Major security problem I just found (only on my site)

ThePiston · Worker Joined: Dec 22, 2004 Posts: 135

Ok, I have been making this site for a long time now... tweaking here and there etc. At first I was only putting benign info in the "Content" pages for anoymouse visitors. I started putting private info on them too and other sensitive info on them (without thinking) and I have put a lot of work into it. I just realized that I can't tell nuke which ones to show only to registered users.... does anyone know how I can fix this problem?? I've got some sensitive stuff on this page. Can I create a "Content2" and make it registered only or something? How about a hack to create privelages for Content's Categories?

kguske · Site Admin Joined: Jun 04, 2004 Posts: 6044

There are a couple of options. You could:

There are probably other ways, too, but this should give you some things to consider.

ThePiston · Worker Joined: Dec 22, 2004 Posts: 135

yeah, those all require a lot more grasp of the language than I have. I wish there was an easy way to give privelages to Content Categories instead of all-or-nothing that is is now.

kguske · Site Admin Joined: Jun 04, 2004 Posts: 6044

Why not store the sensitive content in a private forum? That shouldn't require any code changes.

ThePiston · Worker Joined: Dec 22, 2004 Posts: 135

because I want the pages to look cohesive and not change around like that. I'm dealing with guys who are not computer geeks.... odler gentlemen who do not use computers too often.

Steptoe · Involved Joined: Oct 09, 2004 Posts: 291

Quote:

I'm dealing with guys who are not computer geeks.... odler gentlemen who do not use computers too often.

I had the same problem....members accessing hidden members section and staff accessing admin sections.
These did not show up in the scrolling forum block which from logs I was able to establish they used, by passing the forum index.
I bumbled thru made a custom user info out of others user info. When a user is logged in, just under the log out button, with the PM link, I put a link to posts since last visited, that appears only when logged in. this shows all posts since last visit that they have permissin to veiw.
From the logs I now see that this link is now commonly used.
Unfortunately my code is rather messy, (althu works)as I do not realy know what Im doing. therefore it would be irresponsable to release the user info in its current condition. It needs a coder to clean up and them to release.

64bitguy · Posted: Wed Sep 28, 2005 5:50 pm

NSN Groups.

Xiode · Regular Joined: Jun 15, 2005 Posts: 78 Location: AR

Here you go man.. Here is "Content2"... All I did was change the SQL so that it looks for a different second DB... It is the exact same module just # 2... No that wasn't a restroom joke Razz

.

It is based off 7.6.3.1....

All you have to do is upload the contents of the "html" folder...

Then go into phpmyadmin and run the sql querry....

I take no credit for this, use at your own risk blah blah.... So on... You know man. If you don't you should.

Only registered users can see links on this board!
Get registered or login to the forums!

ThePiston · Worker Joined: Dec 22, 2004 Posts: 135

wow, thanks. I'll let you know how it goes.

Xiode · Regular Joined: Jun 15, 2005 Posts: 78 Location: AR

did everything work out for you?

montego · Posted: Sun Oct 02, 2005 7:08 am

64bitguy wrote:

NSN Groups.

On that "note", it might be another good "After-Patched" value-add to include more core group "awareness" within certain core nuke modules similar, I think, to NSN News to attach groups to specific articles?

ThePiston · Worker Joined: Dec 22, 2004 Posts: 135

worked very well, thank you. Now, how do I go about moving the private Content from old "nuke_pages" to "nuke_pages2"? What's the SQL code so I can do it in the DB and not by hand.

ThePiston · Worker Joined: Dec 22, 2004 Posts: 135

nm, exported and just changed one number and then inserted into new pages... THANKS!

ThePiston · Worker Joined: Dec 22, 2004 Posts: 135

oops, spoke too soon... The links to the content pages in "Content2" have "name=Content" in them, how do I change that so it says "name=Content2"?

montego · Posted: Mon Oct 03, 2005 9:01 pm

ThePiston wrote:

oops, spoke too soon... The links to the content pages in "Content2" have "name=Content" in them, how do I change that so it says "name=Content2"?

Since you already have the export/import process down pat, if you still have the file that you imported, I would change all references of "Content" to "Content2", truncate the table, and then re-import. However, if you no longer have the import file, I would export the table to file first, then change the data, truncate the table, and then re-import.

Regards,
montego

ThePiston · Worker Joined: Dec 22, 2004 Posts: 135

yep, I exported all the tables and then replaced "pages" with pages2" and insterted. My problem now is that when I admin "Content2" pages, they all have links to "Content". How can I change that?

montego · Posted: Tue Oct 04, 2005 4:43 am

ThePiston wrote:

yep, I exported all the tables and then replaced "pages" with pages2" and insterted. My problem now is that when I admin "Content2" pages, they all have links to "Content". How can I change that?

Depending upon your version of nuke (which you should always provide by the way in your up-front posts), you need to find the appropriate admin case.php and link.php for your new "Content2" module. You have to also make the case statements unique, such as changing "content" to "content2" and "content_edit" to "content_edit2", etc... You have to match those changes in your Content2 index.php as well.

Also in the Content2's admin index.php and possibly other scripts you need to look for the hardcoding of the url to "content" to be "content2". It looks like FB wasn't consistent in his use of the variable "$module_name" in the admin scripts.

Lastly, you need to change the admin's link.php script to also use "contents2" instead of "contents".

Unfortunately, cloning a module isn't as simple as copying it to another directory. If you run into any more issues, just post the details of what you are seeing and/or any error messages and we'll try and help you out.

Regards,
montego

ThePiston · Worker Joined: Dec 22, 2004 Posts: 135

got it, there was one instance in the admin/index.php file hat still had "content" and not "content2"... all aothers were fixed. DONE, thanks!

montego · Posted: Tue Oct 04, 2005 7:48 pm

u r welcome.

RavensScripts