Security POT security warning!

Recently it was found, there's an important security hole in POT (for newbies: Gesior/Unnamed AAC uses it) which displays database connection information. Here's a fast solution for XAMPP users from Xampy, which everyone using POT for their AAC should apply:

(...) I will tell you how to prevent hacks in your server:

MySQL Users
Go to C:\xampp\htdocs\pot and open the file OTS_DB_MySQL. Go to line 96~ and:
Change:

        // PDO constructor
        parent::__construct('mysql:' . implode(';', $dns), $user, $password);
    }

with:

        // PDO constructor
	try
	{
		parent::__construct('mysql:' . implode(';', $dns), $user, $password);
	}
	catch(PDOException $error)
	{
		echo 'Can\'t connect to MySQL database.</font>';
			exit;
	}
    }

And save the file.


SQLite Users
Go to C:\xampp\htdocs\pot and open the file OTS_DB_SQLite. Go to line 54~ and:
Change:

        // PDO constructor
        parent::__construct('sqlite:' . $params['database']);

with:

        // PDO constructor
	try
	{
		parent::__construct('sqlite:' . $params['database']);
	}
	catch(PDOException $error)
	{
		echo 'Can\'t connect to SQLite database.</font>';
			exit;
	}

And save the file.

Basicaly, file names DO NOT change if you don't use XAMPP, only path (whats logic, btw...) to POT directory.

 

[LooSik]

Well yes, I've got this fix since ages.

But I'm getting just even more depressed everyday about people's mysql knowledge which is... I won't even comment it.

Even if someone has password, but mysql is set for localhost connections only or mysql port is blocked on firewall, he can do shit

 

[Masiar]

so gesior acc is safe... Check others ;p

;o OMG

 

[Smel]

Thanks a lot!

 

[apitis]

NO! Never do that! Damn how many times it should be told until people will understand. No, it's not POT security leak. It's final scripts (like Gesior AAC, Unnamed AAC) duty to deal with it and they should handle the exceptions! This exception is there for a reason - just to do what it does - inform script that connection failed. It's not POT's fault that authors can't work with exceptions. Fix AAC scripts, not POT code. I recommend to just set exception handler (not best, but least invasive way for current situation):

// handles critical exceptions
function exceptionHandler($exception)
{
    // fatal error, at all only fatals should be catched so far
    // other exceptions will be catched inside try statement and will be displayed in user-friendly site
    die('<pre style="font-weight: bold;">FATAL ERROR: ' . $exception->getMessage() . '</pre>');
}

set_exception_handler('exceptionHandler');

And no, this won't be fixed. This is not a _bug_ - learn how to work with exceptions!

Totally Agree >.>

Gesior AAC is IMHO written very poor : X and should be generally rewritten.

 

[luiskill]

Help I need the complete guide to create since(as,like) the web with sql

 

[Sync]

Thanks Xamppy

 

[Tulucus]

i use xampp... but i can't find
C:\xampp\htdocs\pot........... the pot isn't there

im new at mysql so i don't know really

 

[Lliomex]

Thx. Only Windows?

 

[Zoriath]

i use xampp... but i can't find
C:\xampp\htdocs\pot........... the pot isn't there

im new at mysql so i don't know really

If you don't have Gesior AAC or any other AAC that uses POT then you're fine. Else you'll have to add exeptions to the AAC (like wrzasq said) or you would have to do what Xampy said.

 

[husam]

thanks

 

[BlackDemon]

Totally Agree >.>

Gesior AAC is IMHO written very poor : X and should be generally rewritten.

yeah.. gesior aac sucks..

 

[Zoriath]

yeah.. gesior aac sucks..

I'd like to see you make one yourself, and then make fun of Gesior AAC. I bet you can't, so stfu if you're saying something is bad while you can't do it better yourself.

 

[Artii]

i use xampp... but i can't find
C:\xampp\htdocs\pot........... the pot isn't there

im new at mysql so i don't know really

Then you don't have an AAC with pot, you don't need to change anything.

 

[wlj]

thx..

 

[morov]

What if I got that POT but there isn't that stuff to change from...

Or maybe I am using too "new" stuff so it's different. What to do then?

 

[Erikas Kontenis]

Thanks !!! Rep++

 

[Divinity]

Nice Thanks

 

[szczygiel]

Thanks a lot ! Omg, now i know how a guy hacked my site and everything

hauahuhua sasir noob

 

[Pietia]

hashahaha sasir buahuahuh

 

[Trejo]

ey! thank you very much, for my safety I porfin ot-servers, thank you for all this

Trejo~