Configuration Gesior AAC Exploits! [All Versions]

[Budyn]

well problem is only on ngix ?

Yes, this problem is only in nginx php parser.

;ss

 

[Paxton]

Yes, i create with widnet new custom project hardened gesior AAC. I need great ideas, and creative people.

what? :huh:

 

[Mazen]

Solution for guilds.php

Replace:

$guild_logo = $guild->getCustomField('logo_gfx_name'); if(empty($guild_logo) || !file_exists("guilds/".$guild_logo)) $guild_logo = "default_logo.gif";

With this:

foreach (array("/", "\\", "..") as $char) {
	$guild_logo = str_replace($char, "", $guild->getCustomField('logo_gfx_name'));
}
if (empty($guild_logo) || !file_exists("guilds/".$guild_logo)) {
	$guild_logo = "default_logo.gif";
}

This will remove "/", "\" and ".." from the guild_logo name. Now it should be impossible to hack gesiors AAC through guilds.php this way.

Credits to stian for the idea.


Concerning Gesiors AAC in general, I think it's the worst scripted and screwed up project ever. No offense to Gesior, he helped a lot of people. But it's still a dangerous cancer in the OT community. People wont leave it because no one is doing anything better. Talaturens CMS is a good start, but it's still incomplete. It doesn't have all the features that Gesiors AAC has.

Imo, get rid of this AAC. Stop scripting new features for it. Move on to something better.

 

[Paxton]

Solution for guilds.php

Replace:

$guild_logo = $guild->getCustomField('logo_gfx_name'); if(empty($guild_logo) || !file_exists("guilds/".$guild_logo)) $guild_logo = "default_logo.gif";

With this:

foreach (array("/", "\\", "..") as $char) {
	$guild_logo = str_replace($char, "", $guild->getCustomField('logo_gfx_name'));
}
if (empty($guild_logo) || !file_exists("guilds/".$guild_logo)) {
	$guild_logo = "default_logo.gif";
}

This will remove "/", "\" and ".." from the guild_logo name. Now it should be impossible to hack gesiors AAC through guilds.php this way.

Credits to stian for the idea.


Concerning Gesiors AAC in general, I think it's the most bad scripted and screwed up project ever. No offense to Gesior, he helped a lot of people. But it's still a dangerous cancer in the OT community. People wont leave it because no one is doing anything better. Talaturens CMS is a good start, but it's still incomplete. It doesn't have all the features that Gesiors AAC has.

Imo, get rid of this AAC. Stop scripting new features for it. Move on to something better.

There is already my AAC maker in development, which could be already used but it's not fully finished, there is also Marlex AAC which will be relased soon. So there will be 2 good AAC makers to choose from.

 

[Mazen]

There is already my AAC maker in development, which could be already used but it's not fully finished, there is also Marlex AAC which will be relased soon. So there will be 2 good AAC makers to choose from.

That sounds really good. I hope these 2 will replace Gesiors AAC completely.

 

[Red]

Updated the first page.
Thank you Mazen/stian!

Red

 

[Kekox]

Yes, i create with widnet new custom project hardened gesior AAC. I need great ideas, and creative people.

Well I dont think people would trust you and download your "new project"... I wouldnt

 

[Korrex]

Thanks for allowing the community to know about this exploit. Just replaced the code with Mazens code .

 

[trou]

Well I dont think people would trust you and download your "new project"... I wouldnt

ye? why do people still trust widnet? ...

 

[Paxton]

ye? why do people still trust widnet? ...

Because everyone is using Gesior and they think 'oh, everyone is using it, it must be safe!'

 

[Dulin]

Because everyone is using Gesior and they think 'oh, everyone is using it, it must be safe!'

Yes, Gesior never be safe without anti stupid people system.

 

[stian]

Well, I wrote (as a joke tho) that they should have a IQ test as part of the installation process. When thinking some extra about it; it might solve some issues.

 

[trou]

Because everyone is using Gesior and they think 'oh, everyone is using it, it must be safe!'

It was rhetorical question my Phpized Almost seXy Thin Overall Nice Polish Boy

 

[Paxton]

Well, I wrote (as a joke tho) that they should have a IQ test as part of the installation process. When thinking some extra about it; it might solve some issues.

I will include that into my AAC Maker! :$eace:


@up

sexxyy

 

[sorcerers king]

Thanks <3

 

[zakius]

well, two nice aacs will be great, but fixing gesior wont hurt too I think(all the time before new ones release gesior will be used so...)
but well, I guess no svn should be used, just this topic with: bug and ideas how to solve it(just if you found anythink or know how to fix some known bug post it)(whole community projects that YOU re updating with new features YOURSELF are probably most safe etc)

signatur.php and the eq shower script, too.

What do you mean by eqshower?(I guess in sig you mean using the get as char name? but in eqshower I cannot find anything)

 

[Kekox]

i thought you were the fool, since you were hax recently be careful with exploits

Ye, also you were fooled too cuz your "team" is adding exploit you gesior aac so they can hack any server without including you. I got fooled once but you're being fooled right now and more and more by the day..

 

[Red]

ye? why do people still trust widnet? ...

Who here said they trust widnet?

Red

 

[Mazen]

well, two nice aacs will be great, but fixing gesior wont hurt too I think(all the time before new ones release gesior will be used so...)
but well, I guess no svn should be used, just this topic with: bug and ideas how to solve it(just if you found anythink or know how to fix some known bug post it)(whole community projects that YOU re updating with new features YOURSELF are probably most safe etc)

What do you mean by eqshower?(I guess in sig you mean using the get as char name? but in eqshower I cannot find anything)

The Gesiors AAC code is too messy to be fixed. The whole project is one huge mess.

 

[MxSoft]

:O i use Gesior acc , when the news Acc will be launched?