admin.php security hole

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

I've just written and implemented our new admin.php security hole patch. I've tested it and it seems to work, so I'm having my staff continue testing. If all goes well I'll release it tomorrow. So consider this a heads up!

Lieutenant Joined: Jul 14, 2003 Posts: 153

Thanks ZX for the heads up and hard work you always put in for us.

Posted: Sun Oct 12, 2003 7:42 pm

The code posted in the frontpage article is incorrect because of Nuke's filtering so it's best if it's placed here.

Code:

$checkmyurl = getenv("REQUEST_URI");

if (preg_match("/\?admin/", "$checkmyurl")) {
echo "die - see nukecops.com";
exit;
}

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

Thanks for saving my butt there CS. Yes, the PHP-Nuke news filtering does filter out required characters.

Nuke Cadet Joined: Oct 12, 2003 Posts: 4

I added the code and now I can't add a new block with a RSS feed. It complains about the URL. Can somebody sanity check this for me? I'll post more details if nobody can reproduce the error by default.

--------------

There is a problem with the RSS file URL

Please check the URL and RSS file name, then try again.

--------------------

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

Hi'ya sanity check has been completed on several PHP-Nuke websites and all has been fine. Please insert the code into your admin.php. Otherwise, please post exactly where you placed it in your code.

Corporal Joined: Oct 01, 2003 Posts: 59

So does it go like this?

<?php

$url = getenv("REQUEST_URI");

if (preg_match("/\?admin/", "$url")) {
echo "die";
exit;
}
require_once("mainfile.php");
get_lang(admin);

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

Yes that is correct.

Corporal Joined: Oct 01, 2003 Posts: 59

Ok just making sure.. site seems to be ok with that code in there..

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

Yes it will be good with that code.

Nuke Cadet Joined: Oct 12, 2003 Posts: 4

chatserv pegged it. That's the bugger.

Corporal Joined: Oct 01, 2003 Posts: 59

tinjaw thats only if you are using rss correct? use the code chatserv posted?

Nuke Soldier Joined: Oct 13, 2003 Posts: 22

Also Nuke 6.0?

Nuke Cadet Joined: Oct 12, 2003 Posts: 4

speedx: If you attempt to add a block and that block is a custom block based on a RSS feed, the code that checks the URL also uses the $URL variable. This causes a conflict. Therefore the security fix needs to use a variable named something other than $URL to be backward compatible.

Corporal Joined: Oct 01, 2003 Posts: 59

roger that ..