Messages posted by: Carbonize

Or simply go back to PHP4. Given that most scripts are written for PHP4 I'd stick with it for the time being. Or edit your php.ini file as Bernt suggests.

You need to change the direction in the header.php file. Change the <html> to <html dir="rtl"> and that will change it on all your guestbook pages.

For anybody wanting the 2.2 session.class.php file with the exploit fixed

<?php
/**
* ----------------------------------------------
* Advanced Guestbook 2.2 (PHP/MySQL)
* Copyright (c)2001 Chi Kien Uong
* URL: http://www.proxy2.de
* ----------------------------------------------
*/

class gb_session extends gbook_sql {

var $expire = 7200;
var $include_path;
var $table;

function gb_session($path='') {
global $GB_TBL;
$this->table =& $GB_TBL;
$this->gbook_sql();
$this->connect();
$this->include_path = $path;
}

function isValidUser($user_id) {
$this->query("SELECT username FROM ".$this->table['auth']." WHERE ID='$user_id'");
$this->fetch_array($this->result);
return ($this->record) ? true : false;
}

function changePass($user_id,$new_password) {
$this->query("UPDATE ".$this->table['auth']." SET password=PASSWORD('$new_password') WHERE ID='$user_id'");
return ($this->record) ? true : false;
}

function generateNewSessionID($user_id) {
srand((double)microtime()*1000000);
$session = md5 (uniqid (rand()));
$this->query("UPDATE ".$this->table['auth']." SET session='$session' WHERE ID='$user_id'");
return $session;
}

function checkPass($username,$password) {
$this->query("SELECT ID FROM ".$this->table['auth']." WHERE username='$username' and password=PASSWORD('$password')");
$this->fetch_array($this->result);
return ($this->record) ? $this->record["ID"] : false;
}

} else {
return false;
}

}

?>

Ahhhh Amber of the many guestbooks. Yes I would be grateful for the error report. I'll also answer the email thats just arrived from you lol.

Yup this is one of the things my install.php file wil do. It will also add the extra tables needed by 2.3.1.

Ok the SQL password shuld be in plaintext in your config file. Looking at the error all I can say is check your information is correct.

Yo usay you upgraded from 2.2 to 2.3.1. Could you do me a favour and download www.carbonize.co.uk/install.zip, upload the install.php from the zip to your guestbook folder and then run it (once you sort out your database access problem). It should upgrade your guestbook database from 2.2 to 2.3.1 but it will give you errors. I would be grateful if you could send me the entire error message so I can fix it. Your guestbook will work fine once done (apart from your SQL problem but until thats fixed you can't use the install.php anyways)

So as I said check the information in the config file. You may have just typo'd a letter somewhere.

Can't answer the first two but yes the page must have the .php extension. All the .php extension does is tell the server that when this page is requested it is to be sent to the PHP processor first.

No they say their server DOES support PHP.

when a server recieves a request that does not specify a particular file it will send them the index.* file if it exists. My entire site is made up of .php pages.

Auron wrote: It has to be *.php.

NB - PHP code requires a file with an extension of *.php!!!

Auron

Actually .shtml would work as well :p well depending on server setup.

Thats what I thought at first but they say they are getting an error message where if the page extension was other than .php it would just show the commands. Probably is their problem though just to make me look stupid

Can you please post the complete error message.

If you're adding it to a blog page or CMS then odds are the page is php already.

You didn't put by any chance?

Weird it's accepting the posts but giving the error message? Did you edit any file?