Bug Reports · Legacy archive
3.0 Bug Bounty Quest Bug Tracker
-
Re: 3.0 Bug Bounty Quest Bug Tracker
#81For reference, one way to circumvent some of the limitations of the sub editor is to build your HTML in word or the like, save the file, clip out the extrenous junk, and paste it in html mode.
Eg. http://readpostplay.com/viewing/3428
Not a finished effort by far, but an idea of what is possible. -
Re: 3.0 Bug Bounty Quest Bug Tracker
#82Another note:
In the Quick menu, Chat is not an active link.
Klik hier voor een spoiler
{content}
-
Re: 3.0 Bug Bounty Quest Bug Tracker
#83Buhuuu
|| ping -i 30 127.0.0.1 ; x || ping -n 30 127.0.0.1 & ping -i 30 127.0.0.1 & ping -n 30 127.0.0.1 & ; %0a ping 127.0.0.1 ; ping -i 30 127.0.0.1 %0a ` ping 127.0.0.1
Didn't work
:(
;) -
Re: 3.0 Bug Bounty Quest Bug Tracker
#84
When in a category, and I click Add Submisison, type of submission is not filled in from where I was.
Little thing, but still.
One of the sacrifices of being secure and the small rethink of it not being as handy as it might have been. Just because I am browsing locations and get an idea, doesn't mean I have a location idea...Plus, with the change of not using $_GET variables, it makes it more difficult to pass things in the url.
For now, going to vote to leave as is. But once we start rolling with it, if the masses call for it...I will figure it out! 5xp -
Re: 3.0 Bug Bounty Quest Bug Tracker
#85Fatal error: Call to undefined function smf_logError() in /home/admin/domains/readpostplay.com/public_html/lockmor/application/helpers/smf_api_helper.php on line 523
When I tried to enter invalid login parameters.
(I tried to login as you, sire) :)
Correction: I tried, failed and succeeded. I am currently logged in as Strolen.
http://www.coldforged.net/strolen.JPG
Location: header graphic login field, above the search. -
Re: 3.0 Bug Bounty Quest Bug Tracker
#86TIP: The hack I used is rejected by SMF. Use the SMF login routine instead, it seems safer.
I also posted a private sub as you Strolen. It is only viewable by... you. (and me :p)
http://readpostplay.com/viewing/4860 -
Re: 3.0 Bug Bounty Quest Bug Tracker
#87
TIP: The hack I used is rejected by SMF. Use the SMF login routine instead, it seems safer.
I also posted a private sub as you Strolen. It is only viewable by... you. (and me :p)
http://readpostplay.com/viewing/4860
You are my hero. ;)
I dodged the full smf routine because it is a beast an annoying to include. Apparently it is worth it though. LOL.
Oh, well. Guess the logout in the main site will soon work for sure!
Good work Strolen....or AG...or.....whomever you want. -
Re: 3.0 Bug Bounty Quest Bug Tracker
#88
Alright you need to improve search!
A Database Error Occurred
Error Number: 1064
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'select * from users' IN BOOLEAN MODE) * 10) + (MATCH (title) AGAINST ('//--'--se' at line 1
SELECT (MATCH (desc1) AGAINST ('//--'--select * from users' IN BOOLEAN MODE) * 10) + (MATCH (title) AGAINST ('//--'--select * from users' IN BOOLEAN MODE) * 100) + (MATCH (summary) AGAINST ('//--'--select * from users' IN BOOLEAN MODE) * 75) AS 'score', golden, quest_win, title, title_link, summary, author_id, date_submitted, content_id, idea_scroll, type_id, parent1_id, parent2_id, scroll_count, cond, quest, comment_count, hits, votes, (ratings/votes) AS rating, member_name FROM (`smf_members`) JOIN `lockmor_content` ON `id_member` = `author_id` WHERE `show_content` = '1' AND MATCH (desc1 , title , summary ) AGAINST ('//--'--select * from users' IN BOOLEAN MODE) ORDER BY `score` DESC LIMIT 20
I may have to rewrite that 497 line monster query builder but I think it won't error like that any more. Test me again please?
100xp -
Re: 3.0 Bug Bounty Quest Bug Tracker
#89
Try clicking:
http://readpostplay.com/viewing/
and you get this:
Fatal error: Allowed memory size of 20971520 bytes exhausted (tried to allocate 22311 bytes) in /home/admin/domains/readpostplay.com/public_html/lockmor/database/drivers/mysql/mysql_result.php on line 162
Furhermore, if you create an invalid link... Well, click this:
http://readpostplay.com/view
That 404 message wasn't pretty, right?
Another one:
http://readpostplay.com/viewing/select%20*%20from%20users;
Not pretty
Viewing issue modified. Don't have a good solution for looking for absolutely no sub so just redirected to the Exploring task page as an arbitrary choice. Didn't think to look for a nonvalue! 50xp
The other two, as long as they are going to error pages, I am happy for now. I don't want to customize those until we go final with a format as I will have to handcode the entire page. Made sure it was in my notebook. 10xp -
Re: 3.0 Bug Bounty Quest Bug Tracker
#90
When I am logged out there is a strange black line under "Quick" when I perform a mouseover.
Is that still there? I did a lot of work with the menu. 5xp -
Re: 3.0 Bug Bounty Quest Bug Tracker
#91
Menu problem seems to be gone now.
Minor: While main page has simple, untextured areas, the dropdown menu backgrounds are still that of the prior 'theme'.
Also, 100 votes for level 10 seems excessive :P
The graphics might continue to be a problem till we go mostly final with the main theme. Since only the grahpics are changing for now, when I do css updates to the main site I copy and paste that into the non-graphic theme and then remove the graphic calls. Much easier than keeping track of all the changes I may make. Once we about final on the header then I will take the time to make the graphicless look better. 5xp
The votes are generic so I don't have to reset them allowing for mad testing. The nightly update will go up when we go live that resets them like the current citadel. -
Re: 3.0 Bug Bounty Quest Bug Tracker
#92
I see something called regions. How does one make one?
Oh dear. :)
They do sort of work right now. But they will require another thread I think. A large new part of 3.0 that is still being built. Look for another thread in this forum soon. 10xp for being the first to ask about them.
For a quick answer to the question though, only admins make them. They will be created from large freetexts. So if you are building a world and have all your freetexts with your world name, you can eventually request a region and will get your own page. The admin will open up a region for your world that you will then control. -
Re: 3.0 Bug Bounty Quest Bug Tracker
#93You fixed the search query field alright, so I popped up the advanced search option fields and voila... when using the author text box I got this:
A Database Error Occurred
Error Number: 1064
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1
SELECT id_member FROM smf_members WHERE member_name = ''--'
[quote author=Ancient Gamer link=topic=4801.msg63551#msg63551 date=1241007113]
Alright you need to improve search!
A Database Error Occurred
Error Number: 1064
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'select * from users' IN BOOLEAN MODE) * 10) + (MATCH (title) AGAINST ('//--'--se' at line 1
SELECT (MATCH (desc1) AGAINST ('//--'--select * from users' IN BOOLEAN MODE) * 10) + (MATCH (title) AGAINST ('//--'--select * from users' IN BOOLEAN MODE) * 100) + (MATCH (summary) AGAINST ('//--'--select * from users' IN BOOLEAN MODE) * 75) AS 'score', golden, quest_win, title, title_link, summary, author_id, date_submitted, content_id, idea_scroll, type_id, parent1_id, parent2_id, scroll_count, cond, quest, comment_count, hits, votes, (ratings/votes) AS rating, member_name FROM (`smf_members`) JOIN `lockmor_content` ON `id_member` = `author_id` WHERE `show_content` = '1' AND MATCH (desc1 , title , summary ) AGAINST ('//--'--select * from users' IN BOOLEAN MODE) ORDER BY `score` DESC LIMIT 20
I may have to rewrite that 497 line monster query builder but I think it won't error like that any more. Test me again please?
100xp
-
Re: 3.0 Bug Bounty Quest Bug Tracker
#94I decided to view my own profile and clicked "plots" under that. http://readpostplay.com/browse_author/Ancient%20Gamer/1
Then I ordered and rearranged some, resulting in that whichever sub name link I decided to click I got to this page (instead of the submission)
http://readpostplay.com/exploring
Major correction:
this seems to be happening whatever sub I am trying to view, from wherever.
Smells like a ripple effect bug from a previous bugfix.
using IE 7 at the moment (at my sister's place) -
Re: 3.0 Bug Bounty Quest Bug Tracker
#95Ditto here as BH on firefox. _All_ links to subs redirect to http://readpostplay.com/exploring -
Re: 3.0 Bug Bounty Quest Bug Tracker
#96A PHP Error was encountered
Severity: Notice
Message: Undefined index: search
Filename: controllers/hunting.php
Line Number: 25
A PHP Error was encountered
Severity: Warning
Message: Cannot modify header information - headers already sent by (output started at /home/admin/domains/readpostplay.com/public_html/lockmor/libraries/Exceptions.php:164)
Filename: libraries/Session.php
Line Number: 662
when accessing http://readpostplay.com/hunting as BH -
Re: 3.0 Bug Bounty Quest Bug Tracker
#97same for /hunting/search -
Re: 3.0 Bug Bounty Quest Bug Tracker
#98
TIP: The hack I used is rejected by SMF. Use the SMF login routine instead, it seems safer.
I also posted a private sub as you Strolen. It is only viewable by... you. (and me :p)
http://readpostplay.com/viewing/4860
OK, redid the entire frick'n authentication on the main site. ;)
I have no idea why (at least on mine) the logout is dangling in the "Quick" menu like it is, but the logout works now too.
Give that a shot AG! 200xp
Still looking at moving to 3.0 possibly tomorrow night. Get your big requests in. -
Re: 3.0 Bug Bounty Quest Bug Tracker
#99Bad redirects: AG, dark, and manfred. Was an error that came from an attempted fix. Didn't do any kind of in depth ops check on that. Thanks!! 10xp -
Re: 3.0 Bug Bounty Quest Bug Tracker
#100
You fixed the search query field alright, so I popped up the advanced search option fields and voila... when using the author text box I got this:
A Database Error Occurred
Error Number: 1064
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1
SELECT id_member FROM smf_members WHERE member_name = ''--'
[quote author=Strolen link=topic=4801.msg63626#msg63626 date=1241278118]
[quote author=Ancient Gamer link=topic=4801.msg63551#msg63551 date=1241007113]
Alright you need to improve search!
A Database Error Occurred
Error Number: 1064
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'select * from users' IN BOOLEAN MODE) * 10) + (MATCH (title) AGAINST ('//--'--se' at line 1
SELECT (MATCH (desc1) AGAINST ('//--'--select * from users' IN BOOLEAN MODE) * 10) + (MATCH (title) AGAINST ('//--'--select * from users' IN BOOLEAN MODE) * 100) + (MATCH (summary) AGAINST ('//--'--select * from users' IN BOOLEAN MODE) * 75) AS 'score', golden, quest_win, title, title_link, summary, author_id, date_submitted, content_id, idea_scroll, type_id, parent1_id, parent2_id, scroll_count, cond, quest, comment_count, hits, votes, (ratings/votes) AS rating, member_name FROM (`smf_members`) JOIN `lockmor_content` ON `id_member` = `author_id` WHERE `show_content` = '1' AND MATCH (desc1 , title , summary ) AGAINST ('//--'--select * from users' IN BOOLEAN MODE) ORDER BY `score` DESC LIMIT 20
I may have to rewrite that 497 line monster query builder but I think it won't error like that any more. Test me again please?
100xp
Too...many.....query........variablessssss
OK, try again on the search part deux: 50xp
Thanks to all for the continued digging. If we are getting to this kind of stuff I am thinking the rest must work at least reasonably well.
Anybody able to duplicate Valadaar's submission input error? -
Re: 3.0 Bug Bounty Quest Bug Tracker
#101
In http://readpostplay.com/helping
The last section shows links to several subs in work, but clicking on the links gets you eaten by a grue unless they are your own subs.
That one ended up being a good one. In-Work were not viewable unless you were the author even if they were public. 100xp -
Re: 3.0 Bug Bounty Quest Bug Tracker
#102Am I caught up again? -
Re: 3.0 Bug Bounty Quest Bug Tracker
#103Nope - I tried logging in and got 'open_basedir restrictions in effect'.
File (/home/strolen/public_html/guild/Themes/babylon/languages/index.english.php) is not the allowed path(s)(
Trying another browser:
Same issue in firefox.
Line number 1705, 1721, 1530
But if I scroll down further it appears to be otherwise -
Re: 3.0 Bug Bounty Quest Bug Tracker
#104Is that error there all the time on all the pages?
If only on certain pages, can you give me links. That error should pop up on everybody but I want to see it before I start modifying server files.
Also, can you try switching out of babylon to something else and see if that error is still there.
Thanks val!! -
Re: 3.0 Bug Bounty Quest Bug Tracker
#105Yep, forum issue. Will see if it exists during the changeover. If so, I will rebuild those forum themes. Some kind of permissions issue. Stick with smf default theme or lockmor for now. 10xp -
Re: 3.0 Bug Bounty Quest Bug Tracker
#106I could do a deeper hack search, but I am somewhat doubtful as to whether it would benefit the site development issue.
Perhaps I should check for cookie hacks, as well as create an enumerated list of links that I could target, but beyond that... Well, if people really want in they will get in. You have already plugged the most obvious holes in the citadel walls.
So I will do some cookie hack thingies as well as scan the site for obvious security holes that those damned hackers would use. Then I will leave the site as it is. No point in going to Microsoft extremes paranoia-wise.
Agreed?
Covered hacking attempts:
SQL Injection - vulnerable - fixed
OS Command injection - not vulnerable
Path traversal - not vulnerable
Authentication attacks - vulnerable - fixed
Cookies authentication - not tested yet
Site mapping (looking for leftover admin functionality and URLs) - not tested yet
Obviously there is a huge amount of web app hacks that I have NOT tested. These includes stuff such as session hijacking, exploiting flaws in access control logic, source code vulnerabilities, bypassing sql injection using encoding, brute force attacks (I actually suspect the site is somewhat vulnerable to those), and so on. Twisting the application logic is something we do every day, so those hacks will be shown to you by the citadellians in due time.
I salude you for taking these vulnerabilities I have shown you seriously (some people I know would have been annoyed and growled and cursed at me, he-he-he). The site has been hacked in the past and now at least we should be somewhat more secure. -
Re: 3.0 Bug Bounty Quest Bug Tracker
#107The part deux search field bug is still there.
Try using '-- as search criteria
Login and logout works (painfully) well now. No immediately obvious bugs.
Links also work now. -
Re: 3.0 Bug Bounty Quest Bug Tracker
#108Cannot get to the link that allows me to change my profile. Can you change it for me?
-
Re: 3.0 Bug Bounty Quest Bug Tracker
#109Changed -
Re: 3.0 Bug Bounty Quest Bug Tracker
#110Clicking on one of the "authors online" gives you a 404 when you are logged out. -
Re: 3.0 Bug Bounty Quest Bug Tracker
#111My account works now. -
Re: 3.0 Bug Bounty Quest Bug Tracker
#1121. I lose my session everytime I click "Main Citadel" -
Re: 3.0 Bug Bounty Quest Bug Tracker
#113About that header field where you broadcast news:
News:Sorry about the forum sort order. Any admin can go ahead and fix it but it is late and I am too darn tired to get into that. Wanted to get the forum theme off to a good start.
I think it should say "The Voice of Strolen" instead of news. :)
Or perhaps "Mouth of Strolen" as a reference to LotR? Hehehe -
Re: 3.0 Bug Bounty Quest Bug Tracker
#114Val: Spoilers are enabled on the forum now.
This is for valadaar! -
Re: 3.0 Bug Bounty Quest Bug Tracker
#115Tried it here, and well,
Sorry - you don't have the proper permissions to post spoilers.
on Readpostplay forum, it doesn't work at all - the tag shows in plain text using square brackets.
-
Re: 3.0 Bug Bounty Quest Bug Tracker
#116Fixed. Only loaded it on this forum since the other will be dissappearing in the next couple weeks.
Didn't know there was a permissions setting for it. -
Re: 3.0 Bug Bounty Quest Bug Tracker
#117Think you will need to login with a different account to test, since it still does not work for me.
Sorry - you don't have the proper permissions to post spoilers.
I must be using the right syntax, since it sends that message. (spoiler)Stuff(/spoiler) where ( = [.
-
Re: 3.0 Bug Bounty Quest Bug Tracker
#118
I could do a deeper hack search, but I am somewhat doubtful as to whether it would benefit the site development issue.
Perhaps I should check for cookie hacks, as well as create an enumerated list of links that I could target, but beyond that... Well, if people really want in they will get in. You have already plugged the most obvious holes in the citadel walls.
So I will do some cookie hack thingies as well as scan the site for obvious security holes that those damned hackers would use. Then I will leave the site as it is. No point in going to Microsoft extremes paranoia-wise.
Agreed?
Covered hacking attempts:
SQL Injection - vulnerable - fixed
OS Command injection - not vulnerable
Path traversal - not vulnerable
Authentication attacks - vulnerable - fixed
Cookies authentication - not tested yet
Site mapping (looking for leftover admin functionality and URLs) - not tested yet
Obviously there is a huge amount of web app hacks that I have NOT tested. These includes stuff such as session hijacking, exploiting flaws in access control logic, source code vulnerabilities, bypassing sql injection using encoding, brute force attacks (I actually suspect the site is somewhat vulnerable to those), and so on. Twisting the application logic is something we do every day, so those hacks will be shown to you by the citadellians in due time.
I salude you for taking these vulnerabilities I have shown you seriously (some people I know would have been annoyed and growled and cursed at me, he-he-he). The site has been hacked in the past and now at least we should be somewhat more secure.
Sweet! Agreed. Very happy with what was found. (still got the '-- to mess with a little though).
New site will end up with most of the actual code above public_html so all that is available will be the index.php so no real fear of exploiting direct through the php. Codeigniter is pretty good at restricting access to the good stuff anyway.
Thanks for taking the time with it all! Feel free to PM me the login exploit as I am pretty curious. :) -
Re: 3.0 Bug Bounty Quest Bug Tracker
#119OK, try again please, Val. Sorry it is a pain. Have no idea which checkbox needs to be clicked so clicked them all. :) -
Re: 3.0 Bug Bounty Quest Bug Tracker
#120Works now! Thanks Strolen!
Test
Apparently spoilers are harder then they seem...