[geeklog-devel] 1.5 Installer stuff

[Joe Mucchiello]

There's a bunch security vulnerabilities from older version of 
Geeklog where you could take over the site using php files that are 
not intended as URL target combined with register_globals on. So 
yeah, the language files should also probably have them too.

At 09:45 PM 10/11/2007, Oliver Spiesshofer wrote:

>Oliver Spiesshofer wrote:

>>Joe Mucchiello wrote:

>>>I put a / in the database prefix (by mistake) and received a 

>>>cryptic database error. That field should be validated.

>>>

>>>

>>>siteconfig.php needs the

>>>

>>>if (strpos ($_SERVER['PHP_SELF'], 'siteconfig.php') !== false) {

>>>     die ('This file can not be used on its own!');

>>>}

>>>

>>>or a

>>>

>>>    header('location: index.php');

>>noted.

>taking a look at it now.... why? Should we do it with all the 

>languages files then also?

>

>Oliver

>_______________________________________________

>geeklog-devel mailing list

>geeklog-devel at lists.geeklog.net

>http://eight.pairlist.net/mailman/listinfo/geeklog-devel


----
Joe Mucchiello
Throwing Dice Games
http://www.throwingdice.com