Question Question
 

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Main Menu

Question

Started by cmfa, February 15, 2011, 01:17:41 PM

Previous topic - Next topic

0 Members and 3 Guests are viewing this topic.

cmfa

Hi,

I would like to port just an another plugin from 1.4. The following is found here.

if (count($_POST) > 0)

What do here in $superCage->post->
   
or something else??

VG
CMFA


Αndré

It's not possible to translate that statement in the 'clean' way, but only in the way that circumvents Inspekt's security mechanisms. Try if it works when you replace
if (count($_POST) > 0)
with
if (count($superCage->post->_source) > 0)


A much better way would be to check if a specific post value has been submitted.

phill104

CMFA,

Could you use more meaningful titles for your threads. Simple titles like "Question" make it a lot harder for us. Thanks and keep up the good work.
It is a mistake to think you can solve any major problems just with potatoes.

cmfa

Hi,

I will make, excuse ;)

VG

CMFA

cmfa

Hi

Andre:
how it should look like then? An excerpt of the code at issue, see below.
It is plug-in "PMS" by Stramm
I miss somehow still in my gallery.

if (count($superCage->post->_source) > 0) {
    if (isset($_POST['update_config'])) {


        // Code to rename system thumbs in images folder
        $old_thumb_pfx =& $CONFIG['thumb_pfx'];

        foreach($lang_pms_admin_data as $element) {
            if ((is_array($element))) {
                if (!isset($_POST[$element[1]])) /*cpg_die(CRITICAL_ERROR, "Missing admin value for '{$element[1]}'", __FILE__, __LINE__);*/ continue;
                $value = addslashes($_POST[$element[1]]);
                if ($CONFIG[$element[1]] !== stripslashes($value))
                     {
                        cpg_db_query("UPDATE {$CONFIG['TABLE_CONFIG']} SET value = '$value' WHERE name = '{$element[1]}'");
                         if ($CONFIG['log_mode'] == CPG_LOG_ALL) {
                                log_write('CONFIG UPDATE SQL: '.
                                          "UPDATE {$CONFIG['TABLE_CONFIG']} SET value = '$value' WHERE name = '{$element[1]}'\n".
                                          'TIME: '.date("F j, Y, g:i a")."\n".
                                          'USER: '.$USER_DATA['user_name'],
                                          CPG_DATABASE_LOG
                                          );
                        }
                }
            }
        }
        pageheader($lang_admin_php['title']);
        msg_box($lang_admin_php['info'], $lang_admin_php['upd_success'], $lang_continue, 'index.php');

    }
    pagefooter();
    exit;
}

Any change I make breaks the subject, so that only see the debugger.

CMFA

Αndré

Please always post the whole plugin as zip file if you have such specific questions. There are still some occurrences of $_POST that needs to be replaced.

cmfa

hi
Attached is the zip file, it is still rudimentary in the porting

CMFA

Αndré

Quote from: Αndré on February 15, 2011, 06:15:35 PM
There are still some occurrences of $_POST that needs to be replaced.

I won't have a look at the plugin until I know what exactly doesn't work.

cmfa

Hi,
recorded in the above code, I have replaced $ _POST in eg $ super cage-> post-> and then save the changes when
the form is all gone (only debugger is there). here it seems to pinch something.

CMFA

Quote from: cmfa on February 15, 2011, 05:30:11 PM
if (count($superCage->post->_source) > 0) {
    if (isset($_POST['update_config'])) {


        // Code to rename system thumbs in images folder
        $old_thumb_pfx =& $CONFIG['thumb_pfx'];

        foreach($lang_pms_admin_data as $element) {
            if ((is_array($element))) {
                if (!isset($_POST[$element[1]])) /*cpg_die(CRITICAL_ERROR, "Missing admin value for '{$element[1]}'", __FILE__, __LINE__);*/ continue;
                $value = addslashes($_POST[$element[1]]);
                if ($CONFIG[$element[1]] !== stripslashes($value))
                     {
                        cpg_db_query("UPDATE {$CONFIG['TABLE_CONFIG']} SET value = '$value' WHERE name = '{$element[1]}'");
                         if ($CONFIG['log_mode'] == CPG_LOG_ALL) {
                                log_write('CONFIG UPDATE SQL: '.
                                          "UPDATE {$CONFIG['TABLE_CONFIG']} SET value = '$value' WHERE name = '{$element[1]}'\n".
                                          'TIME: '.date("F j, Y, g:i a")."\n".
                                          'USER: '.$USER_DATA['user_name'],
                                          CPG_DATABASE_LOG
                                          );
                        }
                }
            }
        }
        pageheader($lang_admin_php['title']);
        msg_box($lang_admin_php['info'], $lang_admin_php['upd_success'], $lang_continue, 'index.php');

    }
    pagefooter();
    exit;
}


Αndré

I still don't know what happens when. Keep in mind that we (may) don't know the plugin you're trying to port. I personally never used that plugin, so I don't know what you can do. That's why I need a description how I can reproduce the error on my testbed.

cmfa

   
Hi,.
in this piece of code I $_Post exchanged. Save the form read easily. Make changes in the form and gone on save. Then only the debugger was without any reference to the index page and on the subject.

I still don't know what here exactly
if (isset($_POST['update_config'])) { or here

if (!isset($_POST[$element[1]])) or here

$value = addslashes($_POST[$element[1]]);

must be exchanged.

like to use my test system where it is installed. I make you an admin access a.

CMFA

Αndré

isset($_POST
can be replaced by
->post->keyExists

addslashes($_POST
can be replaced by
->post->getEscaped

cmfa

Hi,
   
There is one small change lacked yet. Still _source had must install. The initial configuration can be changed using the form. However, this change via the called form can be undone. But the same code is called.

CMFA