CGI Error on Security 1.0.3 update

[Jason Sanborn]

Here's the situation:

Dev Computer: Windows XP Pro // IIS 5.1 // PHP 4.4.2 Running as CGI
IntegraMOD 1.4.0 // phpBB 2.0.19 // phpBB Security 1.0.3

Live Server: Windows 2003 // IIS 6 // PHP 4.4.2 Running as ISAPI
IntegraMOD 1.4.0 // phpBB 2.0.19 // phpBB Security 1.0.2

When I updated my Dev Computer to phpBB Security 1.0.3, the CGI module for PHP crashed and the ACP Panel returned a CGI Error. I haven't updated my live site for obvious reasons.

Now, when reading through information relating to this, I have tracked the error down to the following location:

File: admin/index.php
Line Number: Around 77
Line Value: $secfile = @file('http://phpbb-tweaks.com/secver.txt');

When I comment out the above line, the module no longer crashes, and I can open my ACP. Only problem is the feature for alerting me to if an update is needed for phpBB Security always says that it can't get the version data.

Now, the obvious work-around would be to comment out the entire section that was added to that file:

Code: Select all

/*#======================================================================= |#==== Start];     $this_ver   = $board_config['phpBBSecurity_version'];             if ($newest_ver == $this_ver)             $msg .= 'The newest release is <b>'. $newest_ver .'</b>. The version you are using is             <b>'. $this_ver .'</b>. So I would have to say you are up to date!';         else             $msg .= 'The newest release is <b>'. $newest_ver .'</b>. The version you are using is             <b>'. $this_ver .'</b>. So I would have to say you need to upgrade ASAP!';         }             $msg .= '             </span>';     $msg .= '         </td>';     $msg .= '    </tr>';     $msg .= '    <tr>';     $msg .= '         <th> </th>';     $msg .= '    </tr>';     $msg .= '</table>';     echo $msg;#====#==== Author: aUsTiN [austin@phpbb-amod.com] [http://phpbb-tweaks.com] = |#==== End: ==== phpBB Security ========================================= |   #======================================================================= |*/

The problem with doing that is that the feature goes away. The thing is, the same feature works fine for phpBB and for IntegraMOD, and the update information is displayed as expected. So I know there is a way to get that to work without using @file to the remote site. Unfortunately, my knowledge of PHP is quite limited. That is why I post this issue here. Perhaps one of the PHP gurus here might be able to restructure this code to still work, so that users on Windows based systems won't have this issue.

[Jason Sanborn]

I found a solution to this problem.

OPEN: adminindex.php

FIND:

Code: Select all

#======================================================================= |#==== Start];     $this_ver   = $board_config['phpBBSecurity_version'];             if ($newest_ver == $this_ver)             $msg .= 'The newest release is <b>'. $newest_ver .'</b>. The version you are using is             <b>'. $this_ver .'</b>. So I would have to say you are up to date!';         else             $msg .= 'The newest release is <b>'. $newest_ver .'</b>. The version you are using is             <b>'. $this_ver .'</b>. So I would have to say you need to upgrade ASAP!';         }             $msg .= '             </span>';     $msg .= '         </td>';     $msg .= '    </tr>';     $msg .= '    <tr>';     $msg .= '         <th> </th>';     $msg .= '    </tr>';     $msg .= '</table>';     echo $msg;#====#==== Author: aUsTiN [austin@phpbb-amod.com] [http://phpbb-tweaks.com] = |#==== End: ==== phpBB Security ========================================= |   #======================================================================= |

REPLACE WITH:

Code: Select all

#======================================================================= |#==== Start];                 if ($newest_ver == $this_ver)         {             $msg .= 'The newest release is <b>'. $newest_ver .'</b>. The version you are using is             <b>'. $this_ver .'</b>. So I would have to say you are up to date!';         }         else         {             $msg .= 'The newest release is <b>'. $newest_ver .'</b>. The version you are using is             <b>'. $this_ver .'</b>. So I would have to say you need to upgrade ASAP!';         }     }     else     {         if ($errstr)         {             $msg .= '<p>Sorry, I was unable to get version data at this time. Please try later.<br>'. $errstr . '</p>';         }         else         {             $msg .= '<p>' . $lang['Socket_functions_disabled'] . '</p>';         }     }       $msg .= '             </span>';     $msg .= '         </td>';     $msg .= '    </tr>';     $msg .= '    <tr>';     $msg .= '         <th> </th>';     $msg .= '    </tr>';     $msg .= '</table>';     echo $msg;#====#==== Author: aUsTiN [austin@phpbb-amod.com] [http://phpbb-tweaks.com] = |#==== End: ==== phpBB Security ========================================= |   #======================================================================= |

[Jason Sanborn]

This changes the way that the version file is read from the phpbb-tweaks.com site so that it functions in much the same way as the phpbb version and the IntegraMod news files are read. This should work on Windows and *nix servers.

[Adrian Rea]

Well done Jason [flash=,:1amo5wwr]http://integramod.com/forum/images/icon/icon14.gif[/flash:1amo5wwr]


Have you considered relaying this to Austin, the Mod's creator?

Thanks again, good diagnosis and treatment <img>

A

[Jason Sanborn]

I would, but it doesn't seem to allow me to post. I joined but his security settings say I can't post. <img>

Maybe someone who's been a member over there can give more feedback on the situation?

[Adrian Rea]

I did pm Austin myself, and he has replied

I'm not going to create a username there to post once, so if you like you can relay this.

My way works fine if the site is online, if you have a test site on your PC using EasyPHP or similar, then naturally its going to crash out because its on your local on not the net.

None the less, i will consider when i update it, changing it to something more similar using fsocket instead of file.

I am happy to return any productive comments from this.

A

[Jason Sanborn]

Thanks, A. I will double check on my live server to verify, but I think it happened there as well. I have a dedicated Windows 2003 server, so can create a test site without affecting any of my live sites.

This issue seems to be involving Windows and IIS running php either as a CGI plugin (which is what I do locally) or as an ISAPI filter (which is what my server runs).

As an additional FYI, when I wasn't connected to the net, it gave no error at all. It simply stated that it couldn't retrieve the information (as expected).

[Adrian Rea]

Do you think it could be some wierd firewall issue?

Also I note that once on old integraMOD there was one person who could never get the Integramod info link in ACP.

A

[Jason Sanborn]

I wouldn't think so, but I suppose it could be possible. Another possibility could be server configuration with regards to DNS resolution. These issues shouldn't cause crashes, though.

I haven't had a chance to create a test site on my server yet. Plan on doing that later today.

[Jason Sanborn]

Ok. I checked on my web server directly and the error didn't appear. Therefore the problem appears to only exist if the user is hosted on a Windows server that has PHP installed as CGI instead of ISAPI.

I still think the fix would be good to have, simply because it does affect some people (probably a very small group).

[davidgreen73]

I am one of those few that the fix worked for. (Just a heads up)