web link bugs

New Member Joined: Jun 14, 2005 Posts: 9

hi
please tell me how can I fix this bugs :

Quote:

modules.php?name=Web_Links&l_op=TopRated&ratenum=This%20Site%20Is%20HACKED%20BY%someone&ratetype=num
modules.php?name=Web_Links&l_op=ratelink&ttitle=This%20Site%20Is%20Hacked%20By%20someone
modules.php?name=Web_Links&l_op=viewlinkcomments&ttitle=This%20Site%20Is%20Hacked%20By%20someone

my nuke version is 7.8 with chat serv 78patched and nuke sentinel

[/url]

Posted: Fri Jul 08, 2005 1:32 am

Open modules/Web_Links/index.php
find 2 times:

Code:

   if ($ratenum != "" && $ratetype != "") {

change to:

Code:

   $ratenum = intval($ratenum);


   $ratetype = htmlentities($ratetype);


   if (!empty($ratenum) && !empty($ratetype)) {

find 4 times:

Code:

   $transfertitle = ereg_replace ("_", " ", $ttitle);

change to:

Code:

   $ttitle = htmlentities($ttitle);


   $transfertitle = ereg_replace ("_", " ", $ttitle);

Posted: Fri Jul 08, 2005 1:38 am

Also applies to modules/Downloads/index.php

Regular Joined: May 28, 2005 Posts: 90

i removed $ttitle from my downloads module because it's buggy and has problems with sentinel and others

Posted: Sun Jul 10, 2005 2:54 am

Thanks Dear chatserv
I replaced patch code (Total 6 line)
First Bug Fixed :

Code:




modules.php?name=Web_Links&l_op=TopRated&ratenum=This%20Site%20Is%20HACKED%20BY%20someone&ratetype

but these bug not fix

Code:




modules.php?name=Web_Links&l_op=viewlinkcomments&ttitle=This%20Site%20Is%20Hacked%20By%20someone


modules.php?name=Web_Links&l_op=ratelink&ttitle=This%20Site%20Is%20Hacked%20By%20someone

I'm sure apply your patch code correct
Thank You

Posted: Sun Jul 10, 2005 7:51 pm

You can't hack a site with a line like This%20Site%20Is%20Hacked%20By%20someone, try using something else to see if it goes through, that line just translates to This Site Is Hacked By someone