Gesior, guilds.php exploits (Tell me)

[LucasFerraz]

Hello,
This is my guilds.php.
I'm using Gesior AAC (Gesior-AAC 0.5.1.tar.gz), I found in otland.net that there are some exploits in guilds.php of Gesior.
1. Is this true?
2. How to protect it?
3. What can this exploits make?

After a long search in BR Forums I found it:
"If you disband guild(in website) and relog your character will receive a Rollback(exploit), then you can duplicate items.
PS.: There is no guilds in-game.

 

[Linken93]

Just remove commands for creating guilds ingame.

 

[LucasFerraz]

There is not guilds in-game.

 

[Linken93]

Are you using TFS 0.4?

 

[Cykotitan]

probably no. it's only for ingame disband command.

one of the vulnerabilities are uploading guild logos, it can be abused on nginx that's using php-cgi

 

[LucasFerraz]

@Linken93
I'm using dev 0.4, 3884.


@Cykotitan
How can I do that?

 

[Cykotitan]

you didn't understand me

 

[LucasFerraz]

Oh, sorry, I understand now, can you tell me how to fix that?



I've found that: http://otland.net/f118/gesior-aac-how-block-noob-hackers-36511/.
Which code is the best? Xampy or Gesior's code?

 

[Korrex]

Oh, sorry, I understand now, can you tell me how to fix that?



I've found that: http://otland.net/f118/gesior-aac-how-block-noob-hackers-36511/.
Which code is the best? Xampy or Gesior's code?

Seriously, whos do you think? If Gesior made the guilds.php he must have forgot about the exploit, so his code probably has it...

 

[Cykotitan]

you should patch your code with that or else someone will see your password when there's a database error

 

[LucasFerraz]

I still don't understand
1. Which code is the best? Xampy or Gesior's code?
2. How can I protect this "one of the vulnerabilities are uploading guild logos, it can be abused on nginx that's using php-cgi"?

 

[Cykotitan]

are you using nginx as webserver?

 

[LucasFerraz]

I'm using Xampp for Windows, Version 1.7.3

Which code is the best? Xampy or Gesior's code?

 

[Cykotitan]

I'm using Xampp for Windows, Version 1.7.3

then why are you asking how to protect yourself? i said only nginx is affected

 

[LucasFerraz]

Oh, sorry and Thanks!

Can you tell me which code is the best? Xampy or Gesior's code(found here)?

 

[LucasFerraz]

Which code is the best? Xampy or Gesior's code(found here)?

 

[Cykotitan]

if gesior's code was the "best" one, then why would xampy create that thread? use you head

 

[LucasFerraz]

Xampy is the safer? XD