Ravens PHP Scripts: Forums
 

 

View next topic
View previous topic
This forum is locked: you cannot post, reply to, or edit topics.   This topic is locked: you cannot edit posts or make replies.    Ravens PHP Scripts And Web Hosting Forum Index -> NukeSentinel™ v2.4.x
Author Message
Dauthus
Worker
Worker


Joined: Oct 07, 2003
Posts: 211

PostPosted: Mon Jun 19, 2006 4:48 pm Reply with quote

NukeSentinel(tm) Version 2.4.2pl9

I just noticed that when I click on any of the links listed in the HTTP Referers in the Admin control panel, I get banned. I can copy and paste the link, but clicking on it causes the ip to be banned. Here's the sentinel report.

Quote:
Date & Time: 2006-06-18 23:41:16 EDT GMT -0400 Blocked IP: XX.XX.X.XXX User ID: Dauthus (X)
Reason: Abuse-Filter
--------------------
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; InfoPath.1) Query String: Only registered users can see links on this board! Get registered or login!
Get String: Only registered users can see links on this board! Get registered or login!
Post String: Only registered users can see links on this board! Get registered or login! Forwarded For: none Client IP: none Remote Address: XX.XX.X.XXX Remote Port: 7554 Request Method: GET


I haven't had this happen in the prior patch levels. Any way to fix this or is it best to leave it alone?

_________________
Only registered users can see links on this board! Get registered or login!
Vivere disce, cogita mori 
View user's profile Send private message Visit poster's website
montego
Site Admin


Joined: Aug 29, 2004
Posts: 9449
Location: Arizona

PostPosted: Mon Jun 19, 2006 10:04 pm Reply with quote

Yes, I would not click those. The filters in NS must have been "tuned up" a bit since your last version. NS is tripping on the inclusing of Only registered users can see links on this board! Get registered or login! in the query string. This is a no-no and is a good thing.

_________________
Only registered users can see links on this board! Get registered or login!
Only registered users can see links on this board! Get registered or login! 
View user's profile Send private message Visit poster's website
benji
New Member
New Member


Joined: Jul 15, 2006
Posts: 1

PostPosted: Sat Jul 15, 2006 1:55 pm Reply with quote

Hi guys.. i'm not a programer or anything like that but that option is disabled for many reasons.. if you want that to be enabled then you need to enable (something on sentinel which i dont know which one it is but but but) its best not to do so as there are many kiddie scripts that use this type of hacking...
Only registered users can see links on this board! Get registered or login!

now the txtfile contains codes and stuff that will break your protection and get access to your site.. so thats why that is now allowing you to do so..

my suggestion would be copy and paste the link to a new browser.. it will be no harm for u

Benji
 
View user's profile Send private message
Dauthus
PostPosted: Sun Jul 16, 2006 12:19 am Reply with quote

Ok, here's a simple fix for this issue:

Code:
#

#-----[ OPEN ] -----
#

admin/modules/referers.php

#
#-----[ FIND ] -----
#

."<td bgcolor=\"$bgcolor2\"><font class=\"content\"><a href=\"index.php?url=$url\" target=\"_blank\">$url</a></td></tr>";

#
#-----[ REPLACE WITH ] -----
#

//."<td bgcolor=\"$bgcolor2\"><font class=\"content\"><a href=\"index.php?url=$url\" target=\"_blank\">$url</a></td></tr>";
."<td bgcolor=\"$bgcolor2\"><font class=\"content\"><a href=\"$url\" target=\"_blank\">$url</a></td></tr>";

#
#-----[ SAVE AND CLOSE ALL FILES ] -----
#

EOM
 
spottedhog
Regular
Regular


Joined: Jun 02, 2004
Posts: 88

PostPosted: Fri Jul 21, 2006 1:12 pm Reply with quote

Here is another work around.....

The issue is the "http://" being inside a URL and this happens also in the Downloads and Web Links modules in Admin.

I think it was the 3.1 patches where "http://" was added to the cross-scripting code. Now, at least from what I have seen that code is now inside the includes/nukesentinel.php file. For a very short time, this code was a part of mainfile.php, but now it is requested to move it to the includes/nukesentinel.php file.

My work around is to move those lines of cross-scripting code back to the mainfile.php, then surround it with ---> if(!is_admin) {cross-script code};

From what I have seen in the includes/nukesentinel.php file, it does not include the mainfile.php, so that file has no idea what is_admin is, so my work around would not be functional except in the mainfile.php file.

Sooo, if that code were moved to mainfile.php then the admin would never have an issue.

I know this runs contrary to what is listed in Sentinel, but it seems to work OK this way.

sorry.......
 
View user's profile Send private message Visit poster's website
Guardian2003
Site Admin


Joined: Aug 28, 2003
Posts: 6792
Location: Ha Noi, Viet Nam

PostPosted: Fri Jul 21, 2006 1:37 pm Reply with quote

spottedhog wrote
Quote:
From what I have seen in the includes/nukesentinel.php file, it does not include the mainfile.php, so that file has no idea what is_admin is, so my work around would not be functional except in the mainfile.php file.


nukesentinel.php does not do an include for mainfile.php because it is mainfile.php that includes nukesentinel.php


Last edited by Guardian2003 on Fri Jul 21, 2006 2:25 pm; edited 1 time in total 
View user's profile Send private message Send e-mail
spottedhog
PostPosted: Fri Jul 21, 2006 2:23 pm Reply with quote

Smile right......

I mentioned that as to the reason why my suggested work around could not be used when the code was located in the includes file..... hence, move the code to the mainfile.php so "!is_admin" can be used.
 
Guardian2003
PostPosted: Fri Jul 21, 2006 2:30 pm Reply with quote

Yup.
I think this is already being investigated in another thread (use of is_admin) with a view to making sure an admin doesnt have an issue with this type of problem.
Both are interesting resolutions though.
 
Display posts from previous:       
This forum is locked: you cannot post, reply to, or edit topics.   This topic is locked: you cannot edit posts or make replies.    Ravens PHP Scripts And Web Hosting Forum Index -> NukeSentinel™ v2.4.x

View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001-2007 phpBB Group
All times are GMT - 6 Hours
 
Forums ©