[not confirmed yet]Big problem has arised! Security related

This mod will make it posible to specify permissions to all "special pages, like MEMBERLIST, PROFILE VIEW and so on.
The permissions support USERGROUP, making this tool very powerfull

Moderator: Moderators

Forum rules
The content in this forum is dated Dec. 21 2005 and can be used as Archive only. This Forum is LOCKED and READ ONLY !

[not confirmed yet]Big problem has arised! Security related

Postby LaZeR on Thu 31. Jul, 2003 23:43

Although I'm not certain, it would seem that the problem I am currently having very well may be because of this mod. Can't confirm yet though since was just noticed but here goes:

When I go into Admin and try to change a current moderator's privledges all off (All forums), their user level no longer drops in the DB but rather remains = 2 which is moderator status. Their name goes off the list description in the forums BUT the actual user_level status in the database remains 2 thus shows them as a moderator. I confirmed/realized this when I check my staff.php page after removing a certain member's privledges but they retained moderator level 8O = not good

Please confirm if this could be a problem Niels as I fear this poses a bit of security risk to an unknowing Admin. For now I can just manually go into the DB and return the level appropriatly :roll:

I suppose the file admin_ug_auth.php which your mod doesn't touch may possibly need some changes to work properly now?

Possibly due to the '$forum_id' OR if(isset($forum_id)) changes made in other file(s). Please look into this as its currently way over my head but certainly a problem!
LaZeR
Poster
Poster
 
Posts: 94
Joined: Tue 27. Aug, 2002 00:42

Postby LaZeR on Fri 01. Aug, 2003 11:30

Ok, I may have come up with a fix.

Niels Please test or atleast look over this code change/addition and see if you think its alright.

File: admin_ug_auth.php

FIND:

Code: Select all
         $sql = "SELECT *
            FROM " . FORUMS_TABLE . " f
            ORDER BY forum_order";


REPLACE WITH:

Code: Select all
         $sql = "SELECT *
            FROM " . FORUMS_TABLE . " f
            WHERE f.cat_id>0
            $forum_sql
            ORDER BY forum_order ASC";



FIND: (Yes this is 2nd occurence and also needs replaced!)

Code: Select all
   $sql = "SELECT *
      FROM " . FORUMS_TABLE . " f
      ORDER BY forum_order";



REPLACE WITH:

Code: Select all
   $sql = "SELECT *
      FROM " . FORUMS_TABLE . " f
      WHERE f.cat_id>0
      $forum_sql
      ORDER BY forum_order ASC";


Well, maybe this now defeats part of the purpose of this mod as individual user's permissions for the xTra areas can no longer be accessed but for now it fixes what I feel is a MAJOR problem of not being able to revoke a user's MOD status back to normal User Level. Maybe you know another (better) way to fix :?:
LaZeR
Poster
Poster
 
Posts: 94
Joined: Tue 27. Aug, 2002 00:42

Postby Niels on Sun 03. Aug, 2003 02:23

admin_ug_auth.php should not need to be modifyed in my belive, there is not obvius reasoon why only positive cat_id entry should be allwed to be updated.

I haven't confirmed this as potential problem, I will though have to look into this.

after you have preformed the abouve mentioned code, you are able to update your members mod status correctly ? :? and did not before .... ?
I can't really see why this should be the case, as the mod should not behaive in sutch way as this should be nessesary
User avatar
Niels
Poster
Poster
 
Posts: 4390
Joined: Sat 27. Jul, 2002 15:46

Postby Niels on Sun 03. Aug, 2003 02:31

I could not reproduce your problem here on mods.db9.dk, could you provide detaild information about how to make this happen.


I did (to test) made a test user a moderator of some forums (ACP->user permission) after that I inspected the DB and verifyed that the user_level was correctly changed to 2, then I removed the users moderator permissions, and did again go into the DB and manually inspect the user_level, witch in this case was correctly set back to 0
have I miss understod te problem ?, could it be related to other mods you have instaled ?
User avatar
Niels
Poster
Poster
 
Posts: 4390
Joined: Sat 27. Jul, 2002 15:46

Postby LaZeR on Sun 03. Aug, 2003 02:45

Niels wrote:I did (to test) made a test user a moderator of some forums (ACP->user permission) after that I inspected the DB and verifyed that the user_level was correctly changed to 2, then I removed the users moderator permissions, and did again go into the DB and manually inspect the user_level, witch in this case was correctly set back to 0
have I miss understod te problem ?, could it be related to other mods you have instaled ?


Nope you understood perfectly and thats exactly the way I was testing. Only problem is the user would never return to level 0 but rather stayed as 2 , but even when I re-entered ACP - User permissions, no forums listed would remain assigned moderator except when I checked in the database, the user_level always would be 2 for my test user. So after I did my little fix as noted the user can now be set back to level = 0 simply by the normal removal to "Not Moderator" back in the User Permissions.

Note: I even first thought maybe something was overriding like a usergroup assignment, ect... with moderator privledges but this was definetly not the case as this was a plain 'vanilla' user with no other privledges set other than setting "Is moderator" to "Not moderator" in a given forum.

:? - Very weird and doesn't make sense that I had to do this but you say that file requires no modification 8O
LaZeR
Poster
Poster
 
Posts: 94
Joined: Tue 27. Aug, 2002 00:42

Postby Niels on Sun 03. Aug, 2003 11:53

I consider this closed, as I think it is related to your files...?

anyway, if at some point another user (witch also have installed this mod) have the EXACT same problem, I will look deeper into this.

so (to other users) please test this, and report in this thread
User avatar
Niels
Poster
Poster
 
Posts: 4390
Joined: Sat 27. Jul, 2002 15:46

LaZeR Do you have the Super Moderators mod installed

Postby MrStormy on Tue 26. Aug, 2003 17:04

LaZeR Do you have the Super Moderators mod installed by chance?

I have seen the same thing happen, when I had the super Moderators Mod installed, if you do have it, I would bet that is the culprit and not this mod.
MrStormy
Poster
Poster
 
Posts: 19
Joined: Thu 12. Jun, 2003 06:40


Return to Extra permission [2.0.6/EM]

Who is online

Users browsing this forum: No registered users and 1 guest

cron