Only registered users can see links on this board! Get registered or login to the forums!
.
The latest version, 4.4.2, was released before 7.6, and it may require changes both for 7.6 and the latest patch. The next version, 5.0, has been in testing status since June, but has some excellent features. menelaos and Sixonetonoffun, how about an update?
The other official site for CNB is
Only registered users can see links on this board! Get registered or login to the forums!
and has English-language feature requests and bug tracking.
Your observation and comment is much appreciated, however I have still do install both CNBYA and Sentinel, so I will make sure I take your advise when I do.
CNB YA 5.0 hasn't been released yet, so the only choice is 4.4.2. You may notice that 4.4.2 is a Beta version, but it's been around for a long time and used extensively on many sites without significant issues.
I would suggest comparing the patched changes to the standard Your Account module to identify similar changes in the CNB YA module.
5. SECUTIRY
-----------
Open modules/includes/constants.php
Find:
define("CNBYA_DOMAINNAME", "");
add your domain or IP here without any http or www or slashes
Example:
define("CNBYA_DOMAINNAME", "phpnuke.org.br");
After this I tried running the cnbya.php file to complete the install, but now my site just shows a white blank page...
BUT I do also see that for the second change you are advised to locate the constants.php file here modules/includes/constants.php and this must be incorrect. My constants.php
is located in:
modules/YOURACCOUNT/includes/constants.php and this is where I made the folllowing change:
5. SECUTIRY
-----------
Open modules/includes/constants.php
Find:
define("CNBYA_DOMAINNAME", "");
add your domain or IP here without any http or www or slashes
Example:
define("CNBYA_DOMAINNAME", "phpnuke.org.br");
The website is now only a blank white page, even thought I have the following setting in in my config.php file:
$display_errors = true;
By the way, I HAVE changed the name of my original admin.php file...Would this be causing the problem..If so, what should I do?
Joined: May 02, 2003 Posts: 1396 Location: Puerto Rico
Posted:
Tue Dec 27, 2005 3:42 pm
emma since you are using nuke patched change the first file to (edit the url):
Code:
<?php
/*********************************************************************************/
/* CNB Your Account: An Advanced User Management System for phpnuke */
/* ============================================ */
/* */
/* Copyright (c) 2004 by Comunidade PHP Nuke Brasil */
/* http://dev.phpnuke.org.br & http://www.phpnuke.org.br */
/* */
/* Contact author:
Only registered users can see links on this board! Get registered or login to the forums!
*/
/* International Support Forum: http://ravenphpscripts.com/forum76.html */
/* */
/* This program is free software. You can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 2 of the License. */
/* */
/*********************************************************************************/
/* CNB Your Account it the official successor of NSN Your Account by Bob Marion */
/*********************************************************************************/
if (stristr($_SERVER['PHP_SELF'], "constants.php")) {
Header("Location: index.php");
die();
}
# enter your domain name here to add an extra layer of protection or leave blank.
# example shows how to use this with a subdomain
# define("CNBYA_DOMAINNAME", "wwww.yourdomain.com");
# no www or http just the domain name
# remove the '//' from the next two lines and insert your domain name for additional security
# (don't put 'http://' in front of it, your domain name only!
define("CNBYA_DOMAINNAME", "your_url.com");
if (($_SERVER['SERVER_NAME'] != CNBYA_DOMAINNAME OR $_SERVER['SERVER_NAME'] != CNBYA_DOMAINNAME) AND CNBYA_DOMAINNAME != "") {exit();}
define('CNBYA', true);
?>
and mainfile.php to:
Code:
<?php
/************************************************************************/
/* PHP-NUKE: Advanced Content Management System */
/* ============================================ */
/* */
/* Copyright (c) 2002 by Francisco Burzi */
/* http://phpnuke.org */
/* */
/* This program is free software. You can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 2 of the License. */
/************************************************************************/
/* Additional Security and Code Cleanup for Patched 3.1 */
/* Commited by the Nuke Patched Development Team 2005 */
/* chatserv, Evaders99, Quake */
/* http://www.nukeresources.com - Download location */
/* http://www.nukefixes.com - Development location */
/* http://sourceforge.net/projects/nukepatched/ - CVS */
/************************************************************************/
// End the transaction
if(!defined('END_TRANSACTION')) {
define('END_TRANSACTION', 2);
}
// After doing those superglobals we can now use one
// and check if this file isnt being accessed directly
if (stristr(htmlentities($_SERVER['PHP_SELF']), "mainfile.php")) {
header("Location: index.php");
exit();
}
if (!function_exists("floatval")) {
function floatval($inputval) {
return (float)$inputval;
}
}
if ($phpver >= '4.0.4pl1' && isset($_SERVER['HTTP_USER_AGENT']) && strstr($_SERVER['HTTP_USER_AGENT'],'compatible')) {
if (extension_loaded('zlib')) {
@ob_end_clean();
ob_start('ob_gzhandler');
}
} elseif ($phpver > '4.0' && isset($_SERVER['HTTP_ACCEPT_ENCODING']) && !empty($_SERVER['HTTP_ACCEPT_ENCODING'])) {
if (strstr($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip')) {
if (extension_loaded('zlib')) {
$do_gzip_compress = true;
ob_start(array('ob_gzhandler',5));
ob_implicit_flush(0);
if (ereg("MSIE", $_SERVER['HTTP_USER_AGENT'])) {
header('Content-Encoding: gzip');
}
}
}
}
if (!ini_get('register_globals')) {
@import_request_variables("GPC", "");
}
// This block of code makes sure $admin and $user are COOKIES
if((isset($admin) && $admin != $_COOKIE['admin']) OR (isset($user) && $user != $_COOKIE['user'])) {
die("Illegal Operation");
}
// We want to use the function stripos,
// but thats only available since PHP5.
// So we cloned the function...
if(!function_exists('stripos')) {
function stripos_clone($haystack, $needle, $offset=0) {
$return = strpos(strtoupper($haystack), strtoupper($needle), $offset);
if ($return === false) {
return false;
} else {
return true;
}
}
} else {
// But when this is PHP5, we use the original function
function stripos_clone($haystack, $needle, $offset=0) {
$return = stripos($haystack, $needle, $offset=0);
if ($return === false) {
return false;
} else {
return true;
}
}
}
// Die message for not allowed HTML tags
$htmltags = "<center><img src=\"images/logo.gif\"><br><br><b>";
$htmltags .= "The html tags you attempted to use are not allowed</b><br><br>";
$htmltags .= "[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]</center>";
@require_once(INCLUDE_PATH."config.php");
@require_once(INCLUDE_PATH."db/db.php");
@require_once(INCLUDE_PATH."includes/sql_layer.php");
@require_once(INCLUDE_PATH."includes/ipban.php");
if (file_exists(INCLUDE_PATH."includes/custom_files/custom_mainfile.php")) {
@include_once(INCLUDE_PATH."includes/custom_files/custom_mainfile.php");
}
@include_once(INCLUDE_PATH."modules/Your_Account/includes/mainfileend.php");
if (!defined('FORUM_ADMIN')) {
if(empty($admin_file)) {
die ("You must set a value for admin_file in config.php");
} elseif (!empty($admin_file) && !file_exists($admin_file.".php")) {
die ("The admin_file you defined in config.php does not exist");
}
}
// Error reporting, to be set in config.php
error_reporting(E_ALL^E_NOTICE);
if($display_errors) {
@ini_set('display_errors', 1);
} else {
@ini_set('display_errors', 0);
}
function get_lang($module) {
global $currentlang, $language;
if ($module == "admin" AND $module != "Forums") {
if (file_exists("admin/language/lang-".$currentlang.".php")) {
include_once("admin/language/lang-".$currentlang.".php");
} elseif (file_exists("admin/language/lang-".$language.".php")) {
include_once("admin/language/lang-".$language.".php");
}
} else {
if (file_exists("modules/$module/language/lang-".$currentlang.".php")) {
include_once("modules/$module/language/lang-".$currentlang.".php");
} elseif (file_exists("modules/$module/language/lang-".$language.".php")) {
include_once("modules/$module/language/lang-".$language.".php");
}
}
}
function is_admin($admin) {
if (!$admin) { return 0; }
if (isset($adminSave)) return $adminSave;
if (!is_array($admin)) {
$admin = base64_decode($admin);
$admin = addslashes($admin);
$admin = explode(":", $admin);
}
$aid = $admin[0];
$pwd = $admin[1];
$aid = substr(addslashes($aid), 0, 25);
if (!empty($aid) && !empty($pwd)) {
global $prefix, $db;
$sql = "SELECT pwd FROM ".$prefix."_authors WHERE aid='$aid'";
$result = $db->sql_query($sql);
$pass = $db->sql_fetchrow($result);
$db->sql_freeresult($result);
if ($pass[0] == $pwd && !empty($pass[0])) {
static $adminSave;
return $adminSave = 1;
}
}
static $adminSave;
return $adminSave = 0;
}
function is_user($user) {
if (!$user) { return 0; }
if (isset($userSave)) return $userSave;
if (!is_array($user)) {
$user = base64_decode($user);
$user = addslashes($user);
$user = explode(":", $user);
}
$uid = $user[0];
$pwd = $user[2];
$uid = intval($uid);
if (!empty($uid) AND !empty($pwd)) {
global $db, $user_prefix;
$sql = "SELECT user_password FROM ".$user_prefix."_users WHERE user_id='$uid'";
$result = $db->sql_query($sql);
$row = $db->sql_fetchrow($result);
$db->sql_freeresult($result);
if ($row[0] == $pwd && !empty($row[0])) {
static $userSave;
return $userSave = 1;
}
}
static $userSave;
return $userSave = 0;
}
function is_group($user, $name) {
global $prefix, $db, $user_prefix, $cookie, $user;
if (is_user($user)) {
if(!is_array($user)) {
$cookie = cookiedecode($user);
$uid = intval($cookie[0]);
} else {
$uid = intval($user[0]);
}
$result = $db->sql_query("SELECT points FROM ".$user_prefix."_users WHERE user_id='$uid'");
$row = $db->sql_fetchrow($result);
$points = intval($row['points']);
$db->sql_freeresult($result);
$result2 = $db->sql_query("SELECT mod_group FROM ".$prefix."_modules WHERE title='$name'");
$row2 = $db->sql_fetchrow($result2);
$mod_group = intval($row2['mod_group']);
$db->sql_freeresult($result2);
$result3 = $db->sql_query("SELECT points FROM ".$prefix."_groups WHERE id='$mod_group'");
$row3 = $db->sql_fetchrow($result3);
$grp = intval($row3['points']);
$db->sql_freeresult($result3);
if (($points >= 0 AND $points >= $grp) OR $mod_group == 0) {
return 1;
}
}
return 0;
}
$postString = "";
foreach ($_POST as $postkey => $postvalue) {
if ($postString > "") {
$postString .= "&".$postkey."=".$postvalue;
} else {
$postString .= $postkey."=".$postvalue;
}
}
str_replace("%09", "%20", $postString);
$postString_64 = base64_decode($postString);
if ((!is_admin($admin)) AND (stristr($postString,'%20union%20')) OR (stristr($postString,'*/union/*')) OR (stristr($postString,' union ')) OR (stristr($postString_64,'%20union%20')) OR (stristr($postString_64,'*/union/*')) OR (stristr($postString_64,' union ')) OR (stristr($postString_64,'+union+')) OR (stristr($postString,'http-equiv')) OR (stristr($postString_64,'http-equiv')) OR (stristr($postString,'alert')) OR (stristr($postString_64,'alert'))) {
header("Location: index.php");
die();
}
// Additional security (Union, CLike, XSS)
if(!file_exists('includes/nukesentinel.php')) {
//Union Tap
//Copyright Zhen-Xjell 2004 http://nukecops.com
//Beta 3 Code to prevent UNION SQL Injections
unset($matches);
unset($loc);
if(isset($_SERVER['QUERY_STRING'])) {
if (preg_match("/([OdWo5NIbpuU4V2iJT0n]{5}) /", rawurldecode($loc=$_SERVER['QUERY_STRING']), $matches)) {
die('Illegal Operation');
}
}
if((!is_admin($admin)) AND (isset($_SERVER['QUERY_STRING'])) AND (!stristr($_SERVER['QUERY_STRING'], "ad_click"))) {
$queryString = $_SERVER['QUERY_STRING'];
if ((stristr($queryString,'%20union%20')) OR (stristr($queryString,'/*')) OR (stristr($queryString,'*/union/*')) OR (stristr($queryString,'c2nyaxb0')) OR (stristr($queryString,'+union+')) OR (stristr($queryString,'http://')) OR ((stristr($queryString,'cmd=')) AND (!stristr($queryString,'&cmd'))) OR ((stristr($queryString,'exec')) AND (!stristr($queryString,'execu'))) OR (stristr($queryString,'concat'))) {
die('Illegal Operation');
}
}
}
function update_points($id) {
global $user_prefix, $prefix, $db, $user;
if (is_user($user)) {
if(!is_array($user)) {
$cookie = cookiedecode($user);
$username = $cookie[1];
} else {
$username = $user[1];
}
$username = substr(htmlspecialchars(str_replace("\'", "'", trim($username))), 0, 25);
$username = rtrim($username, "\\");
$username = str_replace("'", "\'", $username);
if ($db->sql_numrows($db->sql_query("SELECT * FROM ".$prefix."_groups")) > 0) {
$id = intval($id);
$result = $db->sql_query("SELECT points FROM ".$prefix."_groups_points WHERE id='$id'");
list($points) = $db->sql_fetchrow($result);
$db->sql_freeresult($result);
$rpoints = intval($points);
$db->sql_query("UPDATE ".$user_prefix."_users SET points=points+".$rpoints." WHERE username='$username'");
}
}
}
function delQuotes($string){
/* no recursive function to add quote to an HTML tag if needed */
/* and delete duplicate spaces between attribs. */
$tmp=""; # string buffer
$result=""; # result string
$i=0;
$attrib=-1; # Are us in an HTML attrib ? -1: no attrib 0: name of the attrib 1: value of the atrib
$quote=0; # Is a string quote delimited opened ? 0=no, 1=yes
$len = strlen($string);
while ($i<$len) {
switch($string[$i]) { # What car is it in the buffer ?
case "\"": #" # a quote.
if ($quote==0) {
$quote=1;
} else {
$quote=0;
if (($attrib>0) && (!empty($tmp))) { $result .= "=\"$tmp\""; }
$tmp="";
$attrib=-1;
}
break;
case "=": # an equal - attrib delimiter
if ($quote==0) { # Is it found in a string ?
$attrib=1;
if ($tmp!="") $result.=" $tmp";
$tmp="";
} else $tmp .= '=';
break;
case " ": # a blank ?
if ($attrib>0) { # add it to the string, if one opened.
$tmp .= $string[$i];
}
break;
default: # Other
if ($attrib<0) # If we weren't in an attrib, set attrib to 0
$attrib=0;
$tmp .= $string[$i];
break;
}
$i++;
}
if (($quote!=0) && (!empty($tmp))) {
if ($attrib==1) $result .= "=";
/* If it is the value of an atrib, add the '=' */
$result .= "\"$tmp\""; /* Add quote if needed (the reason of the function ;-) */
}
return $result;
}
function check_html ($str, $strip="") {
/* The core of this code has been lifted from phpslash */
/* which is licenced under the GPL. */
include("config.php");
if ($strip == "nohtml")
global $AllowableHTML;
if (!is_array($AllowableHTML)) $AllowableHTML = array('');
$str = stripslashes($str);
$str = eregi_replace("<[[:space:]]*([^>]*)[[:space:]]*>",'<\\1>', $str);
// Delete all spaces from html tags .
$str = eregi_replace("<a[^>]*href[[:space:]]*=[[:space:]]*\"?[[:space:]]*([^\" >]*)[[:space:]]*\"?[^>]*>",'<a href="\\1">', $str);
// Delete all attribs from Anchor, except an href, double quoted.
$str = eregi_replace("<[[:space:]]* img[[:space:]]*([^>]*)[[:space:]]*>", '', $str);
// Delete all img tags
$str = eregi_replace("<a[^>]*href[[:space:]]*=[[:space:]]*\"?javascript[[:punct:]]*\"?[^>]*>", '', $str);
// Delete javascript code from a href tags -- Zhen-Xjell @ http://nukecops.com
$tmp = "";
while (ereg("<(/?[[:alpha:]]*)[[:space:]]*([^>]*)>",$str,$reg)) {
$i = strpos($str,$reg[0]);
$l = strlen($reg[0]);
if ($reg[1][0] == "/") $tag = strtolower(substr($reg[1],1));
else $tag = strtolower($reg[1]);
if ($a = $AllowableHTML[$tag])
if ($reg[1][0] == "/") $tag = "</$tag>";
elseif (($a == 1) || (empty($reg[2]))) $tag = "<$tag>";
else {
# Place here the double quote fix function.
$attrb_list=delQuotes($reg[2]);
// A VER
$attrb_list = str_replace("&","&",$attrb_list);
$attrb_list = str_replace("&","&",$attrb_list);
$tag = "<$tag" . $attrb_list . ">";
} # Attribs in tag allowed
else $tag = "";
$tmp .= substr($str,0,$i) . $tag;
$str = substr($str,$i+$l);
}
$str = $tmp . $str;
return $str;
exit;
/* Squash PHP tags unconditionally */
$str = str_replace("<?","",$str);
return $str;
}
function filter_text($Message, $strip="") {
global $EditedMessage;
check_words($Message);
$EditedMessage=check_html($EditedMessage, $strip);
return $EditedMessage;
}
That didnt work either. Did you include ALL the code in the second set?
I mean, I do note there is no ?> at the end so I wonder?
Also, as you can see, kguske suggest something different, so I have no clue why or if it is a case of either will work?...Anyhow, I tried your 'solution' first, but as I explain, I am still haiving no luck.
One thing to mention is that now I have returned the original mainfile.php and constants.php files from the 7.6 php 3.1 patch install and Ido note that I can log into a user account, and the new 'layout' for CNBYA has taken effect, but I can only visit one page before I am immediately automatically logged out again.
The other point is that although those original files have been replaced, my admin panel no longer works and all I see is the icons for Administration Menu' and 'Modules Administration'...When I click on the icons, nothing appears to happen.
Finally, do note that I have not yet added Sentinel or any other addon to this 7.6 3.1patch istallation yet.
Joined: May 02, 2003 Posts: 1396 Location: Puerto Rico
Posted:
Wed Dec 28, 2005 10:16 am
As Raven noted when he edited my post the file got truncated, i made the mistake of assuming that since the preview displayed all the content the final post would as well, anyway let's do the following, email me the zip for CNBYA and any file it asks you to edit (i.e. your mainfile.php)
When I originally viewed the code you posted, I noted the text at the bottom, but it only read, '[Raven note: CS, looks', and I did wonder what it meant. It has now clearly been ammended.
View next topic View previous topic
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
![[Valid RSS]](http://www.ravenphpscripts.com/images/valid-rss.png "Validate my RSS feed"){kind=small}
:: 
::
