 |
 |
 |
 |
#199384 - 04/19/03 08:32 PM
Re: [6.x] Album.pl - UBB-Integrated Photo Album
|
Member
Registered: 05/14/01
Posts: 262
Loc: Los Angeles, CA
|
|
|
Top
|
|
|
|
 |
 |
 |
 |
|
|
|
|
|
#199386 - 04/26/03 01:27 PM
Re: [6.x] Album.pl - UBB-Integrated Photo Album
|
Member
Registered: 04/30/01
Posts: 230
Loc: Ottawa, ON, Canada
|
V6.2 has been released. Note that there are a number of fixes, including a security fix that prevents users from execuruting programs from the hosting system. (Programs are executed with the privileges of the web server user, and have to be pre-existing on the system.) An advisory detailing the problem will hit BugTraq on April 27th. (Thanks to AresU for finding this and for responsible disclosure!) As a result, I *strongly* recommend that everyone upgrade to V6.2. Download here . New Features- Added a new "Popular" option. This shows the 10 (by default) most popular photos or albums. Popularity is based on rating, number of times rated and number of times viewed. New for this feature: popular_button and most_popular config items, thmb_album_popular.gif graphic, popular style sheet class and updated album_header.tml.
- SSI setting for popular modes defines number of images to display. (I.E. ssi=10 shows 10 most popular)
- Added self-administration: users can now create sub-albums and set album thumbnails for albums they own.
- Added new user class: guest. Guests are defined through the "default_guests" config item, and are like regular users but cannot upload.
- Added ability to set photo and album owners through the "Update Titles & Descriptions" form.
- Admins are now excluded from quota checking.
- A "thmb_root.jpg" image added to the root album will now be used as the album thumbnail for the root album.
- Re-organized Configuration Management screen into sections.
- Added "Edit User List" capability for flatfile authentication (authentication_type=1). This form shows up on the Configuration Management screen.
- Added jhead_comments config item, which uses jhead to automatically insert a photo's title/description (if present) as a comment in the EXIF header.
- Added a check to ensure the style sheet is working, through the use of a "hidden" class that hides the error when things are working properly.
- Added "postupload" config item, which allows an ImageMagick command to be run on a pic after upload.
- Added 2 new sort options: newest first and oldest first, by file creation date.
- Added public_albums option to protect only photos (thumbnail view is pulic).
- Login errors now display as a popup window.
- Improved "fatal error" troubleshooting.
- Jump Station will now go to target album on click (submit not required).
- Automatic ImageMagick sensing for new configs has been added.
- Allowed entered passwords to override cookies.
- Made DB code more robust.
Bug Fixes- Major security hole fixed where any program can be remotely executed has been closed -- thanks to AresU for finding this and for responsible disclosure!
- Fixed broken SSI code - it now won't display all the "extra stuff" in SSI mode. The ssirecentuploads style class has also been updated.
- Fixed security hole around creating albums.
- Fixed bug where first level sub albums showed their own thumbnail for the "root" album's nav button.
- Fixed problem where ()'s in album filenames broke the nav footer.
- Photos without a thumbnail are no longer displayed on the "Set Album Thumbnail" screen.
- Fixed "Update Titles & Descriptions" bug for "empty" albums.
- Movies can now be viewed when browsing through a batch of photos and movies.
- Fixed a bug where setting thumbnails for sub-sub albums threw an error.
- Fixed a bug where the "Full Size" viewing button didn't work if you had defined a default size.
- Removed double /'s from thumbnail links.
- Fixed a bug where rating_location wasn't being honoured.
- Fixed broken movie links on search results page.
|
|
Top
|
|
|
|
|
|
|
|
|
|
|
|
|
#199387 - 04/26/03 03:18 PM
Re: [6.x] Album.pl - UBB-Integrated Photo Album
|
Moderator / Kingpin
Registered: 02/11/01
Posts: 817
Loc: Burlington, VT
|
quote:</font><hr />Originally posted by Mike Bobbitt: An advisory detailing the problem will hit BugTraq on April 27th. (Thanks to AresU for finding this and for responsible disclosure!)<hr /></blockquote>It must have went out on BugTraq early because I just got it: <blockquote><font class="small">quote: [qb]AresU Advisory 04/27/2003 Album.pl Vulnerability Severity : High (CGI Remote Command Execution) Systems Affected: Album.pl up to v6.1 Vendor URL: http://perl.bobbitt.ca/album Vuln Type : CGI Remote Command Execution Status : Vendor contacted, new fixed version available Author : AresU Greetz to : Mike B., Bosen, Tioeuy, syzwz, Heltz, eF73, SakitJiwa, nimdA, Br0374l, FreshFirst, Algorithm All 1ndonesian Security Team (1st) http://www.bosen.net/releases/ http://bosen.blogspot.com Summary ======= album.pl is a popular web photo album application that allows you to simply drop new photo files into a directory, and they will automatically be accessible via the web. Any user can execute commands with Web Server privileges (normally nobody) when use an alternate configuration file. Solution ======== Upgrade to a newer album.pl version (at least 6.2) http://perl.bobbitt.ca/album/album62.zip Acknowledgments =============== Vulnerability discovery and advisory by AresU Vendor Response =============== Vendor has been contacted and new fixed version is available. Exploit Code ============ I have refrained from publishing a more functional exploit at this time, to delay attacks against album.pl installations. ----------------------------------------------- This mail sent through http://webmail.bosen.net [/qb]
|
|
Top
|
|
|
|
|
|
|
|
|
|
|
|
|
#199393 - 05/02/03 09:14 AM
Re: [6.x] Album.pl - UBB-Integrated Photo Album
|
Pooh-Bah
Registered: 11/28/00
Posts: 3208
Loc: NYC | 100% Hockey
|
The settings should be: db_driver=mysql db_name=[yourwebsite_com] db_hostname=localhost db_user=[username] db_password=[password] db_port=3306 db_membertable=USERS db_username=USERNAME db_passwdfield=PASSWORD I've gotten as far as getting a line 2696 error I posted a similar thread @ infopop http://community.infopop.net/2/OpenTopic?a=tpc&s=729094322&f=1853060105&m=3403056517 I'll have to check the case settings for the table/fields when I get home
_________________________
|
|
Top
|
|
|
|
|
|
|
|
|
|
|
|
|
#199401 - 10/10/03 03:42 PM
Re: [6.x] Album.pl - UBB-Integrated Photo Album
|
Member
Registered: 04/30/01
Posts: 230
Loc: Ottawa, ON, Canada
|
V6.3 has been released. ( Download ) New Features - You can now create links to photos in other albums. The new "Link" item on the admin menu allows you to create links to existing photos. Only the original photo exists, with links simply pointing to it. Useful for a "favourites" album, without keeping multiple copies of your photos.
- Local templates now supported. Any template files found in an album directory will automatically be used for that album.
- New buttons!
- Added ssi=2 mode, which shows actual photos, not just thumbnails. (Good for use with random/slideshow features.)
- Added support for YaBB SE 1.5.1+ password protection. Digest::HMAC_MD5 Perl module required.
- Added ####NAVPREV####, ####NAVUP####, ####NAVNEXT#### and ####NAVJUMP#### tags, for extra granularity with the navigation footer. Updated album_footer.tml to use these tags.
- Added ####MOVIESIZE#### tag for the upload form, to show the max allowed movie upload size.
- Added "logout" button for flatfile authentication (type 1). Includes logout_button config item and thmb_album_logout.gif image.
- The postupload command can now use all regular ####TAGS####. (Such as ####CONFIG=loggedin#### to show the logged in user's name.)
- Improved cookie deletion (thanks Scouter!)
- Additional check to prevent bogus config update added.
- Tuned up album_test.pl.
- Added new default_linkdir to allow fast linking.
- Added new "delcookie" function to forcibly delete any album related cookies.
New Config Items - link_button: Filename of the "Link" button graphic.
- default_linkdir: When added, clicking on the "link" button will auto create the link in this directory, instead of prompting the user for a destination (not present by default).
- logout_button: Filename of the "Logout" button graphic
- db_displaynamefield: Used to define the database field containing a user's display name. Optional.
- movie_upload_size_limit: Allows admins to specify the max size for uploaded movies, separate from photos.
Bug Fixes - User edit no longer adds a blank line to the end of the list.
- Nav "up" link now takes you up to the right page.
- Album URLs are now properly escaped, allowing characters such as + in the album filenames.
- Fixed flatfile password carryover problem.
- Fixed ssi / authentication problem.
- Fixed a bug where search results weren't displayed properly.
- Fixed up static HTML to honour local configs.
- Fixed broken movie links.
Files to replace - album.pl
- album_test.pl
- album_footer.tml
- album_strings.txt (or appropriate language file)
- Photo_Album.css
New files Enjoy! P.S. caroth, that's on the to do list, hope to get to it some time. 
|
|
Top
|
|
|
|
|
|
|
|
|
|
|
|
|
#199404 - 11/11/03 05:24 PM
Re: [6.x] Album.pl - UBB-Integrated Photo Album
|
Enthusiast
Registered: 10/10/02
Posts: 391
Loc: Toronto
|
Allen, the path, in your case is only: cgi-bin/img/ so in the album.cfg would show something like this: quote:
# The path to the directory containing all icons and buttons. This should be relative to album.pl's location, as it is appended to album_web to get the actual URL.
img_dir=cgi-bin/img In my case was img_dir=ubb/img because I didnt want to mix the "img" folder in the cgi-bin, it doesnt have to be there. I have a question though: I dont get "Rate picture" and also dont get the Admin options: Delete, Move, Edit etc. Do you know why? Is there a page for Admin settings other than album.cfg file? http://romanianational.com/cgi-bin/album.pl Thank you, Felix
|
|
Top
|
|
|
|
|
|
| | |
Checked out the website and it looks sweet!
