ℹ️
Welcome to the archive of the old FlatPress support forum. Browse more than a decade of FlatPress wisdom! Login is disabled.

The current FlatPress support forum is available here: forum.flatpress.org
Flatpress Authentication Bug!!! Very important!
  • It's very easy becoming admin in FP! I won't publish the exploit (I'll send by PM and mail to NoWhereMan) but I'll post how to solve. Do it immediately. This is the bugged function (fp-includes/core/core.users.php): user_loggedin, from line 77 to line 98: function user_loggedin(){ global $loggedin, $fp_user; if ($loggedin) return $fp_user; if ( empty($_COOKIE[USER_COOKIE]) || empty($_COOKIE[PASS_COOKIE]) ) { $fp_user = null; return $loggedin = false; } $fp_user = user_get($_COOKIE[USER_COOKIE]); if ($fp_user) { $loggedin = ($_COOKIE[PASS_COOKIE] == $fp_user['password']); } return $fp_user; } It returns always the data of the username, it checks the password but it doesn't block the check. The correct code is: function user_loggedin(){ global $loggedin, $fp_user; if ($loggedin) return $fp_user; if ( empty($_COOKIE[USER_COOKIE]) || empty($_COOKIE[PASS_COOKIE]) ) { $fp_user = null; return $loggedin = false; } $fp_user = user_get($_COOKIE[USER_COOKIE]); if (!$fp_user) { return false; } if($_COOKIE[PASS_COOKIE] == $fp_user['password']) { $loggedin = true; return $fp_user; } $loggedin = false; return false; } Per gli utenti italiani (Italian users): c'è la versione in italiano nel mio blog.
  • your suggested fix has been already deployed on sourceforge in 0.1010.1 I'll advertise soon the update on the site, too (the update check should work already) bye
  • It's not because of this bug, it's because your hoster doesn't allow to use cURL with Flatpress Servers or I think so.
  • pierovdfn said:

    It's not because of this bug, it's because your hoster doesn't allow to use cURL with Flatpress Servers or I think so.

    correct
  • ok... There are no jquary and lightbox2 plugin in the flatpress 0.1010.1. It's ok?
  • lantaca said: There are no jquary and lightbox2 plugin in the flatpress 0.1010.1.
    It's ok?

    Sorry, my mistake but... in the maintein page of blog, when you click on link of new version 0.1010.1, the link links (sorry) to the 0.909.1 arioso version :-)
  • I guess one more bug is the terms of service link does not work and was forced to register without having viewed the terms of service. Anyway here I am Costas
  • Is the above mentioned bug all that got fixed with 0.1010.1? I need to know, since I don't upgrade the installed package, but change the code manually. Found no ChangeLog, that describes more than 0.803 (so far that is).
  • it contains any fix between revisions r172-r180 http://flatpress.svn.sf.net/viewvc/flatpress/trunk/?view=log
  • Thanks! (Especially for the subversion-Link.)
  • Add a Comment
    Start a New Discussion

    Howdy, Stranger!

    It looks like you're new here. If you want to get involved, click one of these buttons!

    Categories

    In this Discussion