Admin panel > HTTP Referers > check url

BlueLion · New Member Joined: Aug 10, 2004 Posts: 12

PHP-Nuke 7.6pl3.1
Location:

Only registered users can see links on this board!
Get registered or login to the forums!

Problem: When checking out one of the listed URL's PHP-Nuke comes up with: "Illegal Operation".
URL:

Only registered users can see links on this board!
Get registered or login to the forums!

I've looked into the /mainfile.php where this part is blocking the operation:

Code:

// Additional security (Union, CLike, XSS)
if(!file_exists('includes/nukesentinel.php')) {
if(isset($_SERVER['QUERY_STRING']) && (!stripos_clone($_SERVER['QUERY_STRING'], "ad_click") || !stripos_clone($_SERVER['QUERY_STRING'], "url"))) {
$queryString = $_SERVER['QUERY_STRING'];
if (stripos_clone($queryString,'%20union%20') OR stripos_clone($queryString,'/*') OR stripos_clone($queryString,'*/union/*') OR stripos_clone($queryString,'c2nyaxb0') OR stripos_clone($queryString,'+union+') OR stripos_clone($queryString,'http://') OR (stripos_clone($queryString,'cmd=') AND !stripos_clone($queryString,'&cmd')) OR (stripos_clone($queryString,'exec') AND !stripos_clone($queryString,'execu')) OR stripos_clone($queryString,'concat')) {
die('Illegal Operation');
}
}
}

And in particular this part:

Code:

OR stripos_clone($queryString,'http://')

One site runs Sentinel and the problem has never occured on that pages, but locally and on sites where sentinel isn't installed it will look for this part of code, because of this line:

Code:

if(!file_exists('includes/nukesentinel.php'))

When stripping out this

Code:

OR stripos_clone($queryString,'http://')

the referer can be checked with this URL:

Only registered users can see links on this board!
Get registered or login to the forums!

Questions:
Is it save to remove the following?

Code:

OR stripos_clone($queryString,'http://')

Any other suggestion to get this solved, except installing Sentinel?
Is sentinel not checking this?

BlueLion

Raven · Posted: Sat Oct 22, 2005 6:51 am

That is a tough call. That referer line is how one can easily get redirected to a bad page, but at the same time many legitimate applications use that type syntax. You, as webmaster, have to make that call.