Penny Arcade Forums› H.Q. Reception Desk
The Coin Return Foundational Fundraiser is here! Please donate!

Code updates

ÄlphämönkëyÄlphämönkëy Registered User regular
edited April 2004 in H.Q. Reception Desk
I made a ton of code changes tonight as phpBB released yet another security patch.

If you notice something funky, tell me.

Älphämönkëy on

Posts

  • DogDog Registered User, Administrator, Vanilla Staff admin
    edited March 2004
    Anything in particular we should be looking for?

    Also, I cheated on you with deni. :cry:
    I'm sorry. :(

    Unknown User on
  • Raijin QuickfootRaijin Quickfoot I'm your Huckleberry YOU'RE NO DAISYRegistered User, ClubPA regular
    edited March 2004
    SeñorAmor wrote:
    Anything in particular we should be looking for?

    Also, I cheated on you with deni. :cry:
    I'm sorry. :(
    Hussy.

    Raijin Quickfoot on
  • ÄlphämönkëyÄlphämönkëy Registered User regular
    edited March 2004
    SeñorAmor wrote:
    Anything in particular we should be looking for?

    Also, I cheated on you with deni. :cry:
    I'm sorry. :(
    Mostly random redirect errors. I trust the phpBB guys though, they do a good job, so I dont think there will be any problems.


    :shock:
    You cheating bastard!

    Älphämönkëy on
  • DogDog Registered User, Administrator, Vanilla Staff admin
    edited March 2004
    alphamonkey wrote:
    SeñorAmor wrote:
    Anything in particular we should be looking for?

    Also, I cheated on you with deni. :cry:
    I'm sorry. :(
    Mostly random redirect errors. I trust the phpBB guys though, they do a good job, so I dont think there will be any problems.


    :shock:
    You cheating bastard!

    I got randomly redirected to your heart. <3

    Unknown User on
  • denihilistdenihilist Ancient and Mighty Registered User, Moderator Mod Emeritus
    edited March 2004
    Yeah but you had to go pick up your girlfriend Senor.
    (no tilde)

    denihilist on
  • DogDog Registered User, Administrator, Vanilla Staff admin
    edited March 2004
    I certaiñly did, but her druñk ass was iñ the mood for some hañky pañky, so it was all good. ;)

    (many tildes)

    Unknown User on
  • LegacyLegacy Stuck Somewhere In Cyberspace The Grid(Seattle)Registered User, ClubPA regular
    edited March 2004
    Spoilers?

    ;)

    Legacy on
    Can we get the chemicals in. 'Cause anything's better than this.
  • DogDog Registered User, Administrator, Vanilla Staff admin
    edited March 2004
    I had sex.

    *Edit*
    To be fair, whilst having sex with my gf, I was thinking about Alpha and Deni (having sex).

    Unknown User on
  • denihilistdenihilist Ancient and Mighty Registered User, Moderator Mod Emeritus
    edited March 2004
    I want to do your girlfriend.

    :(

    denihilist on
  • DogDog Registered User, Administrator, Vanilla Staff admin
    edited March 2004
    ...

    Unknown User on
  • StevenSteven Registered User regular
    edited March 2004
    alphamonkey wrote:
    security patch

    What was it they needed to patch?

    Steven on
  • ÄlphämönkëyÄlphämönkëy Registered User regular
    edited March 2004
    Steven wrote:
    alphamonkey wrote:
    security patch

    What was it they needed to patch?
    A very clever user could submit weird data and have access to run SQL commands. This could dump all of our password hashes into a file and (after a long ass time) eventually crack them.

    Älphämönkëy on
  • DogDog Registered User, Administrator, Vanilla Staff admin
    edited March 2004
    alphamonkey wrote:
    Steven wrote:
    alphamonkey wrote:
    security patch

    What was it they needed to patch?
    A very clever user could submit weird data and have access to run SQL commands. This could dump all of our password hashes into a file and (after a long ass time) eventually crack them.

    Ok, now I'm gonna strain myself on thinking how this would be possible. :(

    Unknown User on
  • StevenSteven Registered User regular
    edited March 2004
    alphamonkey wrote:
    Steven wrote:
    alphamonkey wrote:
    security patch

    What was it they needed to patch?
    A very clever user could submit weird data and have access to run SQL commands. This could dump all of our password hashes into a file and (after a long ass time) eventually crack them.

    Haha, SQL injection, jesus, I thought that was a lost art.

    Steven on
  • ÄlphämönkëyÄlphämönkëy Registered User regular
    edited March 2004
    SeñorAmor wrote:
    alphamonkey wrote:
    Steven wrote:
    alphamonkey wrote:
    security patch

    What was it they needed to patch?
    A very clever user could submit weird data and have access to run SQL commands. This could dump all of our password hashes into a file and (after a long ass time) eventually crack them.

    Ok, now I'm gonna strain myself on thinking how this would be possible. :(
    Simple. SQL Injection. phpBB didnt handle their input correctly and made it so a user could write values into a mySQL query. A user could then call for the password hash of a user or a group of users. With little\no effort that list could be referenced to a UID and bam, you can forge a cookie and login as the user without their knowledge. Or if you really were mean you could run that MD5 hash through a program like john the ripper and bruteforce it (or a group of passwords) All the simple passwords would break quickly, the better ones would take longer.

    Älphämönkëy on
  • DogDog Registered User, Administrator, Vanilla Staff admin
    edited March 2004
    alphamonkey wrote:
    SeñorAmor wrote:
    alphamonkey wrote:
    Steven wrote:
    alphamonkey wrote:
    security patch

    What was it they needed to patch?
    A very clever user could submit weird data and have access to run SQL commands. This could dump all of our password hashes into a file and (after a long ass time) eventually crack them.

    Ok, now I'm gonna strain myself on thinking how this would be possible. :(
    Simple. SQL Injection. phpBB didnt handle their input correctly and made it so a user could write values into a mySQL query. A user could then call for the password hash of a user or a group of users. With little\no effort that list could be referenced to a UID and bam, you can forge a cookie and login as the user without their knowledge. Or if you really were mean you could run that MD5 hash through a program like john the ripper and bruteforce it (or a group of passwords) All the simple passwords would break quickly, the better ones would take longer.

    Strain complete.

    Unknown User on
  • StevenSteven Registered User regular
    edited March 2004
    SeñorAmor wrote:
    alphamonkey wrote:
    SeñorAmor wrote:
    alphamonkey wrote:
    Steven wrote:
    alphamonkey wrote:
    security patch

    What was it they needed to patch?
    A very clever user could submit weird data and have access to run SQL commands. This could dump all of our password hashes into a file and (after a long ass time) eventually crack them.

    Ok, now I'm gonna strain myself on thinking how this would be possible. :(
    Simple. SQL Injection. phpBB didnt handle their input correctly and made it so a user could write values into a mySQL query. A user could then call for the password hash of a user or a group of users. With little\no effort that list could be referenced to a UID and bam, you can forge a cookie and login as the user without their knowledge. Or if you really were mean you could run that MD5 hash through a program like john the ripper and bruteforce it (or a group of passwords) All the simple passwords would break quickly, the better ones would take longer.

    Strain complete.

    weerd coed go in usernaem feeld, out go passwards

    Steven on
  • DogDog Registered User, Administrator, Vanilla Staff admin
    edited March 2004
    Steven wrote:
    SeñorAmor wrote:
    alphamonkey wrote:
    SeñorAmor wrote:
    alphamonkey wrote:
    Steven wrote:
    alphamonkey wrote:
    security patch

    What was it they needed to patch?
    A very clever user could submit weird data and have access to run SQL commands. This could dump all of our password hashes into a file and (after a long ass time) eventually crack them.

    Ok, now I'm gonna strain myself on thinking how this would be possible. :(
    Simple. SQL Injection. phpBB didnt handle their input correctly and made it so a user could write values into a mySQL query. A user could then call for the password hash of a user or a group of users. With little\no effort that list could be referenced to a UID and bam, you can forge a cookie and login as the user without their knowledge. Or if you really were mean you could run that MD5 hash through a program like john the ripper and bruteforce it (or a group of passwords) All the simple passwords would break quickly, the better ones would take longer.

    Strain complete.

    weerd coed go in usernaem feeld, out go passwards

    Holy shit. De ja vu.

    And yeah, I assumed it was done this way, but I also assumed the phpBB guys would have made 100% certain this wasn't possible.

    Unknown User on
  • StevenSteven Registered User regular
    edited March 2004
    The entire problem is just one period mark. That's kind of funny, actually.

    Steven on
  • DogDog Registered User, Administrator, Vanilla Staff admin
    edited March 2004
    Heh.

    .hack


    ;)

    Unknown User on
  • OrthancOrthanc Death Lite, Only 1 Calorie Off the end of the internet, just turn left.Registered User, ClubPA regular
    edited March 2004
    Jesus fuck my eye christ. I would have thought in something the size of phpBB they would have mechanisms to avoid injection holes. That's crazy.

    Orthanc on
    orthanc
  • OrthancOrthanc Death Lite, Only 1 Calorie Off the end of the internet, just turn left.Registered User, ClubPA regular
    edited March 2004
    BUG!!! BUG!!!

    I think it's forcing images to end in image tags.

    observe
    [img]http://tinyurl.com/3gryj[/img]
[img]http://tinyurl.com/35np9/MBsig1.jpg[/img]

    second works, first doesn't
    3gryj
    MBsig1.jpg

    Orthanc on
    orthanc
  • Munkus BeaverMunkus Beaver You don't have to attend every argument you are invited to. Philosophy: Stoicism. Politics: Democratic SocialistRegistered User, ClubPA regular
    edited March 2004
    http://www.penny-arcade.com/forums/viewtopic.php?t=52953

    May or may not be caused by the code changes

    Munkus Beaver on
    Humor can be dissected as a frog can, but dies in the process.
  • OrthancOrthanc Death Lite, Only 1 Calorie Off the end of the internet, just turn left.Registered User, ClubPA regular
    edited March 2004
    munkus beaver wrote:
    http://www.penny-arcade.com/forums/viewtopic.php?t=52953

    May or may not be caused by the code changes

    It must have been caused by A code change.

    If it wasn't caused by these code changes, it's mighty co-incidental

    Orthanc on
    orthanc
  • Munkus BeaverMunkus Beaver You don't have to attend every argument you are invited to. Philosophy: Stoicism. Politics: Democratic SocialistRegistered User, ClubPA regular
    edited March 2004
    Let me rephrase that then.

    May or may not be purposeful.

    EDIT: Also, my sig was fine until I tried to update it not a few minutes ago. I got rid of the tinyurl until this gets fixed though, because itjust looks silly.

    Munkus Beaver on
    Humor can be dissected as a frog can, but dies in the process.
  • OrthancOrthanc Death Lite, Only 1 Calorie Off the end of the internet, just turn left.Registered User, ClubPA regular
    edited March 2004
    My understanding is that phpBB stores the HTML translation rather than the bbCode in the database, so it makes sence that it would only break on update

    Orthanc on
    orthanc
  • MeizMeiz Registered User regular
    edited April 2004
    Whatever you did...

    Grease fucking lightning.

    Meiz on
Sign In or Register to comment.
Penny Arcade Forums› H.Q. Reception Desk