Hacking on modern...

[kito2]

Then why donating to DEV team if maybe they won't update the source sometime... I know that you are not paying or buying something, but you also can't secure that donating them will be an incentive to keep working on it.

Everything here is distorcioned, people that "donate" to an OT thinks that they are paying to get points, here will happen the same...

For example, people donate to otland to be a premium member and get access to private SVN, but if this private SVN doesn't keep being upgraded daily, then otland won't have more premium members...

Can you get my point? xd

 

[stian]

Yea, I get your point, but well, christiandb and may others want it to change. I don't really care.

 

[Dankoo]

I'm using ModernAAC and I want to be safe.

What a normal human beign can do about it by now, like me?

I didn't open my server yet, still checking things etc, so it would be more of a preventive action... LoL in fact I don't know what scaffolding is, should I disable it to be safer? I've never used it...

 

[kito2]

Like someone said before just set all accounts to page_access = 1

UPDATE accounts SET page_access = 1

And go to system/applications/controllers and remove admin.php, that would be enough... If you want to add news, insert them via phpmyadmin.

 

[Znote]

I believe TFS 0.4 is for premiums only is:
So otland as a forum earns money to keep its hosting up.
So the developers get a nice amount of svn testers. However not as many as the whole world. Having public svn to TFS 0.4 would lead to very much spam and complaints about issues that are being worked on. Witch is why there haven't been an official new release of TFS since TFS 0.3.6pl1 (12th December 2009).

 

[Paxton]

I'm using ModernAAC and I want to be safe.

What a normal human beign can do about it by now, like me?

I didn't open my server yet, still checking things etc, so it would be more of a preventive action... LoL in fact I don't know what scaffolding is, should I disable it to be safer? I've never used it...

Probablz just download 1.0.1 not newest rev.

 

[kito2]

Paxton, so at rev 198+ there is added a "scaffholding" and that's the problem?

 

[Paxton]

Well if someone got access to your admin account, then thats not Modern AAC hole.

 

[kito2]

Now ask yourself and think, if they get access to your admin account via Modern AAC is a Modern AAC hole.

 

[stian]

Yea, it was a security hole, you could run a query on it too i think.


'); DELETE FROM accounts WHERE '1' IN ('1

 

[Paxton]

Now ask yourself and think, if they get access to your admin account via Modern AAC is a Modern AAC hole.

What I meant, is normal access - account/password.

Anyway I will think about whole thing, and the mess as well and I will post soon whats gonna happen

 

[kito2]

Thanks Paxton.

 

[Diazapam]

Just bringing it out their but:
IP range for the accounts with group access > 3 and/or page_access >3?

 

[kito2]

page_access should be lower than 1 for all accounts and remove /www/system/applications/controlers/admin.php