[geeklog-devel] 1.5 Installer stuff

[Joe Mucchiello]

Do you remember this checkin a couple days ago? Language files 
sometimes execute code. And thus are vulnerable when register_global 
is on (and the language directory is in the webroot).

--- 1162,1167 ----
       89 => 'Unable to find an OpenID server for the given identity URL.',
       90 => 'OpenID identification cancelled.',
!     91 => 'You specified an invalid identity URL.',
!     92 => 'Please ' . COM_createLink('check the security of your 
site', $_CONF['site_admin_url'] . '/sectest.php') . ' before using it!'
   );

Example: 
http://example.com/geeklog/languages/english.php?_CONF[site_admin_url]=http://evil.com

   Joe

At 10:45 PM 10/11/2007, Oliver Spiesshofer wrote:
>I always assumed that this problem is only there with files that 
>have actual code in them and not only variables.
>given that this file has some system variables it might be a problem 
>here, but I am not sure with the language files.
>
>Oliver
>
>Joe Mucchiello wrote:
>>There's a bunch security vulnerabilities from older version of 
>>Geeklog where you could take over the site using php files that are 
>>not intended as URL target combined with register_globals on. So 
>>yeah, the language files should also probably have them too.
>>
>>At 09:45 PM 10/11/2007, Oliver Spiesshofer wrote:
>>>Oliver Spiesshofer wrote:
>>>>Joe Mucchiello wrote:
>>>>>I put a / in the database prefix (by mistake) and received a 
>>>>>cryptic database error. That field should be validated.
>>>>>
>>>>>
>>>>>siteconfig.php needs the
>>>>>
>>>>>if (strpos ($_SERVER['PHP_SELF'], 'siteconfig.php') !== false) {
>>>>>     die ('This file can not be used on its own!');
>>>>>}
>>>>>
>>>>>or a
>>>>>
>>>>>    header('location: index.php');
>>>>noted.
>>>taking a look at it now.... why? Should we do it with all the 
>>>languages files then also?
>>>
>>>Oliver
>>>_______________________________________________
>>>geeklog-devel mailing list
>>>geeklog-devel at lists.geeklog.net
>>>http://eight.pairlist.net/mailman/listinfo/geeklog-devel
>>
>>----
>>Joe Mucchiello
>>Throwing Dice Games
>>http://www.throwingdice.com
>>_______________________________________________
>>geeklog-devel mailing list
>>geeklog-devel at lists.geeklog.net
>>http://eight.pairlist.net/mailman/listinfo/geeklog-devel
>>
>
>_______________________________________________
>geeklog-devel mailing list
>geeklog-devel at lists.geeklog.net
>http://eight.pairlist.net/mailman/listinfo/geeklog-devel

----
Joe Mucchiello
Throwing Dice Games
http://www.throwingdice.com