How to prevent CPG1.3.2 access UNLESS inside pnCPG / postnuke How to prevent CPG1.3.2 access UNLESS inside pnCPG / postnuke
 

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Main Menu

How to prevent CPG1.3.2 access UNLESS inside pnCPG / postnuke

Started by Beyond_Doubt, December 23, 2004, 12:03:06 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

Beyond_Doubt

Hi,
How can I prevent access either directly to the stand alone install of CPG1.3.2, or through the use of a Right-Click 'Open in new window' situation?

Thanks in advance.

Joachim Müller

hm, not really. There are some JavaScript tricks you could do that checks the parent frame of the window: if the parent frame equals the current frame, you could make the page reload (redirecting to the nuked site). I wouldn't advice to do so, visitors usually have a reason for opening a frame in a new window.

Joachim

Beyond_Doubt

Ah. Well as I intended to use a postnuke mod that required all users to be authorized before viewing the gallery at all, then this seems to make this combination useless to me. Wish I'd asked before spending a few days setting things up :(
As it stands even an un-reged person could open the link the gallery bypassing the postnuke 'security'; which is not good enough as I am intending to keep the gallery totally private unless granted admin access.

So it looks like I need a full module application.

Back to CPGNuke then, and trying to existing convert phpnuke to work.

casNuy

No problem, there is a solution to this  (actually thought this was also available in the readme that comes with pncpg):

Only PostNuke access
====================
In addition one needs to change a few files in Coppermine to have people always routed through pnCPG.
Insert the following code :
if (!USER_ID) cpg_die(ERROR, '<a href=../index.php?module=pnCPG&func=main target=_top>Click here to access the Gallery</a>', __FILE__, __LINE__);
into the following files :
index.php, thumbnails.php, search.php, dispaly(image/card).php and showthumb.php
Insert this code just after :
require('include/init.inc.php');

enjoy,
Cas

Beyond_Doubt

That's excellent, I'll try that tomorrow :)
Grateful to you that the days of work aren't being lost.