Author |
Message |
24/04/2004 01:58:45
|
Anonymous
|
What version do you have? The dropping and re-creating of book_auth applies to version 2.3.1 so i hope that didn't mess you up.
Run a query against your book_auth table and post it here if you don't mind. It should look something like this.
|
|
13/06/2004 15:14:09
|
phpbb-fan
Beginner
Joined: 19/02/2004 16:47:14
Messages: 6
Offline
|
i am using version 2.3.1
this is what i have in book_auth:
DROP TABLE IF EXISTS book_auth;
CREATE TABLE book_auth (
ID smallint(5) NOT NULL auto_increment,
username varchar(60) NOT NULL default '',
password varchar(60) NOT NULL default '',
session varchar(32) NOT NULL default '',
last_visit int(11) NOT NULL default '0',
PRIMARY KEY (ID)
) TYPE=MyISAM;
INSERT INTO book_auth (ID, username, password, session, last_visit) VALUES (1, 'test', '773359240eb9a1d9', 'cd2c6d5e457641991d52da8fb6d87c08', 1013100791);
I did a clean install.. but I still can't login with test and 123
|
|
18/06/2004 04:28:12
|
Anonymous
|
I, too, have a problem since upgrading (old GB got hacked, found upgrade info here). I login and go to the admin screen, and as soon as I click on an admin link it tosses me back to the login screen again.
Thoughts?
alsplace@pobox.com
|
|
06/07/2004 18:09:38
|
Anonymous
|
I also have had this problem, even after reading these forums and stepping through the upgrade carefully.
One thing I didn't do was keep a copy of my old 2.2 \lib\session.class.php file....a pity. I hear it can fix the problem.
Anyway I found another way that has worked for me. It might break something else and perhaps the gurus here can let us know the dangers of this approach but anyway here is what I did.
The problem is one of sessions (aren't they always) and the check against the sessionID seems to fail throwing you back to login. I figured OK then, lets make it work. So in session.class.php
find starting at line 24
change to
It looks like this IF clause is evaluating to false either way. So by making the first one true I can now admin my 2.3.1 guestbook.
I am happy that this works, but just not sure if it creates a vulnerability, so comments are welcome.
My next issue is that 'last_visit' in the AUTH table is not updating.
|
|
06/07/2004 18:13:59
|
ReliableSol
Newbie
Joined: 06/07/2004 17:53:50
Messages: 3
Offline
|
Sorry, I wasn't logged in for that last post. The changed line is the one with the '' tags around it. They didn't come out in the display.
|
Kerry |
|
06/07/2004 19:01:09
|
ReliableSol
Newbie
Joined: 06/07/2004 17:53:50
Messages: 3
Offline
|
OK, update.
I have undone the change to session.class.php. While it worked it has now proved to be unnecessary.
My last_visit problem was the key. Since this was not updating properly it was always more than 7200 seconds since the last login and this is why you are logged out and thrown back to the login prompt.
The reason: I believe in 2.2 in table 'Auth' last_visit was capitalized to 'LAST_VISIT'. It was also a timestamp field. And on mine it was allowed to be null.
In 2.3.1 session.class.php down at lines 48, 49 creates a $timestamp variable. However the MYSQL timestamp data type is peculiar. From the MySQL manual (comments)
it is misleading in that the 'timestamp' field type in mysql holds a datetime value that updates itself unless you explicitly set it
Note that a datetime format is YYYY-MM_DD HH:MM:SS however our $timestamp variable is only in seconds with 10 or 11 digits. If you do the full install and run guestbook.sql this gets set correctly. However with an upgrade you only run the upgrade.sql which just set up the images table and doesn't change the 'auth' table. This is why people have posted the sql files in the forums. These .sql files set 'auth' to INT (11) and 'last_visit' to lower case, which allows the field to be written to when you login and logout. Therefore the time is updated and session check doesn't throw you back to the login script.
So if you are having trouble logging in have a close look at your database with something like PHPMYADMIN or better yet MySQL-Front or MySQLCC and make sure the fields are labelled correctly, and the properties are set to either integer(preferred) or varchar.
|
Kerry |
|
11/07/2004 19:24:31
|
Anonymous
|
i have tried every fix given in this forum and i still cant get it to let me login as admin ..tho if i delete the password in book_auth i can login with just test ..it has me baffled
|
|
11/07/2004 22:18:26
|
Anonymous
|
i wonder if it has something to do the fact im running freebsd 5.1 cause when i try the fix on a linux box it works..any thoughts?
|
|
17/10/2004 16:57:51
|
BadBoo
Newbie
Joined: 17/10/2004 16:02:40
Messages: 4
Location: Elgin, South Carolina, USA
Offline
|
I did an upgrade from 2.2. to 2.31.
I had the problem of logging in, and then being asked to login again whenever I clicked on anything from the admin menu.
This s what I did to solve the problem after deleting and uploading the new 2.31 files (with appropriate changed to config.inc.php)
The fix for me was Kerry's post. Since he isn't real clear in his explanation, I am writing the fix he describes:
Go to MyPHPAdmin, and pull up the table:
book_auth
by clicking on it on the leftmost column.
Now place a check mark in the box to the left of LAST_VISIT
Now click on the icon to the right (7 columns to the right) that looks like a piece of paper with a pencil over it. The mouseover will say 'change'
change FIELD from LAST_VISIT to last_visit
(just change it to lower case)
the second column should be:
INT
the third column should be:
11
the fourth column (attributes) should be empty, (blank, nothing in it.)
the 5th coulmn (NULL) should be 'not null'
the 6th column should be:
0
The 8th and final column should be blank (empty, nothing in it)
Now over to the left, and down under the FIELD column is a 'save' button. Click on Save.
This fixed two of my guestbook that I had upgraded from 2.2. to 2.31, and run the upgrade.sql script on.
Hope it helps, and thanks for being smart Kerry!
|
|
17/10/2004 19:10:53
|
Carbonize
Master
Joined: 12/06/2003 19:26:08
Messages: 4292
Location: Bristol, UK
Offline
|
Yup this is one of the things my install.php file wil do. It will also add the extra tables needed by 2.3.1.
|
Carbonize
I am not the maker of the Advanced Guestbook
get Lazarus |
|
17/10/2004 21:56:16
|
JTD
Graduate
Joined: 08/05/2004 21:52:50
Messages: 529
Location: Arkansas
Offline
|
This is for anyone wanting a sessions class php file. From advanced guestbook 2.2
<?php
/**
* ----------------------------------------------
* Advanced Guestbook 2.2 (PHP/MySQL)
* Copyright (c)2001 Chi Kien Uong
* URL: http://www.proxy2.de
* ----------------------------------------------
*/
class gb_session extends gbook_sql {
var $expire = 7200;
var $include_path;
var $table;
function gb_session($path='') {
global $GB_TBL;
$this->table =& $GB_TBL;
$this->gbook_sql();
$this->connect();
$this->include_path = $path;
}
function isValidSession($session,$user_id) {
$this->query("SELECT session, LAST_VISIT from ".$this->table['auth']." WHERE session='$session' and ID='$user_id'");
$row = $this->fetch_array($this->result);
if ($row) {
$year = substr($row["LAST_VISIT"],0,4);
$date = substr($row["LAST_VISIT"],4,10);
$date_strg = chunk_split($date,2,"-");
list($month,$day,$hour,$minute,$second) = explode("-",$date_strg);
$tstamp = mktime($hour,$minute,$second,$month,$day,$year);
return ($this->expire + $tstamp > time()) ? $row["session"] : false;
} else {
return false;
}
}
function isValidUser($user_id) {
$this->query("SELECT username FROM ".$this->table['auth']." WHERE ID='$user_id'");
$this->fetch_array($this->result);
return ($this->record) ? true : false;
}
function changePass($user_id,$new_password) {
$this->query("UPDATE ".$this->table['auth']." SET password=PASSWORD('$new_password') WHERE ID='$user_id'");
return ($this->record) ? true : false;
}
function generateNewSessionID($user_id) {
srand((double)microtime()*1000000);
$session = md5 (uniqid (rand()));
$this->query("UPDATE ".$this->table['auth']." SET session='$session' WHERE ID='$user_id'");
return $session;
}
function checkPass($username,$password) {
$this->query("SELECT ID FROM ".$this->table['auth']." WHERE username='$username' and password=PASSWORD('$password')");
$this->fetch_array($this->result);
return ($this->record) ? $this->record["ID"] : false;
}
function checkSessionID() {
global $username, $password, $session, $uid;
if (isset($session) && isset($uid)) {
return ($this->isValidSession($session,$uid)) ? array("session" => "$session", "uid" => "$uid") : false;
} elseif (isset($username) && isset($password)) {
if (get_magic_quotes_gpc()) {
$username = stripslashes($username);
$password = stripslashes($password);
}
$ID = $this->checkPass($username,$password);
if ($ID) {
$session = $this->generateNewSessionID($ID);
return array("session" => "$session", "uid" => "$ID");
} else {
return false;
}
} else {
return false;
}
}
}
?>
|
LINK-> Use Lazarus Guestbook |
|
17/10/2004 22:14:43
|
Carbonize
Master
Joined: 12/06/2003 19:26:08
Messages: 4292
Location: Bristol, UK
Offline
|
For anybody wanting the 2.2 session.class.php file with the exploit fixed
|
Carbonize
I am not the maker of the Advanced Guestbook
get Lazarus |
|
30/10/2004 01:16:27
|
Anonymous
|
Hi, i try to do this but i dont understand hów to do it, I tried but didnt find the right way can you help me more. Please.
Jam'n wrote:Try reseting the password
You will need PHPadmin for this.
[Method 1]
Select the Guestbook database.
Select book_auth.
Now choose Browse.
You now see the admin username and password.
Select edit.
Now paste Code:
in the password field and click “GO”.
This will reset your account to:
Your admin name and the password will be: 123
Or do it like this.
[Method 2]
Select the Guestbook database
Now choose on the right side of screen select SQL
Now insert in the Data Entry Field the following lines:
And click "GO"
This will reset your account to:
User name: test
Password: 123
|
|
07/04/2005 22:20:02
|
zoso37ba
Newbie
Joined: 07/04/2005 22:16:24
Messages: 1
Offline
|
I forgot my password and I tried these instructions to reset it but I can't locate the book_auth file? Where is it?
Thanks for your help!
|
|
07/04/2005 22:36:34
|
Carbonize
Master
Joined: 12/06/2003 19:26:08
Messages: 4292
Location: Bristol, UK
Offline
|
Use this http://www.carbonize.co.uk/reset.zip
|
Carbonize
I am not the maker of the Advanced Guestbook
get Lazarus |
|
|