MCC v2.0.3

[Dayo]

get_image_size()

[MrEvilChaos]

okay were dose one put it and in what code

[Dominion]

http://uk2.php.net/getimagesize

You could also try [mccode v2.x] Different way of going about 'User Display Pictures'.

[MrEvilChaos]

yea I tried [mccode v2.x] Different way of going about 'User Display Pictures'. but is confused me ;(

[Paul Evans]

which part of the image is hackable (i've seen the preferences and viewuser)

preferences:

		$image = (@getimagesize($_POST['newpic']));
      if ( !is_array($image) ) {
  echo 'Invalid Image.
> [url="preferences.php?action=picchange"]Go Back[/url]';
  die($h->endpage());
      }

Although if you edit it by myphpadmin then it will go through as i believe they didn't add getimagesize on viewuser.

Simple fix would be to goto viewuser...

Replace line 55 :

   echo ($r['display_pic'])?'[img='.$r['display_pic'].']':'No Image';

With this:

   		$image = (@getimagesize($r['display_pic']));
  echo ( is_array($image) )?'[img='.$r['display_pic'].']':'No Image';

[MrEvilChaos]

I used that code and it made it so you even use a pic

[Paul Evans]

Seems to work on my version, sure you imputed it correctly?

[MrEvilChaos]

yea I take this code

echo ($r['display_pic'])?'[img='.$r['display_pic'].']':'No Image';

and replace it with this one

$image = (@getimagesize($r['display_pic']));
  echo ( is_array($image) )?'[img='.$r['display_pic'].']':'No Image';

[Karlos94]

For the prreferences function, here is a quick one based off the MCCodes Lite version.

function pic_change()
{
if (isset($_POST['newpic']))
{
	if (empty($_POST['newpic']))
	{
		echo '

You did not enter a new profile picture in the requested box.</p>';
	}
	else if (!@getimagesize($_POST['newpic']))
	{
		echo '

You haven\'t posted a valid image URL.</p>';
	}
	else
	{
		mysql_query("UPDATE `users` SET `display_pic`='". $_POST['newpic'] ."' WHERE `userid`=".$userid, $c);
		echo '

You have successfully !</p>';
	}

	echo '

> [url="preferences.php?action=', __FUNCTION__ ,'"]Back[/url]';
}
else
{
	echo '<h3>Pic Change</h3>


Please note that this must be externally hosted, [url="http://imageshack.us"]ImageShack[/url] is our recommendation. Any images that are not 150x150 will be automatically resized to fit our requirements.</p>

	<form action="preferences.php?action=', __FUNCTION__ ,'" method="post">
		New Pic: <input type="text" name="newpic" value="', $ir['display_pic'] ,'" />

		<input type="submit" value="Change Picture" />
	</form>';
}
}

[MrEvilChaos]

Thanks guys but I now have a prototype mod that will allow a user to upload a image instead of a url easiest way IMO :thumbup: :thumbsup:

[Paul Evans]

I am still curious how exactly you hacked the display on 2.0.3 i couldn't do it using the UI side...

[MrEvilChaos]

wrong wording the admin hack

[Paul Evans]

via display picture on the UI side?

[MrEvilChaos]

yea it was putting a URl in where the display pic url would be and so when an admin looks at ur profile you got admin

[Paul Evans]

via preferences or mysql?

[Dominion]

Are you talking about this kind of thing? Auto-Admin Hack.

If so, and done by a user, would the user own the site the “image” was on Or was it an image upload site?

[Paul Evans]

Invalid Image.

> Go Back

Source: http://samplev2.mccodes.com/preferences.php?action=picchange2

Imputed: logout.php?x=.gif

Don't see it...

[MrEvilChaos]

well idk they may have updated it cause i cant do that on my game

[Paul Evans]

are you 100% positive your game is running 2.0.3 files (preferences)?

[MrEvilChaos]

yep I changed it myself

[Dominion]

yep I changed it myself

Was it a user thing or did you mange to do it? If it was a user do you know how they did it? E.g. give the link in prefs, change what's on the end of that link. It’s still giving a link in the new version right?

[Uridium]

found an issue with staff_special.php that wasnt allowing staff to update user level.

so just replace these functions..

 

function userlevelform() {
global $db,$ir,$c,$h,$userid;
echo "
<h3>User Level Adjust</h3>
<form action='staff_special.php?action=userlevel' method='get'>
User: ".user_dropdown($c,'ID')."
<br />
User Level:
<br />
<input type='radio' name='level' value='1' /> Member
<br />
<input type='radio' name='level' value='2' /> Admin
<br />
<input type='radio' name='level' value='3' /> Secretary
<br />
<input type='radio' name='level' value='4' /> IRC Op
<br />
<input type='radio' name='level' value='5' /> Assistant
<br />
<input type='submit' value='Adjust' />
</form>
";
}
function userlevel() {
global $db,$ir,$c,$h,$userid;
	$_GET['level'] = ( isset($_GET['level'])&&in_array($_POST['level'], array(1,2,3,4,5)) )?abs(intval($_GET['level'])):$_GET['level'];
	$_GET['ID'] = ( isset($_GET['ID'])&&is_numeric($_GET['ID']) )?abs(intval($_GET['ID'])):'';
$d = $db->query("SELECT `userid` , `user_level` FROM `users` WHERE `userid` = ".$_GET['ID']."");
    if ( $db->num_rows($d) == 0 ) {
  echo 'Invalid user.<br />> <a href="staff_special.php?action=userlevelform">Go Home</a>';
  die($h->endpage());
    }

$db->query("UPDATE `users` SET `user_level` = {$_GET['level']} WHERE `userid` = {$_GET['ID']}", $c);
	stafflog_add('Adjusted user ID '.$_GET['ID'].'\'s staff status.');
  echo 'User\'s level adjusted.<br />> <a href="staff.php?action=stafflist">Go Home</a>';
  die($h->endpage());
}

 

Overwrite with this one should work fine..

[Mystical]

found an issue with staff_special.php that wasnt allowing staff to update user level.

so just replace these functions..

 

function userlevelform() {
global $db,$ir,$c,$h,$userid;
echo "
<h3>User Level Adjust</h3>
<form action='staff_special.php?action=userlevel' method='get'>
User: ".user_dropdown($c,'ID')."
<br />
User Level:
<br />
<input type='radio' name='level' value='1' /> Member
<br />
<input type='radio' name='level' value='2' /> Admin
<br />
<input type='radio' name='level' value='3' /> Secretary
<br />
<input type='radio' name='level' value='4' /> IRC Op
<br />
<input type='radio' name='level' value='5' /> Assistant
<br />
<input type='submit' value='Adjust' />
</form>
";
}
function userlevel() {
global $db,$ir,$c,$h,$userid;
	$_GET['level'] = ( isset($_GET['level'])&&in_array($_POST['level'], array(1,2,3,4,5)) )?abs(intval($_GET['level'])):$_GET['level'];
	$_GET['ID'] = ( isset($_GET['ID'])&&is_numeric($_GET['ID']) )?abs(intval($_GET['ID'])):'';
$d = $db->query("SELECT `userid` , `user_level` FROM `users` WHERE `userid` = ".$_GET['ID']."");
    if ( $db->num_rows($d) == 0 ) {
  echo 'Invalid user.<br />> <a href="staff_special.php?action=userlevelform">Go Home</a>';
  die($h->endpage());
    }

$db->query("UPDATE `users` SET `user_level` = {$_GET['level']} WHERE `userid` = {$_GET['ID']}", $c);
	stafflog_add('Adjusted user ID '.$_GET['ID'].'\'s staff status.');
  echo 'User\'s level adjusted.<br />> <a href="staff.php?action=stafflist">Go Home</a>';
  die($h->endpage());
}

 

Overwrite with this one should work fine..

I noticed this error too but unfortunately your fix does not work. I still get the same error Error: This script requires an action. Any other idea on how to fix this error? I did do a test by changing the two functions with the old ones in v2.0.2c and it worked like a charm but kind of defeats the purpose of the added security in v 2.0.3.

[rulerofzu]

Go do what I posted on the other thread and it works fine.

[lucky3809]

Here is mine... I dont know if it'll work for you.. but you can try

function userlevel()

{

global $db,$ir,$c,$h,$userid;

$_GET['level']=abs((int) $_GET['level']);

$_GET['ID']=abs((int) $_GET['ID']);

$db->query("UPDATE users SET user_level={$_GET['level']} WHERE userid={$_GET['ID']}");

print "User's level adjusted.";

stafflog_add("Adjusted user ID {$_GET['ID']}'s staff status.");

}

function userlevelform()

{

global $db,$ir,$c,$h,$userid;

 

print "<h3>User Level Adjust</h3>

<form action='staff_special.php' method='get'>

<input type='hidden' name='action' value='userlevel'>

User: ".user_dropdown($c,'ID')."<br />

User Level:<br />

<input type='radio' name='level' value='1' /> Member<br />

<input type='radio' name='level' value='2' /> Admin<br />

<input type='radio' name='level' value='3' /> Secretary<br />

<input type='radio' name='level' value='4' /> IRC Op<br />

<input type='radio' name='level' value='5' /> Assistant<br />

<input type='submit' value='Adjust' /></form>";

}

Edited April 13, 2011 by lucky3809