XOOPS 2.0.7.3 released! - XOOPS - XOOPS News - XOOPS Web Application System

XOOPS

News

News World of XOOPS Developers Hacks Themes Archive Submit News

XOOPS: XOOPS 2.0.7.3 released!

Posted by: onokazuOn 2004/9/11 12:45:33 19161 reads

XOOPS Team is pleased to announce the release of XOOPS 2.0.7.3. It includes a fix for a security bug that allowed hijacking of session variables in a certain circumstance, even with 2.0.7.2. It is strongly recommended that all users using any of the previous versions of XOOPS including 2.0.7.2 upgrade to this latest version.

Changes
===============================
!! SECURITY FIX !! fixed more bugs that allowed session hijacking under a certain circumstance (Onokazu)

For new users, there is a full package of 2.0.7.3 available for download both in zip and tar.gz formats.
For users currently running 2.0.7.1/2.0.7.2, extract xoops-2.0.7.x_to_2.0.7.3.zip or xoops-2.0.7.x_to_2.0.7.3.tgz and just overwrite the old files with the new ones.
For users currently running 2.0.7, extract xoops-2.0.7_to_2.0.7.3.zip or xoops-2.0.7_to_2.0.7.3.tgz and just overwrite the old files with the new ones.

The comments are owned by the author. We aren't responsible for their content.

Re: XOOPS 2.0.7.3 released!

Chappy Published 09/11/2004 13:06 Friend of XOOPS Joined 12/14/2002 Comments 456

My thanks to you folks for staying on top of this. I suspect that somebody put in some unexpected time to make sure that this got fixed. I'm grateful. OMRTLX (One More Reason To Love Xoops)!

Re: XOOPS 2.0.7.3 released!

Lance_ Published 09/11/2004 13:15 Home away from home Joined 01/12/2004 Comments 983

Man, I just went through my themes and changed the "Powered by Xoops" line to 2.0.7.2 yesterday.

Now I have to do it all again!!!!

Re: XOOPS 2.0.7.3 released!

m0nty Published 09/11/2004 13:31 XOOPS is my life! Joined 10/24/2003 Comments 3337

lol i'd just done the editing for IPB modules for 2.0.7.2 lol

oh well, its only 1 file to edit.. keep up the good work.. :)

incidentally, on the homepage. The XOOPS 2.0.7.3 [News] in red, takes you to the 2.0.7.1 news and not the 2.0.7.3 news..

Re: XOOPS 2.0.7.3 released!

DonXoop Published 09/11/2004 13:54 Joined 11/27/2003 Comments 1171

I'm always happy to see security fixes. Thanks again for the update(s)

A note to sites using the Remember Me hack/option, you will want to uncomment the "Autologin" section of include/common.php to make it work properly.

Also, I'd like to see some listings of security violation attempt lines to look for in the server logs. I like to look for these attempts so I have an idea of the activity. If I knew more of them I can grep the logs and know when and how often they occur.

Re: XOOPS 2.0.7.3 released!

JMorris Published 09/11/2004 15:54 XOOPS is my life! Joined 04/11/2004 Comments 2722

Nice Work Guys! Yet more proof that XOOPS is the most stable/secure CMS around. I'm especially pleased to see that you've released a full package with all the updates included. Keep up the diligence!

One note though: Are there anymore updates expected this week? I'm scambling to updating all my client's sites. J/k

Seriously thought, thanks for making it soooo easy to apply updates. Other CMSs I've used are a nightmare to update. XOOPS is smooth like buttah.

Re: XOOPS 2.0.7.3 released!

smdcom Published 09/11/2004 16:06 Joined 04/27/2004 Comments 901

what a quick upgrade.. i just upgrade to 2.0.7.2.. less than 24 hrs, new version release... great job guys! thank u so much!

XOOPS Malaysia Team!
http://www.xoopsmalaysia.org

Re: XOOPS 2.0.7.3 released!

AndyM Published 09/11/2004 17:18 Quite a regular Joined 08/31/2003 Comments 296

Personally, I prefer to not advertise the exact version of XOOPS (or any other web app, like phpBB, for that matter) as a potemtial hacker just needs to look up bug tracking lists to see what exploits may be available for that version.

Call me paranoid if you wish, but why make it easier for them?

Re: XOOPS 2.0.7.3 released!

sbkiller Published 09/11/2004 17:38 Just can't stay away Joined 06/09/2004 Comments 461

O, again critical update!

Re: XOOPS 2.0.7.3 released!

DonXoop Published 09/11/2004 17:45 Joined 11/27/2003 Comments 1171

Quote:

Personally, I prefer to not advertise the exact version of XOOPS

The version isn't shown on a running site by default. Only admin can see what version is running. Plenty of 3rd party modules show their version which isn't always wise however.

If you mean showing the version here in the news and Downloads area it has to be or nobody will know what they might need. No secrets there.

I'm all for public posting of security issues and their fixes. Crackers have their own ways to know and I don't want to be the last to know....

Quote:

O, again critical update!

Good thing that and great that it gets fixed. I'd be more worried if critical issues were found every week but that isn't the case...

Re: XOOPS 2.0.7.3 released!

AndyM Published 09/11/2004 18:00 Quite a regular Joined 08/31/2003 Comments 296

Quote:

The version isn't shown on a running site by default. Only admin can see what version is running. Plenty of 3rd party modules show their version which isn't always wise however.

Yeah, but there are some people who do change this (as mentioned in the comments above), and some other web based applications do show the version being used as a default.

Quote:

If you mean showing the version here in the news and Downloads area it has to be or nobody will know what they might need. No secrets there.

No, I just meant for the application being used on a site, not the downloads itself.

Quote:

I'm all for public posting of security issues and their fixes. Crackers have their own ways to know and I don't want to be the last to know....

As am I - as long as the developer has been notified beforehand and has been given chance to fix the problem before details of the exploit has been released...

At the end of the day, not showing the exact version of XOOPS, phpBB or whatever is not going to stop exploits from being, erm, exploited, but it does mean any cracker or script kiddie, or whoever will have to work a little harder.

Re: XOOPS 2.0.7.3 released!

irmtfan Published 09/11/2004 19:11 Updated 09/11/2004 19:21 Module Developer Joined 12/07/2003 Comments 3419

i am use auto login hack so i want to change commom.php file and i think i must only add this code to my old commom.php :

 // security fix for register_globals on 
    if (ini_get('register_globals') == 1) { 
        foreach (array_keys($_SESSION) as $session_key) { 
            unset($HTTP_GET_VARS[$session_key], $HTTP_POST_VARS[$session_key], $HTTP_COOKIE_VARS[$session_key], $_GET[$session_key], $_POST[$session_key], $_REQUEST[$session_key], $_COOKIE[$session_key]); 
        } 
    }

am i right?
regards

Re: XOOPS 2.0.7.3 released!

GIJOE Published 09/11/2004 20:25 Updated 09/11/2004 20:40 Quite a regular Joined 08/13/2003 Comments 265

Quote:

i am use auto login hack so i want to change commom.php file and i think i must only add this code to my old commom.php :
// security fix for register_globals on if (ini_get('register_globals') == 1) { foreach (array_keys($_SESSION) as $session_key) { unset($HTTP_GET_VARS[$session_key], $HTTP_POST_VARS[$session_key], $HTTP_COOKIE_VARS[$session_key], $_GET[$session_key], $_POST[$session_key], $_REQUEST[$session_key], $_COOKIE[$session_key]); } }

am i right?

No.
There is more important patch added in near top of include/common.php.

 if (!defined("XOOPS_MAINFILE_INCLUDED")) { 
    exit(); 
} else { 
[color=ff0000]    // 2004/9/11 temporary fix to prevent session hijacking.  
    foreach ($_REQUEST as $k => $v) { 
        if (false !== strpos($k, '_SESSION')) { 
            header('Location: '.XOOPS_URL.'/'); 
            exit(); 
        } 
    }[/color] 
    // ############## Activate error handler ##############

If you want to patch manually, don't forget 2 patches are needed.

p.s. auto-login hacked files for 2.0.7.3 has been just released.

Re: XOOPS 2.0.7.3 released!

GIJOE Published 09/11/2004 20:38 Quite a regular Joined 08/13/2003 Comments 265

Quote:

A note to sites using the Remember Me hack/option, you will want to uncomment the "Autologin" section of include/common.php to make it work properly.

For enabling Rememberme, commenting out is not a good way.
commented-out codes are too old (I made in 2.0.3) and not so secure.

A) The cookie's path is root (='/'). This cause a collision of the cookies from two XOOPS sites running on the same hostname.

B) This hack weakens XOOPS from CSRF attack. (Some modules are defenseless from CSRF. They delete or update its records by GET methods easily.)

To prevents from CSRF, my autologin codes force redirection to XOOPS_URL when query is not null.

C) The old hack harms customized session.

I recommend the latest autologin patch to you.

Quote:

Also, I'd like to see some listings of security violation attempt lines to look for in the server logs. I like to look for these attempts so I have an idea of the activity. If I knew more of them I can grep the logs and know when and how often they occur.

Perhaps, it is non sense to check access log of httpd.
That's because the session hijacking attacks via POST.

If you want to log some attacks, I recommend Xoops Protector to you.

I also recommend it to Xoopsers who can't upgarde his/her core version immediately with some reasons.

Of course, I believe XOOPS Protector must be useful all users of 2.0.7.3 and later for its security.

Re: XOOPS 2.0.7.3 released!

YourHelp Published 09/12/2004 3:03 Friend of XOOPS Joined 06/09/2003 Comments 479

Another upgrade wow. I just upgraded to 7.0.7.1 here we go again!!! Good work guys.

Re: XOOPS 2.0.7.3 released!

file2mail Published 09/12/2004 7:03 Updated 09/12/2004 7:05 Just popping in Joined 05/23/2004 Comments 27

hmm... were the comments from teh 2.0.7.2 news release deleted? ...

any ways ill reask this...

since its really only updating the common.php file... only one... do i need to click update for the system module in the admin menu???
or should i be okay with just replacing the common.php and version.php files?

Thanks

Re: XOOPS 2.0.7.3 released!

Mithrandir Published 09/12/2004 8:50 XOOPS is my life! Joined 06/21/2003 Comments 6320

Quote:

since its really only updating the common.php file... only one... do i need to click update for the system module in the admin menu???
or should i be okay with just replacing the common.php and version.php files?

No, you do not need to update the system module as it is a code-level update and does not interfere with the database.

Re: XOOPS 2.0.7.3 released!

Nick- Published 09/13/2004 7:24 Just popping in Joined 07/23/2004 Comments 24

Quote:

p.s. auto-login hacked files for 2.0.7.3 has been just released.

Where? I couldn't find it on IT-HQ or the downloads section of this site, though I may be blind :(

Nick

Re: XOOPS 2.0.7.3 released!

djixas Published 09/13/2004 11:41 Just popping in Joined 12/28/2003 Comments 49

Is there any word warap or somethins? :( Because now i am seeing long long lines...

Re: XOOPS 2.0.7.3 released!

Mithrandir Published 09/13/2004 12:07 XOOPS is my life! Joined 06/21/2003 Comments 6320

text within [code] tags is not wrapped, so GIJOE's long code-line is widening the table as a whole.

Re: XOOPS 2.0.7.3 released!

JMorris Published 09/13/2004 15:58 XOOPS is my life! Joined 04/11/2004 Comments 2722

Quote:

Poster: Mithrandir Posted: 2004/9/13 8:07:50

text within [code] tags is not wrapped, so GIJOE's long code-line is widening the table as a whole.

Is there a way to add wrap functionality to the code tag? Sorry for hijacking the thread, but this is something that would be very useful for anyone using a pure CSS theme. Long code snipits break pure CSS themes really bad.

Thanks!

Re: XOOPS 2.0.7.3 released!

vagelis Published 09/13/2004 16:40 Just popping in Joined 09/05/2004 Comments 79

I update my site and I still can't see the "admin menu" when I log-in in the site like a special member that I have right to the "news" module.

I have 9 posters but noone can access the "news" module.

Please, if you want help me

Re: XOOPS 2.0.7.3 released!

onokazu Published 09/13/2004 19:07 XOOPS Founder Joined 12/13/2001 Comments 617

Quote:

I update my site and I still can't see the "admin menu" when I log-in in the site like a special member that I have right to the "news" module.

We're aware of this problem and would likely be fixed in the future versions

Quote:

I have 9 posters but noone can access the "news" module.

I don't think this has anything to do with the updates. Please enable php debug and see if you get any error messages displayed.

Re: XOOPS 2.0.7.3 released!

supernix Published 09/14/2004 17:48 Not too shy to talk Joined 03/13/2003 Comments 151

Is this version PHP5 safe?

Re: XOOPS 2.0.7.3 released!

RVirtue Published 09/14/2004 18:07 Updated 09/15/2004 23:09 Quite a regular Joined 08/04/2004 Comments 246

I'm all in favour of rapid fixes for security
issues. It's unfortunate, however, that someone
couldn't take the opportunity, while patching
common.php anyhow, to add just a couple of lines
to fix the problem (as reported in the Bugs Forum)
that keeps it from working properly with PHP ISAPI.

I mean we're only talking about two extra lines.
But it's a niusance having to add them manually
for each update.

 After: 
$xoopsRequestUri = $_SERVER[ 'REQUEST_URI' ]; // Deprecated 
Add: 
$xoopsRequestUri = ($xoopsRequestUri) ? $xoopsRequestUri : 
    xoops_getenv('REQUEST_URI'); 
$xoopsRequestUri = ($xoopsRequestUri) ? $xoopsRequestUri : 
    (($rq = xoops_getenv('SCRIPT_NAME')) ? $rq : getenv('REQUEST_URI'));

Oh well, maybe next time.

Regards,
Richard

Re: XOOPS 2.0.7.3 released!

talunceford Published 09/14/2004 18:24 Just can't stay away Joined 08/14/2002 Comments 532

Ok, I just updated to the latest release and something funky is happening with the submit.php file for the news module. It doesn't display the theme at all. I tried debugging, but to no avail, as it isn't loading something..... what file would have been modified in the latest release that would cause it not to display properly. I am using the 1.2.1 version of the News module. It seems to submit the info to the db fine, but fails to display the theme at all. Any help would be wonderful.

Re: XOOPS 2.0.7.3 released!

speedxnet Published 09/18/2004 15:49 Just popping in Joined 09/11/2004 Comments 10

Great work XOOPS guys and thanks to you DEV guys are making the portal world a nice place with Xoops' presence.

Re: XOOPS 2.0.7.3 released!

bhall Published 09/24/2004 7:37 Just popping in Joined 09/24/2004 Comments 2

I downloaded this and placed it on my local hard drive. It all worked perfectly.

From there I went to upload it to my webserer via ftp.

This is where the problem comes in.

in thetemplates_c folder I've got this file
"default%2Ftheme.html"
When ever it is uploaded the other two defualt theme.html files won't upload and it denies me access to the file. I can't delete it, change the name or anything else.

Is this a known problem or is there a fix? I'll have to get my server admin to go in and delete the files (two of them now).

All of the other files, when uploaded lose the % part. IE (db%3Anewbb_index -> dbnewbb_index)

But yes, aside from this via the ftp upload it's all pretty amazing on my comp.

Which is easily understandable. When I copy/paste to my localhost folder it doesn't alter the files.

Do the '%3A' chars have to be in there and/or are they an reprensentation for another character that I can just replace?

Thanks for your help in advance.

(and I hope this is the correct place in which to ask for help, if not I apologize)

Re: XOOPS 2.0.7.3 released!

Herko Published 09/24/2004 7:41 XOOPS is my life! Joined 02/04/2002 Comments 4238

Go to system admin -> modules and update your moules. Here the 'update' feature is a bit confusing, as it doesn't get you the latest version, but it reloads the modules, includiung templates.

Herko

Re: XOOPS 2.0.7.3 released!

bhall Published 09/24/2004 9:49 Just popping in Joined 09/24/2004 Comments 2

I am not getting that far.

I emptied out my server of all related files. I emptied my data base of all tables.

I reuploaded everything. I ran the installation..

All that I see when trying to go to the site is what you see at the very top of this page

the XOOPS logo. The blue background going across the top..

and the copywrite bar along the bottom. The space inbetween (which holds ALL the content) is totally empty.

After this clean install I go to my templates_c folder and it's only contents are

'index.html' and 'default%2Ftheme.html'

which I'm pretty sure is going to be the problem

If this is not a problem with any of the files themselves (which I suspect they are not because it works on my personal computer) do you recomment any request I can make to my server admin to correct this problem?

If you wish to see what I'm talking about you can visit

http://bhall.sifen7.com/portal/

Re: XOOPS 2.0.7.3 released!

sbkiller Published 09/29/2004 13:20 Just can't stay away Joined 06/09/2004 Comments 461

Goto:

Go to system admin -> modules -> add module install them.

The default%2Ftheme.html is cache of your site, it's not problem, and don't edit that one.

I'm thinking that you are not able to login to any area.

http://bhall.sifen7.com/portal/admin.php
http://bhall.sifen7.com/portal/user.php

Those I tried on your site, doesn't show any login screen.
You have a big problem with your database (SQL Database)

Re: XOOPS 2.0.7.3 released!

jgouez Published 09/30/2004 11:03 Updated 09/30/2004 12:15 Just popping in Joined 02/26/2004 Comments 3

I use the module shop on XOOPS 2.0.7.3 and my session
variable $shipping is out of order.

the probleme is the code of common.php:

Quote:

if (ini_get('register_globals') == 1) {
foreach (array_keys($_SESSION) as $session_key) {
unset($HTTP_GET_VARS[$session_key], $HTTP_POST_VARS[$session_key], $HTTP_COOKIE_VARS[$session_key], $_GET[$session_key], $_POST[$session_key], $_REQUEST[$session_key], $_COOKIE[$session_key]);
}
}

please help me

Re: XOOPS 2.0.7.3 released!

onokazu Published 10/02/2004 14:30 XOOPS Founder Joined 12/13/2001 Comments 617

One way to let that work is to have register_globals off on your server.

Login

Username

Password

Remember me

Search

Advanced Search

Donat-O-Meter

Stats
Goal:	$100.00
Due Date:	Aug 31
Gross Amount:	$0.00
Net Balance:	$0.00
Left to go:	$100.00

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

{{ record.commit.author.name }} {{ record.commit.author.date | formatDate }}

XOOPS: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Re: XOOPS 2.0.7.3 released!

Login

Search

Recent Comments

Re: New Admin Theme for XOOPS (Beta)

Re: New Admin Theme for XOOPS (Beta)

Re: XOOPS 2.5.11 Final Released

Re: XOOPS 2.5.11 Final Released

Re: XOOPS 2.5.11 Final Released

Who's Online

Donat-O-Meter

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

Archives

News archives