News & Story bug [7.7/ 7.8/ - plain & patch 2.3.1]

Posted: Sun Sep 04, 2005 12:28 am

Have you ever added categories in "News" admin?

Only "Articles" & "News" are allowed. The others are not.
I traced HTTP::POST and found $title variable is replaced with a string "News." Therefore, except for the predefined category "Articles," all categories you are trying to add are "News." because $title is always $title = "News."

I hope that this bug appears in my case. But, I tested several times with 7.7/ 7.8/ with security patch 2.3.1. Still my case was wrong.

Fixation:

Code:

# ---- [ OPEN ] -----
#
Open /modules/News/admin/index.php file

# ---- [ FIND ] ------
#
# comments: under function AddCategory() function
#
   echo "<center><font class=\"option\"><b>"._CATEGORYADD."</b></font><br><br><br>"
   echo "<center><br>"
   ."<form action=\"".$admin_file.".php\" method=\"post\">"
   ."<b>"._CATNAME.":</b> "
   ."<input type=\"text\" name=\"titlex\" size=\"40\" maxlength=\"40\"> "
   ."<input type=\"hidden\" name=\"op\" value=\"SaveCategory\">"
   ."<input type=\"submit\" value=\""._SAVE."\">"
   ."</form></center>";
#
# --- [ FIND, INLINE ] -------
#
."<input type=\"text\" name=\"title\" size=\"40\" maxlength=\"40\"> "

#
# --- [ REPLACE, WITH] ------
#
."<input type=\"text\" name=\"cat_title\" size=\"40\" maxlength=\"40\"> "

#
# ---- [ FIND ] -----
#
   case "SaveCategory":
   SaveCategory($title);
   break;
#
# ---- [ FIND, INLINE] ------
#
SaveCategory($title);

#
# ----- [ REPLACE, WITH ] -------
#
SaveCategory($cat_title);

#
# ---- EFX
#

Posted: Sun Sep 04, 2005 1:07 am

Great minds think alike Xyberian. I posted this same fix yesterday:
http://www.nukecops.com/postlite46612-.html. Hopefully between us we may get the PHP-Nuke coders to fix this in the next release of PHP-Nuke.

Posted: Sun Sep 04, 2005 1:29 am

Sure, arnold.

Site Admin Joined: Aug 17, 2003 Posts: 12388

3rd confirmation, thanxs guys. We'll make it into the next Patched files