Potential XSS exploit discovered

Posted: Sat Nov 10, 2007 12:36 pm

Hi,

Just read the news on the front page of the site, my thanks for once again helping us to make our Nuke installs more secure! I downloaded and applied the fix but there is one part of the read me file I am having "issues" with Sad

Basically, this part goes on about setting the cookie domain correctly....

Quote:

We also highly recommend that you log into your Forum Administration screen and select Configuration. Find the setting called "Cookie domain" and change it to read "your_domain.tld". In other words if your domain name is whats_up_doc.com then "Cookie domain" should be set to whats_up_doc.domain. Failure to do so may result in an Invalid Session eror for some users.

Now my site is on a .net domain so would it still be my_site_name.domain? I may well just be thick and missing something obvious but a helping hand would be appreciated Smile

Cheers, Paul K

Posted: Sat Nov 10, 2007 12:46 pm

I believe instead of your_domain.com it would be your_domain.net

Posted: Sat Nov 10, 2007 12:49 pm

I had thought that would be the case, the whole .domain thing in the read me threw me off though Sad

Thanks for the help Smile

Posted: Sat Nov 10, 2007 1:50 pm

The Auto Cookie mod that Phreekie converted for Nuke is useful for checking that you have the right setup in your forums, see link below.
[ Only registered users can see links on this board! Get registered or login! ]

Posted: Sat Nov 10, 2007 2:18 pm

Hi,

That mod says that everything is ok Smile

Took me a while to work out how to run the thing though!