vBulletin 4, the most powerful community software + vBSEO 3.5, the ultimate SEO solution = Your ultimate platform for 2010 and beyond. Click below to learn more.

Results 1 to 3 of 3

Code Security...

This is a discussion on Code Security... within the Off-Topic & Chit Chat forums, part of the Focus on Members category; Just wanted to get a "once over" by anyone with time. Anything horrible stick out? PHP Code:   <?php  //Load global.php  ...

  1. #1
    Senior Member Citricguy's Avatar
    Real Name
    Josh
    Join Date
    Nov 2006
    Location
    Maui, Hawaii
    Posts
    143
    Blog Entries
    7

    Code Security...

    Just wanted to get a "once over" by anyone with time. Anything horrible stick out?

    PHP Code:
     <?php 
    //Load global.php 
    require_once('./global.php'); 

    //Clean GET variabls 
    $vbulletin->input->clean_array_gpc('g', array( 
    'r' => TYPE_NOHTML
    'g' => TYPE_UINT 
    ));  

    //Login and Redirect 
    if (!is_member_of($vbulletin->userinfo$vbulletin->GPC['g'])) 

        
    print_no_permission(); 
    } else { 
        
    header("Location:"$vbulletin->GPC['r']) ; 

    ?>

  2. #2
    Senior Member briansol's Avatar
    Real Name
    Brian
    Join Date
    Apr 2006
    Location
    Central CT, USA
    Posts
    6,983
    using Get (g) on the $r can be re-directed other than intended...

    ie,

    yoursite.com/thisscript.php?r=http://someothersite.com

    something to consider.

  3. #3
    Senior Member Citricguy's Avatar
    Real Name
    Josh
    Join Date
    Nov 2006
    Location
    Maui, Hawaii
    Posts
    143
    Blog Entries
    7
    Good point, I'm going to force it to only allow redirects to specific domains and directories.

    Thank you yet again!

Similar Threads

  1. Security Hole
    By MaktoobForums in forum Bug Reporting
    Replies: 1
    Last Post: 06-04-2007, 02:53 AM
  2. security?
    By sde in forum General Discussion
    Replies: 8
    Last Post: 07-18-2006, 10:44 PM