24 replies to this topic

[Wiper2007]

Didn't work...

still getting the error....

any suggestions ?

Cris D., on 16 March 2010 - 08:18 AM, said:

Let us know how you go...

[Cris D.]

Wiper2007, on 16 March 2010 - 12:30 PM, said:

Didn't work...

still getting the error....

any suggestions ?

1) Make sure you are using the latest version of this snippet, I posted one that did not validat the hash correctly. Make sure that the membership_validator snippet has these lines:

$hash=$_GET['hash'];
//stop hacking attempts
if(!preg_match('#^[a-f0-9]{32}$#i', $hash)) 
return $messages['error1'];

not this:

if(is_numeric($_GET['hash'])){
$hash=$_GET['hash'];
}else{ 
//someone is trying to inject GET values into the browser
return $messages['error1'];}

which is totaly wrong for an MD5 hash (beig letters and numbers).

ie make sure you are gettting the snippet from the "Download File"button, NOT the list of archive files listed below on the downoad page.

[Wiper2007]

Hi Chris

I've downloaded it by clicking the download button...

I've the:

$hash=$_GET['hash'];
//stop hacking attempts
if(!preg_match('#^[a-f0-9]{32}$#i', $hash)) 
return $messages['error1'];

in the membership_verifier snippet - and not in the membership_validator... are this correct?

Cris D., on 16 March 2010 - 09:37 PM, said:

1) Make sure you are using the latest version of this snippet, I posted one that did not validat the hash correctly. Make sure that the membership_validator snippet has these lines:

$hash=$_GET['hash'];
//stop hacking attempts
if(!preg_match('#^[a-f0-9]{32}$#i', $hash)) 
return $messages['error1'];

not this:

if(is_numeric($_GET['hash'])){
$hash=$_GET['hash'];
}else{ 
//someone is trying to inject GET values into the browser
return $messages['error1'];}

which is totaly wrong for an MD5 hash (beig letters and numbers).

ie make sure you are gettting the snippet from the "Download File"button, NOT the list of archive files listed below on the downoad page.

[Cris D.]

Yeah that's right. PM me if you want me to take a hands on look.

[Wiper2007]

Hi Chris

Thanks - but I'm uninstalling the snippets...

Cris D., on 18 March 2010 - 09:49 AM, said:

Yeah that's right. PM me if you want me to take a hands on look.