Page 1 of 2

CrackerTracker Exploit False Positives

PostPosted: Thu Jan 18, 2007 5:08 pm
Author: Teelk
Have you ever gotten this message while trying to do something you know you should be allowed to do?

[align=center]Image[/align]

There is a KB Article located here that will explain how to use the debug mode of CrackerTracker to detect the problem file and give you a solution.

This thread is for those that have already found their solution and want to share it with the rest of the community. So, feel free to share your CrackerTracker Debug Logs with everyone. All verified and validated False Positive fixes will be contained within this first post.

NOTE: Please do not post support questions in this thread, it is only for CT Debug info. If you are having a problem using the debug mod or have another CrackerTracker related question or problem, please start another thread or post in a thread with the same topic material.

Verified Fixes

Tell a Friend fix
OPEN tellafriend.php
FIND
Code: Select all
define('IN_PHPBB', true);
AFTER ADD
Code: Select all
define('CT_SECLEVEL', 'MEDIUM');


Occupation Fix (in profiles)
OPEN profile.php
FIND
Code: Select all
$ct_ignorepvar = array('helpbox','delete','deleteall','phpBBSecurity_question','user_interests');
REPLACE WITH
Code: Select all
$ct_ignorepvar = array('helpbox','delete','deleteall','phpBBSecurity_question','user_interests','user_occ');

PostPosted: Thu Jan 18, 2007 5:20 pm
Author: ZacFields
When you click the "Tell a Friend" button, you'll get a CrackerTracker error. I have edited the instructions that CrackerTracker gave me to match what you'll actually have to do to fix this.


Open: tellafriend.php
FIND
Code: Select all
define('IN_PHPBB', true);

 
AFTER, ADD
Code: Select all
define('CT_SECLEVEL', 'MEDIUM');


Before it said to look for "define('IN_PHPBB', 1); but in IM 1.4.1 it is "define('IN_PHPBB', true);" so this code will fix the problem.

Zac

PostPosted: Fri Jan 26, 2007 12:54 am
Author: DDay629
For anyone wanting an easy way to make these changes without using a single FTP program, just use the eXtreme Styles template editor. I have for instance created backups in both versions of ctracker/engines/ct_security.php

Hope this helps some of you guys.

DDay

PostPosted: Fri Jan 26, 2007 11:09 am
Author: ZacFields
One of my users was having trouble updating his information. Seems that the 'user_realname' parameter was causing the trouble. Here is the patch for it (I have altered it to work with the integramod code)
OPEN
/profile.php
##-----[ FIND ]------------------------------------------#
Code: Select all
$ct_ignorepvar = array('helpbox','delete','deleteall','phpBBSecurity_question','user_interests')

##-----[IN-LINE FIND]------------------------------------------#
Code: Select all
 'helpbox','delete','deleteall','phpBBSecurity_question','user_interests'

##-----[ IN-LINE, AFTER, ADD ]------------------------------------------#
Code: Select all
 ,'user_realname'

##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------##
EoM

The whole string of code will look like this after the patch:

$ct_ignorepvar = array
('helpbox','delete','deleteall','phpBBSecurity_question','user_interests','user_realname')

I think this is the right instructions that you'll need. Feel free to alter, it's just important to get the 'user_realname' parameter unblocked.

Zac

PostPosted: Fri Jan 26, 2007 3:02 pm
Author: ZacFields
I couldn't edit anything in my ACP ==> Configuration area before adding this fix: (Altered to match integramod code)

OPEN
/admin/admin_board.php
-----[ FIND ]------------------------------------------
Code: Select all
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('cookie_name');

-----[ IN-LINE FIND]-----------------------------------------
Code: Select all
 'cookie_name'

-----[ IN-LINE AFTER, ADD]--------------------------------
Code: Select all
 ,'board_email_sig','board_disable_msg'

-----[ SAVE/CLOSE ALL FILES ]----------------------------
EoM


The whole string of code will look like this after the patch:

$ct_ignorepvar = array('cookie_name','board_email_sig','board_disable_msg');

Now as far as I can tell, I can change anything in the configuration section in the ACP.

Zac

PostPosted: Sat Jan 27, 2007 2:34 pm
Author: ZacFields
To create a forum, there is one minor error that needs to be resolved. Very simple and SMALL problem but here is the patch for it (Altered to match IM code)

-----[ OPEN ]------------------------------------------
admin/admin_forums_extend.php
-----[ FIND ]------------------------------------------

Code: Select all
$ct_ignorepvar = array('create','delete','name','icon');

-----[ IN-LINE, FIND ]------------------------------------------

Code: Select all
'delete','name','icon'

-----[ IN-LINE AFTER, ADD ]------------------------------------------

Code: Select all
,'desc'

-----[ SAVE/CLOSE ALL FILES ]------------------------------------------


The string of code after the fix will look like this:

$ct_ignorepvar = array('create','delete','name','icon','desc');

Once this is fixed, you should be able to create forums just fine.

Zac

*EDIT* This fix seems to also work for creating categories as well.

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Jan 30, 2007 1:07 am
Author: DjPorkchop
Tried Adding a GNU license in downloads and cracker tracker went off. Letting you know so it can be patched when ever and I used ZacFields fixes and my board is alot more free now.

PostPosted: Tue Jan 30, 2007 1:29 am
Author: Dick Dynamite
Biggest problem I am having right now is on one of my sites, I can't edit style.css sheets on the site itself. I have to download them, edit them on my machine, and submit the edited version. That wouldn't be an issue if I wasn't the kind to try something, and nick and pick at it til I liked it. <img>

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Jan 30, 2007 1:53 am
Author: Leadfoot
ctracker is blocking the cookieMod program. I found the easy go around was to rename ctracker to something else. Run cookieMod and then change the file name back to ctracker.

PostPosted: Tue Jan 30, 2007 2:05 am
Author: Dick Dynamite
The CTracker folder?

PostPosted: Tue Jan 30, 2007 11:21 am
Author: Leadfoot
If you look at the root of your forums you will see a folder called ctracker. It was in the files you uploaded for 141.

PostPosted: Tue Jan 30, 2007 11:59 am
Author: ZacFields
I will take a look at the aforementioned problems and see if we can find a patch for it.

The Devs (and I, the newbie dev) are working on a real patch for crackertracker but we want to make sure we've got most of the major fixes on there before we release it.

I have uploaded a patch that you guys can use in the meantime that will help you be able to do some of the basic stuff like create forums, edit forums, etc.

Zac

PostPosted: Tue Jan 30, 2007 1:18 pm
Author: Dick Dynamite
Sorry, Leadfoot, I was asking if you meant the folder itself, or the CTracker_security.php file.

PostPosted: Tue Jan 30, 2007 1:38 pm
Author: Dick Dynamite
Also, now I can't even change those settings at all. [Avatar/Sig, ect.]. I'm tempted to just uninstall ctracker until something is made to work. <img>

PostPosted: Tue Jan 30, 2007 2:52 pm
Author: ZacFields
Dick Dynamite,

Where are you having trouble changing avater/sig info? In your users profile or in your ACP? Be more specific so I can create a patch

Zac

PostPosted: Tue Jan 30, 2007 3:53 pm
Author: Dick Dynamite
Well, the fix in the DB worked to fix the avatar/sig problem. Just when I edited the stuff, I had a typo, so it didn't read right. So, nix that.

PostPosted: Wed Jan 31, 2007 2:28 am
Author: Leadfoot
I rename the folder itself

PostPosted: Thu Feb 01, 2007 1:24 pm
Author: Leadfoot
K heres another false positive Teelk

in amod+admin I went to the xtras page and tried to upload changes to the toggle options. I got the dreaded ctracker pink box.

So again as a workaround I renamed the root file "ctracker" to "-ctracker" did my changes to the toggle box and it worked fine.

You will see php errors when u use this methond but scroll to the bottom of them and you will see your page


Edit: I have also found one game that triggers the ctracker warning also. So far WheelofFortune is the only one to trigger it so far. Let me know if u want to know which games trigger it.

Re: CrackerTracker Exploit False Positives

PostPosted: Thu Feb 01, 2007 3:27 pm
Author: Teelk
Sure, if you can post your debug log info concerning Amod, I'm sure it would be very helpful to those who have installed it on 141.

Re: CrackerTracker Exploit False Positives

PostPosted: Sat Feb 03, 2007 12:45 am
Author: ScottDaMan
When attempting to use General Admin -> Meta Tags+ in ACP, you'll get a false positive. The following debug worked to fix the issue.

Code: Select all
Script-Filename]------------------------------------------#
/forum/admin/admin_meta_tags.php
##-----[ FIND ]------------------------------------------#
define('IN_PHPBB', 1);
##-----[ AFTER, ADD ]------------------------------------------#
define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('meta_de.scription');
##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------##
EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Sun Feb 04, 2007 6:54 am
Author: JohnnyTheOne
end i've got the following debug
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_hacks_list.php
----------------

Request-Method: GET

Matching rule: select%20
In variable: hack_id

Matching rule: union%20
In variable: hack_id

Matching rule: union%20
In variable: hack_id

Matching rule: %20union
In variable: hack_id

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_hacks_list.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('hack_id');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

PostPosted: Mon Feb 05, 2007 12:29 pm
Author: ScottDaMan
When posting some acronyms, you'll get a false positive. The following worked to fix it:
Code: Select all
##-----[ OPEN ]------------------------------------------#
/forum/admin/admin_acronyms.php
##-----[ FIND ]------------------------------------------#
define('IN_PHPBB', 1);
##-----[ AFTER, ADD ]------------------------------------------#
define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('de.scription');

PostPosted: Mon Feb 05, 2007 12:38 pm
Author: ZacFields
We really appreciate all the help you guys are giving. Thanks to your efforts Teelk and I have been working to compile a patch for all these errors.

We're truly thankful for your help, and if you notice any other errors please let us know <img>

Zac

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Feb 06, 2007 1:16 pm
Author: Leadfoot
ok another false positive here

acp/pcp/pcpwizard/alterformdisplay/submit

when you click on the first submit button u get the ctracker security box

ran debug here are the results


Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename]------------------------------------------#
/forum/admin/admin_pcp_wizard.php
##-----[ FIND ]------------------------------------------#
define('IN_PHPBB', 1);
##-----[ AFTER, ADD ]------------------------------------------#
define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('style_user_rank_title','style_user_warnings');
##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------##
EoM

RESULTS

Didnt work for me. Where it says:

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);


I dont have that line. My line says:

define('IN_PHPBB', true);

I tried adding the fix after that line and it did not work. So I reran the debug and it came up with this.

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forum/admin/admin_pcp_wizard.php----------------
Request-Method: POST Matching rule: "In variable:  style_usernameIn variable:  style_user_birthdayIn variable:  style_user_my_friendIn variable:  style_user_my_ignoreIn variable:  style_user_pmIn variable:  style_user_emailIn variable:  style_user_websiteIn variable:  style_user_aimIn variable:  style_user_yimIn variable:  style_user_msnmIn variable:  style_user_skypeIn variable:  style_user_icqIn variable:  style_user_album Possible solution:

##-----[ OPEN ]------------------------------------------
/forum/admin/admin_pcp_wizard.php
##-----[ FIND ]------------------------------------------
define('IN_PHPBB', 1);
##-----[ AFTER, ADD ]------------------------------------------
define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('style_username','style_user_birthday','style_user_my_friend','style_user_my_ignore','style_user_pm','style_user_email','style_user_website','style_user_aim','style_user_yim','style_user_msnm','style_user_skype','style_user_icq','style_user_album');
##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
EoM


So i added those along with the first debug return so now my admin/admin_pcp_wizard.php looks like this

Code: Select all
define('IN_PHPBB', true); 
define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('style_username','style_user_birthday','style_user_my_friend','style_user_my_ignore','style_user_pm','style_user_email','style_user_website','style_user_aim','style_user_yim','style_user_msnm','style_user_skype','style_user_icq','style_user_album');
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('style_user_rank_title','style_user_warnings');



I ran debug again after this and still getting same return as on last run.

If I go into the acp/pcp/pcpwizard/alter page display and i click on the submit button on the default page that pops up all is ok.
But if I navigate to another page such as viewtopic>buttons and hit submit I get the ctracker block.

PostPosted: Tue Feb 06, 2007 1:23 pm
Author: ScottDaMan
When a user attempts to add a link to your link directory and they use a site with a .shtml extension, they will get an error.
Code: Select all
Script-Filename]------------------------------------------#/forum/link_register.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('link_desc','link_title','link_url');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  


It is important to note:
Original:
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('link_title','link_desc');

New:
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('link_title','link_desc','link_url');

PostPosted: Tue Feb 06, 2007 1:32 pm
Author: ScottDaMan
Same deal for the admin side of the link .script.

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/forum/admin/admin_links.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('submit','link_desc','link_title','link_url');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM


Important note:
Original:
$ct_ignorepvar = array('submit','link_desc');

New:
$ct_ignorepvar = array('submit','link_desc','link_title','link_url');

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Feb 06, 2007 2:14 pm
Author: Leadfoot
Dam this debugging might get addictive now that I have figured it out. Anyways here is my debug and fix for wheel of fortune. It worked in removing the ctracker error.

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /forum/newscore.php----------------  Request-Method: POST  Matching rule: or In variable:   puzzle2In variable:   puzzle65In variable:   puzzle132In variable:   puzzle133In variable:   puzzle144In variable:   puzzle163In variable:   puzzle165In variable:   puzzle166In variable:   puzzle183In variable:   puzzle192  Matching rule: and In variable:   puzzle1In variable:   puzzle2In variable:   puzzle5In variable:   puzzle6In variable:   puzzle25In variable:   puzzle35In variable:   puzzle39In variable:   puzzle56In variable:   puzzle86In variable:   puzzle92In variable:   puzzle113In variable:   puzzle143In variable:   puzzle179In variable:   puzzle184In variable:   puzzle186In variable:   puzzle190In variable:   puzzle195In variable:   puzzle196In variable:   puzzle207In variable:   puzzle223In variable:   puzzle238In variable:   puzzle240In variable:   puzzle244In variable:   puzzle246In variable:   puzzle247In variable:   puzzle252In variable:   puzzle258  Matching rule: id In variable:   puzzle43In variable:   puzzle154In variable:   puzzle226In variable:   puzzle237In variable:   puzzle249  Matching rule: ls In variable:   puzzle27In variable:   puzzle58In variable:   puzzle59In variable:   puzzle140In variable:   puzzle194In variable:   puzzle238  Matching rule: rm In variable:   puzzle71  Matching rule: kill In variable:   puzzle193  Matching rule:  chrIn variable:   puzzle70In variable:   puzzle169  Matching rule: rm In variable:   puzzle71  Matching rule: kill In variable:   puzzle193  Matching rule:  likeIn variable:   puzzle29In variable:   puzzle42In variable:   puzzle73In variable:   puzzle94  Matching rule: like In variable:   puzzle29In variable:   puzzle42In variable:   puzzle73In variable:   puzzle94  Matching rule: ping In variable:   puzzle229In variable:   puzzle245Possible solution:------------------  ##-----[ OPEN ]------------------------------------------#/forum/newscore.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('puzzle2','puzzle65','puzzle132','puzzle133','puzzle144','puzzle163','puzzle165','puzzle166','puzzle183','puzzle192','puzzle1','puzzle5','puzzle6','puzzle25','puzzle35','puzzle39','puzzle56','puzzle86','puzzle92','puzzle113','puzzle143','puzzle179','puzzle184','puzzle186','puzzle190','puzzle195','puzzle196','puzzle207','puzzle223','puzzle238','puzzle240','puzzle244','puzzle246','puzzle247','puzzle252','puzzle258','puzzle43','puzzle154','puzzle226','puzzle237','puzzle249','puzzle27','puzzle58','puzzle59','puzzle140','puzzle194','puzzle71','puzzle193','puzzle70','puzzle169','puzzle29','puzzle42','puzzle73','puzzle94','puzzle229','puzzle245');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Feb 06, 2007 7:04 pm
Author: Teelk
Thanks guys for the contributions, they really are helping out.

For PCP Wizard, try opening up admin/admin_pcp_wizard.php and replacing the MEDIUM with LOW. That may solve all issues with the wizard.

Re: CrackerTracker Exploit False Positives

PostPosted: Wed Feb 07, 2007 3:03 am
Author: Leadfoot
ok i have done a lot more debugging on the pcp wizard and have a fix that has everything fixed but one thing and I cant seem to get the last part to work. With the debug below everything will work EXCEPT for "alter form display". I keep getting this ctracker debug on this form and it is not working.

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /forum/admin/admin_pcp_wizard.php----------------  Request-Method: POST  Matching rule: _phpIn variable:   get_func_phpBBSecurity_questionIn variable:   get_func_phpBBSecurity_answerPossible solution:------------------  ##-----[ OPEN ]------------------------------------------#/forum/admin/admin_pcp_wizard.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('get_func_phpBBSecurity_question','get_func_phpBBSecurity_answer');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  



So to get the pcp wizard to work on all pages BUT for the one above this is the working debug

Code: Select all
##-----[ OPEN ]------------------------------------------#/forum/admin/admin_pcp_wizard.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('style_user_birthday','style_user_my_friend','style_user_my_ignore','style_user_pm','style_user_email','style_user_website','style_user_aim','style_user_yim','style_user_msnm','style_user_skype','style_user_icq','style_user_album','style_user_sig','style_username','style_user_online','style_user_rank_title','style_user_avatar','style_user_from','style_user_regdate','style_user_gender','style_user_age','style_user_posts','style_user_cashtp','style_user_holidays','style_user_country','style_user_warnings','style_user_trophy_topic','get_func_phpBBSecurity_question','get_func_phpBBSecurity_answer');      


Hope this helps.

Re: CrackerTracker Exploit False Positives

PostPosted: Wed Feb 07, 2007 10:48 am
Author: psyperu
"Leadfoot";p="21534" wrote:Dam this debugging might get addictive now that I have figured it out. Anyways here is my debug and fix for wheel of fortune. It worked in removing the ctracker error.

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /forum/newscore.php----------------  Request-Method: POST  Matching rule: or In variable:   puzzle2In variable:   puzzle65In variable:   puzzle132In variable:   puzzle133In variable:   puzzle144In variable:   puzzle163In variable:   puzzle165In variable:   puzzle166In variable:   puzzle183In variable:   puzzle192  Matching rule: and In variable:   puzzle1In variable:   puzzle2In variable:   puzzle5In variable:   puzzle6In variable:   puzzle25In variable:   puzzle35In variable:   puzzle39In variable:   puzzle56In variable:   puzzle86In variable:   puzzle92In variable:   puzzle113In variable:   puzzle143In variable:   puzzle179In variable:   puzzle184In variable:   puzzle186In variable:   puzzle190In variable:   puzzle195In variable:   puzzle196In variable:   puzzle207In variable:   puzzle223In variable:   puzzle238In variable:   puzzle240In variable:   puzzle244In variable:   puzzle246In variable:   puzzle247In variable:   puzzle252In variable:   puzzle258  Matching rule: id In variable:   puzzle43In variable:   puzzle154In variable:   puzzle226In variable:   puzzle237In variable:   puzzle249  Matching rule: ls In variable:   puzzle27In variable:   puzzle58In variable:   puzzle59In variable:   puzzle140In variable:   puzzle194In variable:   puzzle238  Matching rule: rm In variable:   puzzle71  Matching rule: kill In variable:   puzzle193  Matching rule:  chrIn variable:   puzzle70In variable:   puzzle169  Matching rule: rm In variable:   puzzle71  Matching rule: kill In variable:   puzzle193  Matching rule:  likeIn variable:   puzzle29In variable:   puzzle42In variable:   puzzle73In variable:   puzzle94  Matching rule: like In variable:   puzzle29In variable:   puzzle42In variable:   puzzle73In variable:   puzzle94  Matching rule: ping In variable:   puzzle229In variable:   puzzle245Possible solution:------------------  ##-----[ OPEN ]------------------------------------------#/forum/newscore.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('puzzle2','puzzle65','puzzle132','puzzle133','puzzle144','puzzle163','puzzle165','puzzle166','puzzle183','puzzle192','puzzle1','puzzle5','puzzle6','puzzle25','puzzle35','puzzle39','puzzle56','puzzle86','puzzle92','puzzle113','puzzle143','puzzle179','puzzle184','puzzle186','puzzle190','puzzle195','puzzle196','puzzle207','puzzle223','puzzle238','puzzle240','puzzle244','puzzle246','puzzle247','puzzle252','puzzle258','puzzle43','puzzle154','puzzle226','puzzle237','puzzle249','puzzle27','puzzle58','puzzle59','puzzle140','puzzle194','puzzle71','puzzle193','puzzle70','puzzle169','puzzle29','puzzle42','puzzle73','puzzle94','puzzle229','puzzle245');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  


Hi but I don't have that archive "newscore.php" in the root of /forum/

Re: CrackerTracker Exploit False Positives

PostPosted: Wed Feb 07, 2007 11:30 am
Author: Teelk
That is only for the "wheel of fortune MOD".

Re: CrackerTracker Exploit False Positives

PostPosted: Wed Feb 07, 2007 12:20 pm
Author: Leadfoot
actually psypru its for the game "wheel of forune" which is part of the amod arcade mod. Just so you are clear.

Re: CrackerTracker Exploit False Positives

PostPosted: Thu Feb 08, 2007 4:01 pm
Author: ScottDaMan
Couple false positives related to the qbar.
Script-Filename: /forum/admin/admin_qbar.php

Original:
$ct_ignorepvar = array('url');

New
$ct_ignorepvar = array('url','explain','shortcut');

Here's the debug details:
Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/forum/admin/admin_qbar.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('explain');


and

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/forum/admin/admin_qbar.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('shortcut');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  

Re: CrackerTracker Exploit False Positives

PostPosted: Fri Feb 09, 2007 4:22 pm
Author: Leadfoot
Ok have the debug info and fix for cookie mod.

Code: Select all
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename: /forum/cookieMOD/cookie.php----------------  Request-Method: POST  Matching rule: _phpIn variable:   cookie_namePossible solution:------------------  ##-----[ OPEN ]------------------------------------------#/forum/cookieMOD/cookie.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('cookie_name');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  



That stopped the cracker tracker error for me.

Re: CrackerTracker Exploit False Positives

PostPosted: Mon Feb 12, 2007 10:41 am
Author: thatjoeguy
I just tried modiying the Welcome PM through the ACP and got the CTracker warning. Put it into debug and found the possible fix, but it doesn't solve the probem.

The log says:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /admin/admin_wpm.php
----------------

Request-Method: POST

Matching rule: or
In variable: wpm_message

Matching rule: and
In variable: wpm_message

Matching rule: '
In variable: wpm_message

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_wpm.php

#
#-----[ FIND ]------------------------------------------
#
require('./pagestart.' . $phpEx);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('wpm_message');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


I didn't find:

require('./pagestart.' . $phpEx);

But instead found

require("pagestart.$phpEx");

and inserted the code after that, but it seems to have had no effect.

PostPosted: Tue Feb 13, 2007 2:39 am
Author: Leadfoot
I thought I would go try and see if I could debug it even farther joeguy. But I seemed to also run into other issues which I will put in another post. But try this it may work.

#
#-----[ OPEN ]------------------------------------------
#
/forum/admin/admin_wpm.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('wpm_message');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#

Re: CrackerTracker Exploit False Positives

PostPosted: Wed Feb 14, 2007 8:52 am
Author: BMD
I just went to change the Welcoming PM and hit a CT issue

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /usr/local/apache/cgi-bin/php.cgi-4.3.1
----------------

Request-Method: POST

Matching rule: or
In variable: wpm_message

Matching rule: and
In variable: wpm_message

Matching rule: "
In variable: wpm_message

Matching rule: '
In variable: wpm_message

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/usr/local/apache/cgi-bin/php.cgi-4.3.1

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('wpm_message');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM



I get how to edit the code... but I am on a paid host provider server and don't see the referenced path at all, and I believe they use linux

anyone got a clue?

also I already implemented Zack's patch

PostPosted: Wed Feb 14, 2007 10:49 am
Author: tekguru
Once these are all resolved with there be a definitive fix?

Re: CrackerTracker Exploit False Positives

PostPosted: Wed Feb 14, 2007 3:33 pm
Author: JohnnyTheOne
The following debug worked to me.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/profile.php
----------------

Request-Method: POST

Matching rule: delete
In variable: delete_user

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/profile.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('delete_user');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Wed Feb 14, 2007 6:04 pm
Author: JohnnyTheOne
end the following Warning: No ending delimiter '#' found in /var/www/vhosts/johnnytheone.com/httpdocs/home/ctracker/engines/ct_security.php on line 357
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_pa_ug_auth.php
----------------

Request-Method: GET

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_pa_ug_auth.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Thu Feb 15, 2007 3:21 pm
Author: Leadfoot
Ok one more for you guys

when trying to submit an update to navigation menu I would get ct warning when hitting submit on the edit.

here is the fix

Code: Select all
Script-Filename: /forum/admin/admin_qbar.php----------------  Request-Method: POST  Matching rule: load In variable:   explainPossible solution:------------------  ##-----[ OPEN ]------------------------------------------#/forum/admin/admin_qbar.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('explain');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM    

PostPosted: Fri Feb 16, 2007 6:17 am
Author: sanji
I can not add an administrator to my board: When going in User Admin -> Permissions, I get a false positive when submitting the name of a user.

OK, I have not find how to solve the problem yet...

sanji

Re: CrackerTracker Exploit False Positives

PostPosted: Fri Feb 16, 2007 11:49 am
Author: Pogue Moran
Can anyone help me fix a false positive? I'm trying to get the inline quickediting function of Ajax but I keep getting a false positive everytime I try to save the edit what do I need to do to fix this?

Below is the install file

[url=http]Ajaxed Install Instruction[/url]

Re: CrackerTracker Exploit False Positives

PostPosted: Fri Feb 16, 2007 11:59 am
Author: fish222222
I get false positives on just about everything I do, even with all of the security turned off. I just put 1.4.0 back on and called it good. Too many issues to deal with to mess with it.

Re: CrackerTracker Exploit False Positives

PostPosted: Sat Feb 17, 2007 4:41 am
Author: Khoas
Adding a banner:

Code: Select all
Possible solution]------------------------------------------#/forum/admin/admin_banner.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('banner_name');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM    

Re: CrackerTracker Exploit False Positives

PostPosted: Mon Feb 19, 2007 11:19 am
Author: atomhead
Code: Select all
##-----[ OPEN ]------------------------------------------#/forums/kb.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('article_desc','message');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  


False positive.. applying this fix doesn't get rid of it. Error is when trying to add a KB article.

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Feb 20, 2007 8:43 am
Author: JohnnyTheOne
and the following debug worked
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_pa_license.php
----------------

Request-Method: POST

Matching rule: or
In variable: form

Matching rule: and
In variable: form

Matching rule: exec
In variable: form

Matching rule: "
In variable: form

Matching rule: into
In variable: form

Matching rule: id
In variable: form

Matching rule: rm
In variable: form

Matching rule: '
In variable: form

Matching rule: rm
In variable: form

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_pa_license.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('form');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Feb 20, 2007 10:01 pm
Author: fish222222
I get false positives when I try to edit a template, put a filter in the show only files that contain box, and then try to change directories. It seems to be fine if I don't change directories though. Anyone have a fix for this?

Re: CrackerTracker Exploit False Positives

PostPosted: Wed Feb 21, 2007 11:15 am
Author: JohnnyTheOne
and the following debug worked <img>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/ratings.php
----------------

Request-Method: GET

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/ratings.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Thu Feb 22, 2007 7:56 am
Author: atomhead
"atomhead";p="22144" wrote:
Code: Select all
##-----[ OPEN ]------------------------------------------#/forums/kb.php  ##-----[ FIND ]------------------------------------------#define('IN_PHPBB', 1);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('article_desc','message');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM  


False positive.. applying this fix doesn't get rid of it. Error is when trying to add a KB article.


Same problem with trying to change the Links information in Qbar edit menu. Qbar > Nav Menu (i renamed it from whatever it was before) > Links edit > Submit = borked

Re: CrackerTracker Exploit False Positives

PostPosted: Fri Feb 23, 2007 2:55 am
Author: midjam
Hi guys

I have a problem with deleting the private messages and with the path name in debugging

PMs won`t delete

And when i use the debugger i get

#
#-----[ OPEN ]------------------------------------------
#
/ "never any dir path here just the / "

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);

Please help as my inbox is getting big and i can`t delete any posts <img>

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Feb 27, 2007 11:32 am
Author: JohnnyTheOne
and the following debug <img>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_phpbbmyadmin.php
----------------

Request-Method: GET

Matching rule: delete%20
In variable: this_query

Matching rule: '
In variable: this_query

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_phpbbmyadmin.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('this_query');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Fri Mar 02, 2007 5:18 am
Author: cobra_pliskin
I tried every thing but I get always the false positive when I try to check out REQUIRED FIELD in ALTER FORM DISPLAY under PCP.
What else to try?
I tried with a kick ... the only result was to lose a shoe down from the window! :)

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Mar 06, 2007 8:45 am
Author: JohnnyTheOne
and the following debug
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_extensions.php
----------------

Request-Method: POST

Matching rule: '
In variable: add_extension_group

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_extensions.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('add_extension_group');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Mar 06, 2007 9:41 am
Author: midjam
Hi again guys

Anyone know why i`m getting no pathname?

#
#-----[ OPEN ]------------------------------------------
#
/ "never any dir path here just the / "

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);

Re: CrackerTracker Exploit False Positives

PostPosted: Wed Mar 07, 2007 4:27 am
Author: Juppertje
i have simulair problem in forum/admin/admin_users.php

This user is blokked and i can not deblock this member i get message

SECURITY ALERT ÂÂÂ » ÂÂÂ » ÂÂÂ » ÂÂÂ »
CBACK CrackerTracker has detected a potential attack on this site with a worm or exploit .script so the Security System stopped the .script.


If you can see this page after including a new MOD into your board or after clicking on a link please contact the Board Administrator with this error message and a de.scription what you have done before you could see this page, that the Admin has the possibility to fix the problem.

Re: CrackerTracker Exploit False Positives

PostPosted: Wed Mar 14, 2007 5:30 pm
Author: JohnnyTheOne
the following debug is helpful to those who have installed it on 141
Script-Filename: /home/admin/admin_ina_xtras.php
----------------

Request-Method: POST

Matching rule: or
In variable: challenge_msg
In variable: trophy_msg

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_ina_xtras.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('challenge_msg','trophy_msg');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Juppertje,
read the first post and this http://www.integramod.com/forum/kb.php?mode=article&k=22

PostPosted: Sun Mar 18, 2007 1:33 pm
Author: richiebgood
Tell a friend is still giving me trouble. In the forum, when i want to send a topic that works ok.

On the portal, when i want to send some news articles there is no problem except with a few. Any ideas.

Debug info:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forum/tellafriend.php
----------------

Request-Method: GET

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forum/tellafriend.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM



My tellafriend.php file.

<?php
define('IN_PHPBB', true);
define('CT_SECLEVEL', 'LOW');
$ct_ignorepvar = array('message','submit','');
$phpbb_root_path = "./";
include($phpbb_root_path . 'extension.inc');
include($phpbb_root_path . 'common.'.$phpEx);
include($phpbb_root_path . 'includes/functions_post.'.$phpEx);

Re: CrackerTracker Exploit False Positives

PostPosted: Sun Mar 18, 2007 4:15 pm
Author: shaythong
"JohnnyTheOne";p="22424" wrote:and the following debug <img>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/admin/admin_phpbbmyadmin.php
----------------

Request-Method: GET

Matching rule: delete%20
In variable: this_query

Matching rule: '
In variable: this_query

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/admin/admin_phpbbmyadmin.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('this_query');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


This doesn't work?

Re: CrackerTracker Exploit False Positives

PostPosted: Mon Mar 19, 2007 5:17 am
Author: Wiked
This CtackerTracker is more trouble than its worth IMO.

Until someone comes up with a way to to fix these errors that actually work then I think I will re upload 140 to my site.

Turning on debug mode and using logmanager, viewing the code to add to fix these errors doesn't work at all for me.

Re: CrackerTracker Exploit False Positives

PostPosted: Mon Mar 19, 2007 10:02 am
Author: eivind
Hello.......

I also think about to reupload my 1.4.0 version. I am going mad of all this fake warnings, debug and so on. I realy like integramod so i hope the folks here at integrmod find a solution of this problem soon.... I also know that security is very important and it is a lot of people that like to destroy other's work.......


eivind

PostPosted: Tue Mar 20, 2007 12:28 am
Author: odius
there's an easy way mentioned on this site somewhere that says how to quick and easily disable ctracker, quit bitchin lol, these guys put a lotta work in, appreciate what they've tried to do at least which is to offer the best they could

http://www.integramod.com/forum/viewtop ... ctrack+fix

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Mar 20, 2007 12:36 am
Author: eivind
We appreciate the work very mutch, but we also have be alowed to say what we meen about things.

<img>

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Mar 20, 2007 12:45 am
Author: odius
I think this forum is just for debug, no offense or anythin, first post says
"NOTE: Please do not post support questions in this thread, it is only for CT Debug info."
[hr:178dld48]
when editing a photo album catagory from admin panel, (album > catagory > edit) the 'view level' and 'parent catagory'
error and this debug fix which does NOT work.

turned the setting to LOW as a work around


Script-Filename: /admin/admin_album_cat.php
----------------

Request-Method: POST

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_album_cat.php

#
#-----[ FIND ]------------------------------------------
#
require('./pagestart.' . $phpEx);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM



[hr:178dld48]

Making a new album folder in user's personal album returns the red flag,

had to turn this to LOW aswell


Script-Filename: /album_personal_cat_admin.php
----------------

Request-Method: POST

Matching rule: create
In variable: addcategory

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/album_personal_cat_admin.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('addcategory');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Wed Mar 21, 2007 1:48 pm
Author: .QUACK.Major.Pain
I have found also that the debug doesn't fix the problem.
You may have to do like I have for many of the debugs I had and change the security from MEDIUM to LOW.
This has fixed it for me and allowed me to edit my forum as needed. You can then later go back when your done editting and change the security back to MEDIUM.
If problem still continues like I had with uploading photos to the album, I left security at LOW and haven't had a problem since.

Re: CrackerTracker Exploit False Positives

PostPosted: Fri Mar 23, 2007 7:46 am
Author: JohnnyTheOne
and the following
Script-Filename: /home/portal.php
----------------

Request-Method: GET

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/portal.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Sun Mar 25, 2007 7:20 am
Author: melamkish
Trying to add KB category.

Script-Filename: admin/admin_kb_cat.php
----------------

Request-Method: POST

Matching rule: and
In variable: submit

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_kb_cat.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('submit');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


And another one

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /admin/admin_kb_cat.php
----------------

Request-Method: POST

Matching rule: and
In variable: catdesc

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_kb_cat.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('catdesc');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Sun Mar 25, 2007 10:47 am
Author: Jerkie
This is all just too rediculous, I haven't seen any mention of Downloads yet, this is my biggest problem, I can't add downloads or change categories or ANYTHING, I too think I will be deleting the whole 1.4.1 and going back to 1.4.0 this 1.4.1, just shouldn't have been released yet.. I get the dreaded Pink box with EVERYTHING I DO, I have added about ALL the fixes / patches found here and it still sucks... down with cTracker..... for now. <img>

Re: CrackerTracker Exploit False Positives

PostPosted: Sun Mar 25, 2007 2:11 pm
Author: .QUACK.Major.Pain
Holy crap!!! That's a crappy attitude. How much you pay for 141??? You should be appreciative that it's offered at no charge. Your taking the wrong road with this. You have to consider us all as Beta testers. If we didn't report the problems, they would never get fixed. Maybe you should go back to 140 and come back and download 141 when they release 142. I have to say that this group guys (and gals if any) do a hell of a job assistting everyone with their problems. They are quick to respond and generally help you fix things within days. I've never come across people who assist you 24/7 as quick as they do.

Disappointing to see you bite of the hand that gives you a hand out. These things are a work in progress. Theirs a time when it's felt all the bugs have been worked out and a product is good to go for release. At times errors do come up. Sometimes few, sometimes many.

Stick around and be part of a team working together to perfect a great thiing.

Re: CrackerTracker Exploit False Positives

PostPosted: Sun Mar 25, 2007 6:37 pm
Author: melamkish
I agree. I waited patiently for this version which runs on PHP5 so I could use it. Though I only know the basics of PHP I have dug in to help. Love this version, and my hats off to the team for all the hard work. <img>



Setting up my photo album here is what I have so far.

Album Categories fix
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /admin/admin_album_cat.php
----------------

Request-Method: POST

Matching rule: create
In variable: submit

Matching rule: or
In variable: cat_desc

Matching rule: and
In variable: cat_title

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_album_cat.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('submit','cat_desc','cat_title');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Album upload

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /album_upload.php
----------------

Request-Method: POST

Matching rule: or
In variable: pic_desc

Matching rule: and
In variable: pic_desc

Matching rule: "
In variable: pic_desc

Matching rule: ls
In variable: pic_desc

Matching rule: '
In variable: pic_title

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/album_upload.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('pic_desc','pic_title');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Album edit

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /album_edit.php

(sorry, didn't copy the matching rule part)
----------------
Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/album_edit.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('pic_desc');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Mon Mar 26, 2007 10:13 am
Author: melamkish
Download fixes

There are a couple of fixes I did before I started copying each CT suggested fix. A couple may not have the failure mode, but the fix is included.

Setting the database name

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /admin/admin_pa_file.php
----------------

Request-Method: POST

Matching rule: or
In variable: short_desc

Matching rule: and
In variable: long_desc
/admin/admin_pa_settings.php


define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('settings_dbname');

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_pa_file.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('short_desc','long_desc');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Add Categories

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /admin/admin_pa_category.php
----------------


Possible solution:
------------------
#
#-----[ OPEN ]------------------------------------------
#
/admin/admin_pa_category.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('addcategory');
#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Download de.scriptions

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /LOTL/admin/admin_pa_file.php
----------------

Request-Method: POST

Matching rule: or
In variable: short_desc

Matching rule: and
In variable: long_desc
/admin/admin_pa_settings.php

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/LOTL/admin/admin_pa_file.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('short_desc','long_desc');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Add download license

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /LOTL/admin/admin_pa_license.php
----------------

Request-Method: POST

Matching rule: create
In variable: form

Matching rule: or
In variable: form

Matching rule: and
In variable: form

Matching rule: load
In variable: form

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/LOTL/admin/admin_pa_license.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('form');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


This is getting to be addictive <img>

Re: CrackerTracker Exploit False Positives

PostPosted: Fri Mar 30, 2007 9:46 am
Author: mRvMan
So Ctracker is a little "paranoid" and gives you a few delays in getting things working just the way you want them...

As with ANY process, plan, software, idea, concept, etc, that involves the protection, prevention and anticipation of some sort of attack, violation, hack...the idea is to start with maximum security, as it were and set those things you wish to allow.

In essence you can consider yourself to be "teaching" CTracker how best to serve your board.

How long did it take you to learn to configure a board? It took some amount of time and effort - and there were mistakes made along the way.
Still, you learned from that, gained wisdom.

So now, you impart that onto CTracker.

And as was already stated here: IMod is a work in progress, ever evolving and improving with the help of us, its users.
If you feel you just "cannot wait.." then consider paying for a "finished product".
But when you do, remember, even they are consistently updating their product. Only now you will have paid money, on top of your time and effort.

Of all the different manifestations and "flavors" of php-based boards and forums, IMod is hands down by far the best one, with little "extra fat" - all of its mods have purpose and utility.
Though this is just my opinion, it is based on my humble experience of installing boards and forums since 1996.

Lastly, the more we all contribute to its improvement, bug-fixes, etc, the sooner we will all enjoy of one hell of a board <img>

Re: CrackerTracker Exploit False Positives

PostPosted: Fri Mar 30, 2007 1:55 pm
Author: odius
outta no where (that i know of) ctrack is now stoppin me from adding a new portal page, which i did fine before. all i can think of is that maybe cuz there's more than one user on my site now (a guest).. dont know what else could be different


this is weird cuz im addin a portal page, not a photo album.. also it says set to medium but it's already set to low, and I just got past the block by adding the page with only one word name "lipid" cuz anything else like "lipid peroxidation" with or without being followed by " - free radical" is blocked

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /album_personal_cat_admin.php
----------------

Request-Method: POST

Matching rule: create
In variable: addcategory

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/album_personal_cat_admin.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('addcategory');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Thu Apr 12, 2007 2:42 pm
Author: JohnnyTheOne
and the following
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /home/calendar_scheduler.php
----------------

Request-Method: GET

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/home/calendar_scheduler.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignoregvar = array('');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Apr 17, 2007 12:35 am
Author: geoff1
One for deleting download categories

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forums/admin/admin_pa_category.php
----------------

Request-Method: POST

Matching rule: delete
In variable: submit

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forums/admin/admin_pa_category.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('submit');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Be warned tho, although it does work properly it gives this error after you've deleted the category:

Warning: Invalid argument supplied for foreach() in /home/sfiregi/public_html/forums/pafiledb/includes/functions_pafiledb.php on line 1365

I'll ask about this in a new topic <img> The link to it is:

http://www.integramod.com/forum/viewtop ... 4114#24114

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Apr 17, 2007 3:43 am
Author: geoff1
One for altering the group de.scriptions:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forums/admin/admin_groups.php
----------------

Request-Method: POST

Matching rule: or
In variable: group_de.scription

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forums/admin/admin_groups.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('group_de.scription');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Apr 17, 2007 7:58 am
Author: Helter
this is what I have for admin_pa_catagory

Code: Select all
define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('addcategory','submit');


and for admin_groups

Code: Select all
define('CT_SECLEVEL', 'LOW');$ct_ignorepvar = array('new','group_name','group_de.scription','username');

Re: CrackerTracker Exploit False Positives

PostPosted: Sat Apr 28, 2007 4:05 pm
Author: zenrei
"Teelk";p="21549" wrote:Thanks guys for the contributions, they really are helping out.

For PCP Wizard, try opening up admin/admin_pcp_wizard.php and replacing the MEDIUM with LOW. That may solve all issues with the wizard.


what medium??

I just went into the php in edit mode and there isn't anything that says MEDIUM

Re: CrackerTracker Exploit False Positives

PostPosted: Sat May 05, 2007 9:16 am
Author: CaNNon
That was done in 2 parts, they added the medium then dropped it to low.
combined it should be like this.

Find ---> define('IN_PHPBB', 1);
Then add ---> define('CT_SECLEVEL', 'LOW');

PostPosted: Sat May 05, 2007 9:26 am
Author: zenrei
yeah... thanks <img> i didn't figure that out until later... i was having one of my dork moments

Re: CrackerTracker Exploit False Positives

PostPosted: Sun May 06, 2007 4:06 pm
Author: Juppertje
every whee is see here

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);



But i only have


define('IN_PHPBB', true);

so is this the same or have i also to replace define('IN_PHPBB', true); with define('IN_PHPBB', 1); ????

Re: CrackerTracker Exploit False Positives

PostPosted: Mon May 07, 2007 2:35 pm
Author: CaNNon
1 and true are the same, just add the line after it.

Re: CrackerTracker Exploit False Positives

PostPosted: Mon May 07, 2007 2:55 pm
Author: Juppertje
"CaNNon";p="24912" wrote:1 and true are the same, just add the line after it.


okay txs

PostPosted: Wed May 09, 2007 12:53 pm
Author: nGAGE
Just wondering... with all these fixes being posted... WHY do these problems happen in the first place? Shouldn't there be a patch to fix what's necessary if it's such a common problem? or are these problems not applicable on every install?
I (to be honest) find it an extreme pain in my behind and it takes me more time to fix this crap-tracker then to design an entire theme. Please find a solution for this! If necessary, post a tutorial on uninstalling crap-tracker from IM... as I've only had useless problems with it constantly banning my members for no reason or blocking me from doing the most common/basic admin tasks! This only prevents me from managing my site properly and I've got other things to do as well then to check .scripts everytime a function fails to co-operate.

Don't get me wrong! I love IM and I intend on using it, but the crap-tracker is more of a pain in the behind then it does good to me.

PostPosted: Wed May 09, 2007 1:01 pm
Author: ZacFields
ngage,

Not sure if you've tried my patch yet. There is a patch out there but it is very much a work-in-progress. I haven't updated it in a while but it solves the most basic problems with crackertracker. Mainly the admin-side stuff.

http://www.integramod.com/forum/viewtopic.php?t=2830

Zac

PostPosted: Wed May 09, 2007 3:17 pm
Author: nGAGE
Thnx... Truly appreciate that link. Missed that post! I'll surely post if I encounter anymore problems <img>

PostPosted: Mon May 14, 2007 10:54 am
Author: nGAGE
ADDING ALLOWED HTML-Code

OPEN admin/admin_board.php

FIND
Code: Select all
 define('IN_PHPBB', 1);  


AFTER ADD
Code: Select all
 define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('allow_html_tags',);  


IF $ct_ignorepvar EXISTS]  $ct_ignorepvar = array('***');  [/php]

*** = Being any code existing already

INLINE, FIND
Code: Select all
 );  


INLINE, REPLACE
Code: Select all
 ,'allow_html_tags');  

Re: CrackerTracker Exploit False Positives

PostPosted: Mon May 14, 2007 3:10 pm
Author: .QUACK.Major.Pain
I checked that file and already in my file from my original install.
Think someone beat you to it .

I'm still waiting for a fix to use html in posts. Trying to use paypal Buy Now button but only offered in html.

PostPosted: Mon May 14, 2007 3:36 pm
Author: nGAGE
Maybe I've overlooked it with the previous fixes posted here, but I've just been trying to make a collection of all of them on my own site as well, as I still have a theory about the patch mentioned somewhere that overwrites only the ctracker/engines/ct_security.php file to fix a lot of the CT issues.

It seems to me that it just adds all this stuff to be "Ignored" and I'm not sure that could have a "Global" effect and effect on the security itself! Fixing the individual files that actually cause problems seems a better bet to me, but ok... I'm not knowledgeable enough with php to make a proper statement!

Will try to find out more about that theory though and keep you all posted.

PostPosted: Wed May 16, 2007 3:52 pm
Author: nGAGE
Could be that I've overlooked this one somewhere, but still... here we go:

Creating KnowledgeBase Types

OPEN /admin/admin_kb_types.php

FIND
Code: Select all
 if ( file_exists( './../viewtopic.php' ) ){     define( 'IN_PHPBB', 1 );     define( 'IN_PORTAL', 1 );     define( 'MXBB_MODULE', false );  


AFTER ADD
Code: Select all
 define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('create','edit','delete');  


IF $ct_ignorepvar EXISTS
FIND / INLINE, FIND
Code: Select all
 $ct_ignorepvar = array(  


INLINE, AFTER ADD
Code: Select all
 'create','edit','delete',  




PS]http://www.net-clan-gaming.com/viewforum.php?f=54[/url]

Re: CrackerTracker Exploit False Positives

PostPosted: Sat May 26, 2007 4:04 am
Author: TheJT
i always get an allert in acp->Forum Admin->Management + -> Creat New Forum

sometimes when i try to write something under "De.scription" i get this allert

PostPosted: Sat May 26, 2007 10:23 pm
Author: nGAGE
There is a fix for that already, but nobody really posted here anymore... so I don't have my bookmarks to the patch anymore :-? ) It will have the fix though to solve your specifig issue and most of the common ones!
You may simply want to use the "Patch"-like edit, or do all the individual edits, either way... a lot of problems with CT will be solved. Personally I prefer editing the individual files, as I will then be assured that I only change something for that specific file and not globally, like the patch might do (not sure though).

Anyhow... have fun creating forums after this 8)

Re: CrackerTracker Exploit False Positives

PostPosted: Mon Jul 02, 2007 6:46 am
Author: Michalis
Hi guys.
Just wanted to say a few things. This integramod 1.4.1 is awsome. it has to be one of the best moded php i have come accross recently.
I have been a fan of & using in the past PHPBB2+. This Integramod 1.4.1 has opened my eyes & made my board more popular with its features in place.

I di have a few probs atm with the ct tracker on the board, I have searched on this forum for individual examples that effect me to & with no luck I did not find any help.

Also just to point out I have added the new ctracker patches & unfortunately my small problems are not fixed.

The problems I have are as follows.

1. Links SOLVED
I have added 2 links already to my board thru the ACP with no problem, but adding any more I get the dreaded pink box from the C Tracker. I really dont understand why this is causing me problems. (remember i have added the latest CT patch.).

1. Downloads SOLVED After making the catorgories for the Download section of the board I have come accross with another dreaded pink box when trying to ad info & files in file management.

Is there any individual fixes for the problems I have or can someone kindly help me resolve these issues. This has been bugging me for some time, I have been very patient in searching this forum for resolutions.

Thanx guys for reading this & hope someone maybe able to help.

Integramod definately rocks php

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Jul 10, 2007 12:03 pm
Author: Michalis
Well I have to say the following:

I finally managed to read all the posts in this perticular section & must say that i finally got round to understanding some of the fixes that most of you sorted.

I must admin this section does actually work, especially if somke of the members who post in this section could actually put the title what the debug or fix is for.
But anyway I managed to go thru this section & payed attention to the problems that i faced too. I went out of my way & followed the instruction of the fixes I needed to do. I must say thanx to all in this section for you effort in reporting the debugs / fixes that we have with the cool CTracker. I actually managed to fix some of my board with the advice here.

Links
Banners
Downloads

I still have a few minor probs now which have not been answered or have popped up again with a fault.

one of them is to do with the index permissions
http://www.integramod.com/forum/viewtop ... highlight=

& unread messages
http://www.integramod.com/forum/viewtop ... highlight=

also some of my members cannot enter registration cause they get the pink box & when I add them thru the ACP & they try to enter the forum again to login the box appears again. so that one has confused me alot..

But besides all that I really do love this new php version (integramod) real quality. I also noticed in this section a few members were impatient.
This is a shame because the main members who do all of this & give helpful advise are not robots, but human being who do need rest on a few occasions. Plus these fixes cannot be known unless people tell. But take it in mind this integramod is free of charge & we should be thankful that it is shared to the public.

So guys lets be patient if there is no fix on the other section of this board then this section may have your answer if not then relax & wait .

Thanx again for all your help that u have provided me in some of the fixes/help I needed. very much obliged...

Re: CrackerTracker Exploit False Positives

PostPosted: Wed Jul 18, 2007 12:38 pm
Author: Juppertje
I have done what is mentiomet below and afther i edited the file i still get


SECURITY ALERT ÂÂ » ÂÂ » ÂÂ » ÂÂ »
CBACK CrackerTracker has detected a potential attack on this site with a worm or exploit .script so the Security System stopped the .script.


If you can see this page after including a new MOD into your board or after clicking on a link please contact the Board Administrator with this error message and a de.scription what you have done before you could see this page, that the Admin has the possibility to fix the problem.



So now what?

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forum/admin/admin_kb_cat.php
----------------

Request-Method: POST

Matching rule: rm
In variable: catname

Matching rule: rm
In variable: catname

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forum/admin/admin_kb_cat.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('catname');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forum/admin/admin_kb_cat.php
----------------

Request-Method: POST

Matching rule: rm
In variable: catname

Matching rule: rm
In variable: catname

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forum/admin/admin_kb_cat.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('catname');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM


Here is the full admin_kb_cat.php file

Code: Select all
<php>sql_query( $sql ) )     {         message_die( GENERAL_ERROR, "Couldn't get list of forums", "", __LINE__, __FILE__, $sql );     }       $forumlist = '<select>';       if ( $sel_id == 0 )     $forumlist .= '<option> Select a Forum !</option>';         while ( $row = $db->sql_fetchrow( $result ) )     {         if ( $sel_id == $row['forum_id'] )         {             $status = "selected";         }         else         {             $status = '';         }         $forumlist .= '<option>' . $row['forum_name'] . '</option>';     }       $forumlist .= '</select>';       return $forumlist;}    if ( isset( $HTTP_POST_VARS['mode'] ) || isset( $HTTP_GET_VARS['mode'] ) ){     $mode = ( isset( $HTTP_POST_VARS['mode'] ) ) ? $HTTP_POST_VARS['mode'] : $HTTP_GET_VARS['mode'];}else{     if ( $create )     {         $mode = 'create';     }     else if ( $edit )     {         $mode = 'edit';     }     else if ( $delete )     {         $mode = 'delete';     }     else     {         $mode = '';     }}  switch ( $mode ){     case ( 'create' ):           if ( !$HTTP_POST_VARS['submit'] )         {             $new_cat_name = stripslashes( $HTTP_POST_VARS['new_cat_name'] );                         // Generate page                         $template->set_filenames( array( 'body' => 'admin/kb_cat_edit_body.tpl' )                 );               $template->assign_block_vars( 'switch_cat', array() );               $template->assign_vars( array( 'L_EDIT_TITLE' => $lang['Create_cat'],                     'L_EDIT_DESCRIPTION' => $lang['Create_de.scription'],                     'L_CATEGORY' => $lang['Category'],                     'L_DESCRIPTION' => $lang['Article_de.scription'],                     'L_NUMBER_ARTICLES' => $lang['Articles'],                     'L_CAT_SETTINGS' => $lang['Cat_settings'],                     'L_CREATE' => $lang['Create'],                     'L_PARENT' => $lang['Parent'],                     'L_NONE' => $lang['None'],                       'PARENT_LIST' => get_kb_cat_list( '', 0, 1, 0, 0, true ),                       'L_FORUM_ID' => $lang['Forum_id'],                     'L_FORUM_ID_EXPLAIN' => $lang['Forum_id_explain'],                     'FORUM_LIST' => get_forums( ),                       'S_ACTION' => append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=create" ),                     'CAT_NAME' => $new_cat_name,                     'DESC' => '',                     'NUMBER_ARTICLES' => '0',                                         // Category permissions                     'L_CAT_PERMISSIONS' => $lang['Category_Permissions'],                     'L_VIEW_LEVEL' => $lang['View_level'],                     'L_UPLOAD_LEVEL' => $lang['Upload_level'],                     'L_RATE_LEVEL' => $lang['Rate_level'],                     'L_COMMENT_LEVEL' => $lang['Comment_level'],                     'L_EDIT_LEVEL' => $lang['Edit_level'],                     'L_DELETE_LEVEL' => $lang['Delete_level'],                     'L_APPROVAL_LEVEL' => $lang['Approval_level'],                     'L_APPROVAL_EDIT_LEVEL' => $lang['Approval_edit_level'],                     'L_GUEST' => $lang['Forum_ALL'],                     'L_REG' => $lang['Forum_REG'],                     'L_PRIVATE' => $lang['Forum_PRIVATE'],                     'L_MOD' => $lang['Forum_MOD'],                     'L_ADMIN' => $lang['Forum_ADMIN'],                                         'L_DISABLED' => $lang['Disabled'],                                       'VIEW_GUEST' => 'selected="selected"',                     'UPLOAD_REG' => 'selected="selected"',                     'RATE_REG' => 'selected="selected"',                     'COMMENT_REG' => 'selected="selected"',                     'EDIT_REG' => 'selected="selected"',                     'DELETE_MOD' => 'selected="selected"',                     'APPROVAL_DISABLED' => 'selected="selected"',                                         'S_GUEST' => AUTH_ALL,                     'S_USER' => AUTH_REG,                     'S_PRIVATE' => AUTH_ACL,                     'S_MOD' => AUTH_MOD,                     'S_ADMIN' => AUTH_ADMIN                      ) );         }         else if ( $HTTP_POST_VARS['submit'] )         {             $cat_name = trim( $HTTP_POST_VARS['catname'] );               if ( !$cat_name )             {                 echo "Please put a category name in!";             }               $cat_desc = $HTTP_POST_VARS['catdesc'];             $parent = intval( $HTTP_POST_VARS['parent'] );             $comments_forum_id = intval( $HTTP_POST_VARS['forum_id'] );                         if ( $comments_forum_id == 0 )             {                 mx_message_die(GENERAL_MESSAGE , 'Select a Forum');               }             $view_level = intval( $HTTP_POST_VARS['auth_view'] );             $post_level = intval( $HTTP_POST_VARS['auth_post'] );             $rate_level = intval( $HTTP_POST_VARS['auth_rate'] );             $comment_level = intval( $HTTP_POST_VARS['auth_comment'] );             $edit_level = intval( $HTTP_POST_VARS['auth_edit'] );             $delete_level = intval( $HTTP_POST_VARS['auth_delete'] );             $approval_level = intval( $HTTP_POST_VARS['auth_approval'] );             $approval_edit_level = intval( $HTTP_POST_VARS['auth_approval_edit'] );               $sql = "SELECT MAX(cat_order) AS cat_order             FROM " . KB_CATEGORIES_TABLE . " WHERE parent = $parent";             if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, 'Could not obtain next type id', '', __LINE__, __FILE__, $sql );             }               if ( !( $id = $db->sql_fetchrow( $result ) ) )             {                 mx_message_die( GENERAL_ERROR, 'Could not obtain next type id', '', __LINE__, __FILE__, $sql );             }             $cat_order = $id['cat_order'] + 10;               $sql = "INSERT INTO " . KB_CATEGORIES_TABLE . " ( category_name, category_details, number_articles, parent, cat_order, auth_view, auth_post, auth_rate, auth_comment, auth_edit, auth_delete, auth_approval, auth_approval_edit, comments_forum_id)" . " VALUES                                                             ( '$cat_name', ' $cat_desc', '0',                 '$parent', '$cat_order', '$view_level', '$post_level', '$rate_level', '$comment_level', '$edit_level', '$delete_level', '$approval_level', '$approval_edit_level', '$comments_forum_id')";               if ( !( $results = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not create category", '', __LINE__, __FILE__, $sql );             }               $message = $lang['Cat_created'] . '<br><br>' . sprintf( $lang['Click_return_cat_manager'], '<a>', '</a>' ) . '<br><br>' . sprintf( $lang['Click_return_admin_index'], '<a>', '</a>' );               message_die( GENERAL_MESSAGE, $message );         }         break;       case ( 'edit' ):           if ( !$HTTP_POST_VARS['submit'] )         {             $cat_id = intval( $HTTP_GET_VARS['cat'] );               $sql = "SELECT * FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = " . $cat_id;               if ( !( $results = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not obtain category information", '', __LINE__, __FILE__, $sql );             }             if ( $kb_cat = $db->sql_fetchrow( $results ) )             {                 $cat_name = $kb_cat['category_name'];                 $cat_desc = $kb_cat['category_details'];                 $number_articles = $kb_cat['number_articles'];                 $parent = $kb_cat['parent'];                 $comments_forum_id = $kb_cat['comments_forum_id'];             }                         // Generate page                         $template->set_filenames( array( 'body' => 'admin/kb_cat_edit_body.tpl' )                 );               $template->assign_block_vars( 'switch_cat', array() );             $template->assign_block_vars( 'switch_cat.switch_edit_category', array() );               $template->assign_vars( array( 'L_EDIT_TITLE' => $lang['Edit_cat'],                     'L_EDIT_DESCRIPTION' => $lang['Edit_de.scription'],                     'L_CATEGORY' => $lang['Category'],                     'L_DESCRIPTION' => $lang['Article_de.scription'],                     'L_NUMBER_ARTICLES' => $lang['Articles'],                     'L_CAT_SETTINGS' => $lang['Cat_settings'],                     'L_CREATE' => $lang['Edit'],                       'L_PARENT' => $lang['Parent'],                     'L_NONE' => $lang['None'],                       'PARENT_LIST' => get_kb_cat_list( '', $parent, $parent, true, 0, true ),                       'S_ACTION' => append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=edit" ),                     'CAT_NAME' => $cat_name,                     'CAT_DESCRIPTION' => $cat_desc,                     'NUMBER_ARTICLES' => $number_articles,                       'L_FORUM_ID' => $lang['Forum_id'],                     'L_FORUM_ID_EXPLAIN' => $lang['Forum_id_explain'],                     'FORUM_LIST' => get_forums( $comments_forum_id ),                                         // Cat permissions                     'L_CAT_PERMISSIONS' => $lang['Category_Permissions'],                     'L_VIEW_LEVEL' => $lang['View_level'],                     'L_UPLOAD_LEVEL' => $lang['Upload_level'],                     'L_RATE_LEVEL' => $lang['Rate_level'],                     'L_COMMENT_LEVEL' => $lang['Comment_level'],                     'L_EDIT_LEVEL' => $lang['Edit_level'],                     'L_DELETE_LEVEL' => $lang['Delete_level'],                     'L_APPROVAL_LEVEL' => $lang['Approval_level'],                     'L_APPROVAL_EDIT_LEVEL' => $lang['Approval_edit_level'],                     'L_GUEST' => $lang['Forum_ALL'],                     'L_REG' => $lang['Forum_REG'],                     'L_PRIVATE' => $lang['Forum_PRIVATE'],                     'L_MOD' => $lang['Forum_MOD'],                     'L_ADMIN' => $lang['Forum_ADMIN'],                                         'L_DISABLED' => $lang['Disabled'],                                         'VIEW_GUEST' => ( $kb_cat['auth_view'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'VIEW_REG' => ( $kb_cat['auth_view'] == AUTH_REG ) ? 'selected="selected"' : '',                     'VIEW_PRIVATE' => ( $kb_cat['auth_view'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'VIEW_MOD' => ( $kb_cat['auth_view'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'VIEW_ADMIN' => ( $kb_cat['auth_view'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'UPLOAD_GUEST' => ( $kb_cat['auth_post'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'UPLOAD_REG' => ( $kb_cat['auth_post'] == AUTH_REG ) ? 'selected="selected"' : '',                     'UPLOAD_PRIVATE' => ( $kb_cat['auth_post'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'UPLOAD_MOD' => ( $kb_cat['auth_post'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'UPLOAD_ADMIN' => ( $kb_cat['auth_post'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'RATE_GUEST' => ( $kb_cat['auth_rate'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'RATE_REG' => ( $kb_cat['auth_rate'] == AUTH_REG ) ? 'selected="selected"' : '',                     'RATE_PRIVATE' => ( $kb_cat['auth_rate'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'RATE_MOD' => ( $kb_cat['auth_rate'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'RATE_ADMIN' => ( $kb_cat['auth_rate'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'COMMENT_GUEST' => ( $kb_cat['auth_comment'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'COMMENT_REG' => ( $kb_cat['auth_comment'] == AUTH_REG ) ? 'selected="selected"' : '',                     'COMMENT_PRIVATE' => ( $kb_cat['auth_comment'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'COMMENT_MOD' => ( $kb_cat['auth_comment'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'COMMENT_ADMIN' => ( $kb_cat['auth_comment'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'EDIT_REG' => ( $kb_cat['auth_edit'] == AUTH_REG ) ? 'selected="selected"' : '',                     'EDIT_PRIVATE' => ( $kb_cat['auth_edit'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'EDIT_MOD' => ( $kb_cat['auth_edit'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'EDIT_ADMIN' => ( $kb_cat['auth_edit'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'DELETE_REG' => ( $kb_cat['auth_delete'] == AUTH_REG ) ? 'selected="selected"' : '',                     'DELETE_PRIVATE' => ( $kb_cat['auth_delete'] == AUTH_ACL ) ? 'selected="selected"' : '',                     'DELETE_MOD' => ( $kb_cat['auth_delete'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'DELETE_ADMIN' => ( $kb_cat['auth_delete'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                       'APPROVAL_DISABLED' => ( $kb_cat['auth_approval'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'APPROVAL_MOD' => ( $kb_cat['auth_approval'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'APPROVAL_ADMIN' => ( $kb_cat['auth_approval'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                                             'APPROVAL_EDIT_DISABLED' => ( $kb_cat['auth_approval_edit'] == AUTH_ALL ) ? 'selected="selected"' : '',                     'APPROVAL_EDIT_MOD' => ( $kb_cat['auth_approval_edit'] == AUTH_MOD ) ? 'selected="selected"' : '',                     'APPROVAL_EDIT_ADMIN' => ( $kb_cat['auth_approval_edit'] == AUTH_ADMIN ) ? 'selected="selected"' : '',                                     'S_GUEST' => AUTH_ALL,                     'S_USER' => AUTH_REG,                     'S_PRIVATE' => AUTH_ACL,                     'S_MOD' => AUTH_MOD,                     'S_ADMIN' => AUTH_ADMIN,                         'S_HIDDEN' => '<input>' )                 );         }         else if ( $HTTP_POST_VARS['submit'] )         {             $cat_id = intval( $HTTP_POST_VARS['catid'] );             $cat_name = trim( $HTTP_POST_VARS['catname'] );             $cat_desc = $HTTP_POST_VARS['catdesc'];             $number_articles = intval( $HTTP_POST_VARS['number_articles'] );             $parent = intval( $HTTP_POST_VARS['parent'] );             $comments_forum_id = intval( $HTTP_POST_VARS['forum_id'] );                         $view_level = intval( $HTTP_POST_VARS['auth_view'] );             $post_level = intval( $HTTP_POST_VARS['auth_post'] );             $rate_level = intval( $HTTP_POST_VARS['auth_rate'] );             $comment_level = intval( $HTTP_POST_VARS['auth_comment'] );             $edit_level = intval( $HTTP_POST_VARS['auth_edit'] );             $delete_level = intval( $HTTP_POST_VARS['auth_delete'] );             $approval_level = intval( $HTTP_POST_VARS['auth_approval'] );             $approval_edit_level = intval( $HTTP_POST_VARS['auth_approval_edit'] );                 if ( !$cat_name )             {                 echo "Please put a category name in!";             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET category_name = '" . $cat_name . "', category_details = '" . $cat_desc . "', number_articles = '" . $number_articles . "', parent = '" . $parent . "', auth_view = '" . $view_level . "', auth_post = '" . $post_level . "', auth_rate = '" . $rate_level . "', auth_comment = '" . $comment_level . "', auth_edit = '" . $edit_level . "', auth_delete = '" . $delete_level . "', auth_approval = '" . $approval_level . "', auth_approval_edit = '" . $approval_edit_level . "', comments_forum_id = '" . $comments_forum_id . "' WHERE category_id = " . $cat_id;               if ( !( $results = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update category", '', __LINE__, __FILE__, $sql );             }               $message = $lang['Cat_edited'] . '<br><br>' . sprintf( $lang['Click_return_cat_manager'], '<a>', '</a>' ) . '<br><br>' . sprintf( $lang['Click_return_admin_index'], '<a>', '</a>' );               mx_message_die( GENERAL_MESSAGE, $message );         }         break;       case ( 'delete' ):           if ( !$HTTP_POST_VARS['submit'] )         {             $cat_id = $HTTP_GET_VARS['cat'];               $sql = "SELECT *                 FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = '" . $cat_id . "'";               if ( !( $cat_result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not obtain category information", '', __LINE__, __FILE__, $sql );             }               if ( $category = $db->sql_fetchrow( $cat_result ) )             {                 $cat_name = $category['category_name'];             }                         // Generate page                         $template->set_filenames( array( 'body' => 'admin/kb_cat_del_body.tpl' )                 );               $template->assign_vars( array( 'L_DELETE_TITLE' => $lang['Cat_delete_title'],                     'L_DELETE_DESCRIPTION' => $lang['Cat_delete_desc'],                     'L_CAT_DELETE' => $lang['Cat_delete_title'],                     'L_DELETE_ARTICLES' => $lang['Delete_all_articles'],                       'L_CAT_NAME' => $lang['Article_category'],                     'L_MOVE_CONTENTS' => $lang['Move_contents'],                     'L_DELETE' => $lang['Move_and_Delete'],                       'S_HIDDEN_FIELDS' => '<input>',                     'S_SELECT_TO' => get_kb_cat_list( '', $cat_id, 0, true, 0, true ),                     'S_ACTION' => append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=delete" ),                       'CAT_NAME' => $cat_name )                 );         }         else if ( $HTTP_POST_VARS['submit'] )         {             $new_category = $HTTP_POST_VARS['move_id'];             $old_category = $HTTP_POST_VARS['catid'];               if ( $new_category != '0' )             {                 $sql = "UPDATE " . KB_ARTICLES_TABLE . " SET article_category_id = '$new_category'                WHERE article_category_id = '$old_category'";                   if ( !( $move_result = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not move articles", '', __LINE__, __FILE__, $sql );                 }                   $sql = "SELECT *                    FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = '$new_category'";                   if ( !( $cat_result = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not get category data", '', __LINE__, __FILE__, $sql );                 }                   if ( $new_cat = $db->sql_fetchrow( $cat_result ) )                 {                     $new_articles = $new_cat['number_articles'];                 }                   $sql = "SELECT *                    FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = '$old_category'";                   if ( !( $oldcat_result = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not get category data", '', __LINE__, __FILE__, $sql );                 }                   if ( $old_cat = $db->sql_fetchrow( $oldcat_result ) )                 {                     $old_articles = $old_cat['number_articles'];                 }                   $number_articles = $new_articles + $old_articles;                   $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET number_articles = '" . $number_articles . "' WHERE category_id = " . $new_category;                   if ( !( $number_result = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not update articles number", '', __LINE__, __FILE__, $sql );                 }             }             else             {                 $sql = "DELETE FROM " . KB_ARTICLES_TABLE . "                         WHERE article_category_id = " . $old_category;                 if ( !( $delete__articles = $db->sql_query( $sql ) ) )                 {                     mx_message_die( GENERAL_ERROR, "Could not delete articles", '', __LINE__, __FILE__, $sql );                 }             }               $sql = "DELETE FROM " . KB_CATEGORIES_TABLE . " WHERE category_id = $old_category";               if ( !( $delete_result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not delete category", '', __LINE__, __FILE__, $sql );             }               $message = $lang['Cat_deleted'] . '<br><br>' . sprintf( $lang['Click_return_cat_manager'], '<a>', '</a>' ) . '<br><br>' . sprintf( $lang['Click_return_admin_index'], '<a>', '</a>' );               mx_message_die( GENERAL_MESSAGE, $message );         }         break;       default:           if ( $mode == "up" )         {             $cat_id = $HTTP_GET_VARS['cat'];               $sql = "SELECT *              FROM " . KB_CATEGORIES_TABLE . "            WHERE category_id = $cat_id";               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not get category data", '', __LINE__, __FILE__, $sql );             }               if ( $category = $db->sql_fetchrow( $result ) )             {                 $parent = $category['parent'];                 $old_pos = $category['cat_order'];                 $new_pos = $old_pos-10;             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET            cat_order = '" . $old_pos . "'            WHERE parent = " . $parent . " AND cat_order = " . $new_pos;               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update order", '', __LINE__, __FILE__, $sql );             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET            cat_order = '" . $new_pos . "'            WHERE category_id = " . $cat_id;               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update order", '', __LINE__, __FILE__, $sql );             }         }           if ( $mode == "down" )         {             $cat_id = $HTTP_GET_VARS['cat'];               $sql = "SELECT *              FROM " . KB_CATEGORIES_TABLE . "            WHERE category_id = $cat_id";               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not get category data", '', __LINE__, __FILE__, $sql );             }               if ( $category = $db->sql_fetchrow( $result ) )             {                 $parent = $category['parent'];                 $old_pos = $category['cat_order'];                 $new_pos = $old_pos + 10;             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET            cat_order = '" . $old_pos . "'            WHERE parent = " . $parent . " AND cat_order = " . $new_pos;               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update order", '', __LINE__, __FILE__, $sql );             }               $sql = "UPDATE " . KB_CATEGORIES_TABLE . " SET            cat_order = '" . $new_pos . "'            WHERE category_id = " . $cat_id;               if ( !( $result = $db->sql_query( $sql ) ) )             {                 mx_message_die( GENERAL_ERROR, "Could not update order", '', __LINE__, __FILE__, $sql );             }         }                 // Generate page                 $template->set_filenames( array( 'body' => 'admin/kb_cat_admin_body.tpl' )             );           $template->assign_vars( array( 'L_KB_CAT_TITLE' => $lang['Cat_man'],                 'L_KB_CAT_DESCRIPTION' => $lang['KB_cat_de.scription'],                   'L_CREATE_CAT' => $lang['Create_cat'],                 'L_CREATE' => $lang['Create'],                 'L_CATEGORY' => $lang['Article_category'],                 'L_ACTION' => $lang['Art_action'],                 'L_ARTICLES' => $lang['Articles'],                 'L_ORDER' => $lang['Update_order'],                   'S_ACTION' => append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=create" ) )             );         // get categories         $sql = "SELECT *                 FROM " . KB_CATEGORIES_TABLE . "             WHERE parent = 0 ORDER BY cat_order ASC";           if ( !( $cat_result = $db->sql_query( $sql ) ) )         {             mx_message_die( GENERAL_ERROR, "Could not obtain category information", '', __LINE__, __FILE__, $sql );         }           $ss = 0;         while ( $category = $db->sql_fetchrow( $cat_result ) )         {             $category_details = $category['category_details'];             $category_articles = $category['number_articles'];               $category_id = $category['category_id'];             $category_name = $category['category_name'];             $temp_url = append_sid( $module_root_path . "kb.$phpEx?mode=cat&cat=$category_id" );             $category_link = '<a>' . $category_name . '</a>';               $temp_url = append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=edit&cat=$category_id" );             $edit = '<a><img></a>';               $temp_url = append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=delete&cat=$category_id" );             $delete = '<a><img></a>';               $temp_url = append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=up&cat=$category_id" );             $up = '<a>' . $lang['Move_up'] . '</a>';               $temp_url = append_sid( $module_root_path . "admin/admin_kb_cat.$phpEx?mode=down&cat=$category_id" );             $down = '<a>' . $lang['Move_down'] . '</a>';               $row_color = ( !( $ss % 2 ) ) ? $theme['td_color1'] : $theme['td_color2'];             $row_class = ( !( $ss % 2 ) ) ? $theme['td_class1'] : $theme['td_class2'];               $template->assign_block_vars( 'catrow', array( 'CATEGORY' => $category_link,                     'CAT_DESCRIPTION' => $category_details,                     'CAT_ARTICLES' => $category_articles,                       'U_EDIT' => $edit,                     'U_DELETE' => $delete,                     'U_UP' => $up,                     'U_DOWN' => $down,                       'ROW_COLOR' => '#' . $row_color,                     'ROW_CLASS' => $row_class )                 );               $i++;             $ss++;             $ss = get_kb_cat_subs_admin( $category_id, '1', '    ', $ss );         }         break;}  $template->pparse( 'body' );include_once( $mx_root_path . 'admin/page_footer_admin.' . $phpEx );  ?>

PostPosted: Sat Aug 18, 2007 7:38 am
Author: Master Dwarf
For Merging Topics

#
#-----[ OPEN ]------------------------------------------
#
/yourportalroot/merge.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', True);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('topic_title');

Re: CrackerTracker Exploit False Positives

PostPosted: Mon Oct 01, 2007 3:33 am
Author: jomasaco
And for the global news on Crack Tracker.
when i try to put a msg always gives me that stupid error, and i canÂÂ ´t pass this out.
what is the fix?

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Nov 06, 2007 2:24 pm
Author: salmercker
ok deos anyone have the fix for the album_cat ? i did what ctracker told me and im still getting that error. everytime i try to create a new catagory. im about to just say screw it and do a work around by renaming the folder lol

also not sure if this is conserning ctracker or not but also get this error after i try to view a photo uploaded.

Fatal error: Cannot redeclare acronym_pass() (previously declared in /home/dragosia/public_html/album_mod/album_bbcode.php:3597) in /home/dragosia/public_html/includes/bbcode.php on line 1422

Re: CrackerTracker Exploit False Positives

PostPosted: Tue Nov 06, 2007 6:07 pm
Author: CaNNon
I didn't need any for that file, could you post your debug info?

Re: CrackerTracker Exploit False Positives

PostPosted: Sat Nov 10, 2007 10:32 am
Author: ThePlague
Trying to set avtars to display as always because non members cannot see them.
PCP Wizzard >> Alter Page Display >> user_avatar


Debug Info:

Code: Select all
   ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Script-Filename]------------------------------------------#/admin/admin_pcp_wizard.php  ##-----[ FIND ]------------------------------------------#require('./pagestart.' . $phpEx);  ##-----[ AFTER, ADD ]------------------------------------------#define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('style_user_rank_title','style_user_warnings');  ##-----[ SAVE/CLOSE ALL FILES ]------------------------------------------## EoM    



Debug Does Not Work. Anyone Have A Fix?