[Fixed]: Vbulletin 4.0 with cpg 1.4.25 - Page 2 [Fixed]: Vbulletin 4.0 with cpg 1.4.25 - Page 2
 

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Main Menu

[Fixed]: Vbulletin 4.0 with cpg 1.4.25

Started by alfisti.net, December 24, 2009, 01:43:07 PM

Previous topic - Next topic

0 Members and 2 Guests are viewing this topic.

phill104

Codjo (Jochen {aka Miski}) and Paul M

Thank you for your contribution. As far as I know none of us have Vbulletin so we are unable to test the fix ourselves. Hopefully Paul (who appears to part of the Vb team) has tested and confirmed the fix. If it does indeed work I am sure our users will be pleased. The bridge appears to be functioning at Jochen's site running CPG 1.4.25.
It is a mistake to think you can solve any major problems just with potatoes.

Joachim Müller

Yes, thank you all.
If this can be confirmed by a member of the vB staff or enough "regular" vB users we will come up with a separate bridge file for vB4 and the corresponding options populated inside the bridge manager for the next Coppermine release.

phill104

I have now managed to test this and it seems to be working fine on my test machine. Paul M also appears to be a member of the Vb team from his profile on the Vb forums.
It is a mistake to think you can solve any major problems just with potatoes.

Paul M

You dont need a seperate bridge, just something like this in your code to get the session id


$sessionid = $_COOKIE[$prefix . '_sessionhash']; // 4.0.1 +

if (empty($sessionid))
{     // 4.0.0 or before
      $sessionid = $_COOKIE[$prefix. 'sessionhash'];
}


:)

Joachim Müller

Thanks for the update. I have edited bridge/vbulletin30.inc.php and replaced // definition of how to extract id, name, group from a session cookie
function session_extraction()
{
if (isset($_COOKIE[$this->cookie_name . 'sessionhash'])) {
$session_id = addslashes($_COOKIE[$this->cookie_name . 'sessionhash']);

$sql = "SELECT u.{$this->field['user_id']}, u.{$this->field['password']}, u.{$this->field['grouptbl_group_id']}+100 AS usergroupid FROM {$this->usertable} AS u, {$this->sessionstable} AS s WHERE s.{$this->field['user_id']}=u.{$this->field['user_id']} AND s.sessionhash='$session_id'";

$result = cpg_db_query($sql, $this->link_id);

if (mysql_num_rows($result)){
$row = mysql_fetch_array($result);
return $row;
} else {
    return false;
}
}
with // definition of how to extract id, name, group from a session cookie
function session_extraction()
{
if (isset($_COOKIE[$this->cookie_name . '_sessionhash'])) {
    $session_id = addslashes($_COOKIE[$this->cookie_name . '_sessionhash']);
} elseif (isset($_COOKIE[$this->cookie_name . 'sessionhash'])) {
    $session_id = addslashes($_COOKIE[$this->cookie_name . 'sessionhash']);
}
if (isset($session_id)) {
$sql = "SELECT u.{$this->field['user_id']}, u.{$this->field['password']}, u.{$this->field['grouptbl_group_id']}+100 AS usergroupid FROM {$this->usertable} AS u, {$this->sessionstable} AS s WHERE s.{$this->field['user_id']}=u.{$this->field['user_id']} AND s.sessionhash='$session_id'";

$result = cpg_db_query($sql, $this->link_id);

if (mysql_num_rows($result)){
$row = mysql_fetch_array($result);
return $row;
} else {
    return false;
}
}
}
I am attaching the modified file to this posting (just download, then rename from vbulletin30.inc.php.txt back to vbulletin30.inc.php and replace your copy with the modified file). Please report if this works as expected.

Joachim Müller

Please confirm - I'd like to see this fix included with the upcoming maintenance release cpg1.4.26, which I can only do if someone confirms my suggestion.

phill104

I can test it tomorrow. I don't have vB but a mate in the office does and I can test on his machine.
It is a mistake to think you can solve any major problems just with potatoes.

Joachim Müller

OK, thanks. I'm looking forward to your report. Cheers  ;D

alfisti.net

Quote from: Joachim Müller on January 31, 2010, 03:06:29 PM
Please confirm
Thank you Joachim :)
This works (as expected) fine :) with vB 4.01 and coppermine 1.4.25
(tested in a already installed version, not with the install function)

Joachim Müller

Phill,

did you have the chance to test the modified bridge file out?

Cheers

Joachim

phill104

I've tried with vB3.8.4 and 4.01 and the bridge works as expected. Well done on adding it to 1.4.26 :)
It is a mistake to think you can solve any major problems just with potatoes.