provided better error handling for database backups (bug #0000714) [Mike] - Provided auto-detection of -left and -right overrides for any given block template. This allows any block to auto-style to left and right for themes From mjervis at qs1489.pair.com Tue Sep 2 15:08:58 2008 From: mjervis at qs1489.pair.com (Michael Jervis) Date: Tue, 02 Sep 2008 19:08:58 +0000 Subject: [geeklog-cvs] Geeklog-1.x/public_html lib-common.php, 1.726, 1.727 siteconfig.php.dist, 1.17, 1.18 Message-ID: <20080902190858.090E3F7410@qs1489.pair.com> Update of /cvsroot/geeklog/Geeklog-1.x/public_html In directory qs1489.pair.com:/tmp/cvs-serv85721/public_html Modified Files: lib-common.php siteconfig.php.dist Log Message: Hide passwords with rootdebug on [1]. (Bug 0000722) [1] - What part of rootdebug was hard to understand? Index: siteconfig.php.dist =================================================================== RCS file: /cvsroot/geeklog/Geeklog-1.x/public_html/siteconfig.php.dist,v retrieving revision 1.17 retrieving revision 1.18 diff -C2 -d -r1.17 -r1.18 *** siteconfig.php.dist 1 Jul 2008 20:27:35 -0000 1.17 --- siteconfig.php.dist 2 Sep 2008 19:08:56 -0000 1.18 *************** *** 20,24 **** // If you have errors on your site, can't login, or can't get to the // config UI, then you can comment this in to set the root debug option ! // on and get detailed error messages: // $_CONF['rootdebug'] = true; --- 20,26 ---- // If you have errors on your site, can't login, or can't get to the // config UI, then you can comment this in to set the root debug option ! // on and get detailed error messages. You can set this to 'force' (which the ! // Config UI won't allow you to do, to override hiding of password and cookie ! // items in the debug trace. // $_CONF['rootdebug'] = true; Index: lib-common.php =================================================================== RCS file: /cvsroot/geeklog/Geeklog-1.x/public_html/lib-common.php,v retrieving revision 1.726 retrieving revision 1.727 diff -C2 -d -r1.726 -r1.727 *** lib-common.php 1 Sep 2008 09:21:04 -0000 1.726 --- lib-common.php 2 Sep 2008 19:08:56 -0000 1.727 *************** *** 6551,6565 **** if($_CONF['rootdebug'] || SEC_inGroup('Root')) { ! echo(" ! An error has occurred:
! $errno - $errstr @ $errfile line $errline
! 
");
              ob_start();
              var_dump($errcontext);
              $errcontext = htmlspecialchars(ob_get_contents());
              ob_end_clean();
!             echo("$errcontext
! (This text is only displayed to users in the group 'Root') ! "); exit; } --- 6551,6580 ---- if($_CONF['rootdebug'] || SEC_inGroup('Root')) { ! echo('

An error has occurred:

'); ! if($_CONF['rootdebug']) { ! echo('

This is being displayed as "Root Debugging" is enabled ! in your Geeklog configuration.

If this is a production ! website you must disable this ! option once you have resolved any issues you are ! investigating.

'); ! } else { ! echo('(This text is only displayed to users in the group \'Root\')
'); ! } ! echo("$errno - $errstr @ $errfile line $errline
"); ! if(!SEC_inGroup('Root')) { ! if('force' != ''.$_CONF['rootdebug']) { ! $errcontext = COM_rootDebugClean($errcontext); ! } else { ! echo('

Root Debug is set to "force", this ! means that passwords and session cookies are exposed in this ! message!!!

'); ! } ! } ! echo('
');
              ob_start();
              var_dump($errcontext);
              $errcontext = htmlspecialchars(ob_get_contents());
              ob_end_clean();
!             echo("$errcontext
"); exit; } *************** *** 6617,6620 **** --- 6632,6666 ---- /** + * Recurse through the error context array removing/blanking password/cookie + * values in case the "for development" only switch is left on in a production + * environment. + * + * [Not fit for public consumption comments about what users who enable root + * debug in production should have done to them, and why making this change + * defeats the point of the entire root debug feature go here.] + * + * @param $array Array of state info (Recursive array). + * @return Cleaned array + */ + function COM_rootDebugClean($array, $blank=false) + { + $blankField = false; + while(list($key, $value) = each($array)) { + $lkey = strtolower($key); + if((strpos($lkey, 'pass') !== false) || (strpos($lkey, 'cookie')!== false)) { + $blankField = true; + } else { + $blankField = $blank; + } + if(is_array($value)) { + $array[$key] = COM_rootDebugClean($value, $blankField); + } elseif($blankField) { + $array[$key] = '[VALUE REMOVED]'; + } + } + return $array; + } + + /** * Checks to see if a specified user, or the current user if non-specified * is the anonymous user. From mjervis at qs1489.pair.com Thu Sep 4 15:03:32 2008 From: mjervis at qs1489.pair.com (Michael Jervis) Date: Thu, 04 Sep 2008 19:03:32 +0000 Subject: [geeklog-cvs] Geeklog-1.x/public_html/admin moderation.php, 1.123, 1.124 Message-ID: <20080904190332.DA185F740E@qs1489.pair.com> Update of /cvsroot/geeklog/Geeklog-1.x/public_html/admin In directory qs1489.pair.com:/tmp/cvs-serv53435/public_html/admin Modified Files: moderation.php Log Message: Bug 726, approve draft from moderation queue fails due to CSRF hardening. Index: moderation.php =================================================================== RCS file: /cvsroot/geeklog/Geeklog-1.x/public_html/admin/moderation.php,v retrieving revision 1.123 retrieving revision 1.124 diff -C2 -d -r1.123 -r1.124 *** moderation.php 19 Jun 2008 18:46:21 -0000 1.123 --- moderation.php 4 Sep 2008 19:03:29 -0000 1.124 *************** *** 217,221 **** if (SEC_hasRights('story.edit')) { if ($_CONF['listdraftstories'] == 1) { ! $retval .= draftlist (); } } --- 217,221 ---- if (SEC_hasRights('story.edit')) { if ($_CONF['listdraftstories'] == 1) { ! $retval .= draftlist ($token); } } *************** *** 400,404 **** * */ ! function draftlist () { global $_CONF, $_TABLES, $LANG24, $LANG29, $LANG_ADMIN; --- 400,404 ---- * */ ! function draftlist ($token) { global $_CONF, $_TABLES, $LANG24, $LANG29, $LANG_ADMIN; *************** *** 439,442 **** --- 439,443 ---- if ($nrows > 0) { $form_arr['bottom'] = '' . LB + . '' . LB . '' . LB . '' From mjervis at qs1489.pair.com Thu Sep 4 15:03:32 2008 From: mjervis at qs1489.pair.com (Michael Jervis) Date: Thu, 04 Sep 2008 19:03:32 +0000 Subject: [geeklog-cvs] Geeklog-1.x/public_html/docs history,1.719,1.720 Message-ID: <20080904190333.15224F740F@qs1489.pair.com> Update of /cvsroot/geeklog/Geeklog-1.x/public_html/docs In directory qs1489.pair.com:/tmp/cvs-serv53435/public_html/docs Modified Files: history Log Message: Bug 726, approve draft from moderation queue fails due to CSRF hardening. Index: history =================================================================== RCS file: /cvsroot/geeklog/Geeklog-1.x/public_html/docs/history,v retrieving revision 1.719 retrieving revision 1.720 diff -C2 -d -r1.719 -r1.720 *** history 2 Sep 2008 19:08:55 -0000 1.719 --- history 4 Sep 2008 19:03:30 -0000 1.720 *************** *** 4,7 **** --- 4,8 ---- ------------ + - CSRF token not passed to draft list (bug #0000726) [Ted Powell] - If root debugging is enabled, hide anything in the array stack that has a key containing 'cookie' or 'pass'. And added option to override this. From dhaun at qs1489.pair.com Sat Sep 6 08:38:16 2008 From: dhaun at qs1489.pair.com (Dirk Haun) Date: Sat, 06 Sep 2008 12:38:16 +0000 Subject: [geeklog-cvs] Geeklog-1.x/public_html/docs changes.html, 1.74, 1.75 history, 1.720, 1.721 Message-ID: <20080906123816.48BD8F7412@qs1489.pair.com> Update of /cvsroot/geeklog/Geeklog-1.x/public_html/docs In directory qs1489.pair.com:/tmp/cvs-serv31121 Modified Files: changes.html history Log Message: Updated documentation and added missing entry for Geeklog 1.4.0sr6 Index: changes.html =================================================================== RCS file: /cvsroot/geeklog/Geeklog-1.x/public_html/docs/changes.html,v retrieving revision 1.74 retrieving revision 1.75 diff -C2 -d -r1.74 -r1.75 *** changes.html 31 Aug 2008 10:05:39 -0000 1.74 --- changes.html 6 Sep 2008 12:38:12 -0000 1.75 *************** *** 27,30 **** --- 27,34 ---- --- 47,52 ----
  • Fixed handling of security tokens (for CSRF protection) that prevented you from deleting comments on a story that had trackbacks.
    • !
  • Other fixes were applied to the user submission queue, story submissions, ! the list of draft stories and the support for MS SQL.
    • *************** *** 50,56 ****