UBB.Developers Forums UBB.classic V5 Mod Questions Security bug in 5.4x

Hello,

I think I discovered some kind of securitybug in 5.4x

It is possible to retrieve all logged IP numbers from posters by retrieving the link www.your_ubb.com/ubb/Forum1/000001.cgi

You can do this on any forum by just changing the ForumX and 00000x.cgi.

I don't want my visitors IP to show, but I do want it logged. I now have chmod all my 00000x.cgi files to 640, but whenever someone posts it is being set back to 666 again.

Am I doing something wrong here or if not and this really is a security bug that reveals the IP's of all visitors, does someone know all the exact chmod instructions to replace?


Should be:


Or am I wrong?

Thanks for your help,

CT.

What you said doesnt work on my UBB

It's not so much a bug in ubb as a bug in the server setup. Set up your server not to show .cgi file outside of the cgi bin

but yes, i like your fix too

Just a thought

Well...

Since I run a virtual server my solution is the only one. I can not alter anything in the server setup.

The quote I made was from postings.cgi

Does anyone know if there are more places where I can find the 666 > 640 fix?

The following files contain the string "0666, "$ForumsPath":

archive.cgi
cpanel2.cgi
cpanel3.cgi
edit.cgi
postings.cgi
ubb_library.pl
ubb_library2.pl

Just a thought

Thanks man...