PunBB Resource

agravetoncas · 2006-05-30 01:56:06

hello everybody,

open include/functions.php
goto :

Code:

function check_cookie(&$pun_user)

find :

Code:

global $db, $pun_config, $cookie_name, $cookie_seed;

replace with :

Code:

global $db, $pun_config, $cookie_name, $cookie_seed, $tmplang;

after:

Code:

    if (isset($_COOKIE[$cookie_name]))
        list($cookie['user_id'], $cookie['password_hash']) = @unserialize($_COOKIE[$cookie_name]);

paste :

Code:

        if (isset($_GET['language']))
                $tmplang =  $_GET['language'] ;
        elseif (isset($_COOKIE['language']))
                $tmplang = $_COOKIE['language'];
        else
                $tmplang = "foo";

find :

Code:

    else
        set_default_user();

replace with :

Code:

    else
        {
        set_default_user();
                if (!@file_exists(PUN_ROOT.'lang/'.$pun_user['language']))
            $pun_user['language'] = $pun_config['o_default_lang'];
                
                setcookie('language', $pun_user['language'], $expire);
        }

goto :

Code:

function set_default_user()

find :

Code:

global $db, $pun_user, $pun_config;

replace with :

Code:

global $db, $pun_user, $pun_config, $tmplang;

find :

Code:

$pun_user['language'] = $pun_config['o_default_lang'];

replace with :

Code:

//$pun_user['language'] = $pun_config['o_default_lang'];
        $pun_user['language'] = $tmplang;

not releasing it as a mod because it is part of a mod i am making.

However, if you think this could cause security issues, please post reply.

Good day.

Last edited by agravetoncas (2006-05-30 07:25:41)

-J- · 2006-06-16 02:30:13

Is there a way to see a demo agravetoncas? I'm pretty interested

Smartys · 2006-06-16 02:44:15

agravetoncas wrote:
However, if you think this could cause security issues, please post reply.

*replies*

agravetoncas · 2006-06-19 06:50:11

Smartys wrote:
agravetoncas wrote:
However, if you think this could cause security issues, please post reply.
*replies*

please make an smart reply
demo can be found on leetnoob.info

Smartys · 2008-02-08 17:48:20

Well, late bump, but allowing users to specify the path to an arbitrary PHP file on a server is a quite huge security flaw.

PunBB Resource

#1 2006-05-30 01:56:06

guest can select $pun_user['language']

Code:

Code:

Code:

Code:

Code:

Code:

Code:

Code:

Code:

Code:

Code:

Code:

#2 2006-06-16 02:30:13

Re: guest can select $pun_user['language']

#3 2006-06-16 02:44:15

Re: guest can select $pun_user['language']

agravetoncas wrote:

#4 2006-06-19 06:50:11

Re: guest can select $pun_user['language']

Smartys wrote:

agravetoncas wrote:

#5 2008-02-08 17:48:20

Re: guest can select $pun_user['language']

Board footer