Home
Login | Register
Welcome, Guest
Please Login or Register.    Lost Password?

2 bugs found
(1 viewing) (1) Guest
Go to bottomPage: 1
TOPIC: 2 bugs found
#249
2 bugs found 3 Years ago Karma: 0
First bug -- redirecting to home page brings up a Loop error page in FireFox 3.0.5.

Second bug -- redirecting to "index.htm or index.html" on a subdomain ie. "subdomain.domain.com" brings up a fatal error page. The only fix is to use the full URL of the domain.

Otherwise great work!!!

Tim
www.timscomputershop.com
timgelvin
Fresh Boarder
Posts: 2
graphgraph
User Offline Click here to see the profile of this user
The administrator has disabled public write access.
 
#250
Re:2 bugs found 3 Years ago Karma: 0
Regarding the redirect bug...I got this and it's easily fixed....

I think it's a new 1.5.9 quirk in JURI::root()

Why it happens is...if anyone tries to redirect to a blank URL then Joomla core application redirect sends you back to the JURI::base. Normally this wouldn't be an issue BUT if Jsecure does this then you end up straight back at....Jsecure which then redirects you to a blank and so on and on.

Therefore whatever Jsecure does it must never try and redirect to a blank.

TO fix this edit the ..plugins/system/jsecure.php and add the following,

Code:

if (strlen($path) == 0 ) {
   $path = "/";
}



just before $app =& JFactory::getApplication(); and $app->redirect($path);

Obviously that checks what path you created and if it's blank then send to the '/' path. If you look at the application.php redirect method then if it sees the '/' (in $url[0]) then it fixes it up for you to make a nice URL.

Why this doesn't work right on some sites verses others is that JURI:root() will actually return a BLANK not a slash in some cases (I have noticed this now on 1.5.9 which I upgraded 3 sites yesterday).

Also in the initial $path .= you might want to remove the '.' in the '.=' where path is first used i.e.

Code:

$path = $params->get('options') == 1 ? JURI::root(true).'/'.$params->get('custom_path') : JURI::root(true);


I did log that bug but no developer has replied to my thread.
openmtl
Fresh Boarder
Posts: 5
graphgraph
User Offline Click here to see the profile of this user
The administrator has disabled public write access.
 
#253
Re:2 bugs found 3 Years ago Karma: 0
I also found another bug... This is a security bug... I'm not sure what's allowing this but I know it's this plugin... I'm getting flooded with spam now that I have this plugin installed... I had to disable it. Would your fix above fix the security problem too?

Tim
www.timscomputershop.com
timgelvin
Fresh Boarder
Posts: 2
graphgraph
User Offline Click here to see the profile of this user
The administrator has disabled public write access.
 
#254
Re:2 bugs found 2 Years, 12 Months ago Karma: 0
I don't think this can be the vector for SPAM injection. JSecure simply locks down the administration interface so that drive-by script kiddies or bots can't get to the login screen to start their dictionary attack.

Is the SPAM injecting into comments, forms or being emailed to you ?

If injected into comments/forms then that is a problem with whatever comment or form module you are using.

Jsecure is used quite widely; it could simply be that using Jsecure and advertising your domain name has simply made some page scraping bot use your domain name and you've been joe-jobbed.

(What is a lot of SPAM ? the catchall on my domain gets around 1200 spams a day of which 99% are flagged as SPAM by spamassassin. Between spamassassin and Thunderbird I don't really care about SPAM other than I think that the Internet would run faster without SPAM....spam spam spam spam and eggs and spam).
openmtl
Fresh Boarder
Posts: 5
graphgraph
User Offline Click here to see the profile of this user
The administrator has disabled public write access.
 
#256
Re:2 bugs found 2 Years, 12 Months ago Karma: 0
Hi,

I don't know what span you are talking here? Are you getting spam mails?

Can you please give me more details? So that I can look into it.

Cheers,
Ajay Lulia.
webtech2
Fresh Boarder
Posts: 0
graphgraph
User Offline Click here to see the profile of this user
The administrator has disabled public write access.
 
Go to topPage: 1