php forum
php mysql forum
php mysql smarty
 
Topic Options
#224705 - 09/16/02 04:09 PM Differences in database security from 6.0.3 to 6.1
Aglavalin Offline
Enthusiast

Registered: 06/18/02
Posts: 394
Loc: Southern California
I'm getting an error of:<br /><br />SQL ERROR: Database error only visible to forum administrators<br /><br />after the upgrade from 6.0.3 to 6.1br1. This is when I am using the ubbt cookie and groups to allow a user to modify information in a new table in the ubbt database. This is a table I made, not part of ubbt. This used to work great, but after the upgrade, it seems the security has changed, or the cookie is different. So I am basically needing to know what changed with ubbt that would give this error, so I can make adjustments to my site for it. I have looked over much of the new code, but have yet to see anything that would cause a conflict.

Top
#224706 - 09/16/02 04:18 PM Re: Differences in database security from 6.0.3 to 6.1 [Re: neuron]
AllenAyres Offline

I type Like navaho

Registered: 03/10/00
Posts: 25580
Loc: Texas
Sounds like it might be the cookie changes, log out, clear your cookie, then log back in and see if it's cleared up.
_________________________
- Allen wavey
- What Drives You?

Top
#224707 - 09/16/02 04:20 PM Re: Differences in database security from 6.0.3 to 6.1 [Re: neuron]
JustDave Offline
That 70's Guy

Registered: 06/24/01
Posts: 4097
There is a table prefix and a cookie prefix being used in 6.1 so you should make sure that the prefixes match your old table prefix and cookie prefix which were hard coded in before. (w3t_)
_________________________
~Dave
ChattersOnline.com

Top
#224708 - 09/16/02 05:33 PM Re: Differences in database security from 6.0.3 to 6.1 [Re: sjsaunders]
Aglavalin Offline
Enthusiast

Registered: 06/18/02
Posts: 394
Loc: Southern California
HMM, upon further investigation and testing, it seems that the data IS updated in the database, but that error is given. I can still verify they are a member of a group ok, but this error is very annoying and causing major confusion with users.<br /><br />I have the table name hardcoded into the page that UPDATES or INSERTS into the table. I have cookies set sitewide, with no special prefix set since I only have one public board. (The other is a test site) I deleted all cookies and started over and it still happens.<br /><br />I use this code at start of page to grab the cookie.<br /><br /><pre><font class="small">code:</font><hr><br /> $PathToThreads = "c:/inetpub/wwwroot/www.newoutriders.org/ubbthreads/";<br /><br /> require ("{$PathToThreads}main.inc.php");<br /> $userob = new user;<br /> $user = $userob -> authenticate(U_Groups,U_Username);<br /> $html = new html;<br /></pre><hr><br /><br />Any more thoughts?

Top
#224709 - 09/16/02 05:45 PM Re: Differences in database security from 6.0.3 to 6.1 [Re: neuron]
JustDave Offline
That 70's Guy

Registered: 06/24/01
Posts: 4097
In your mysql.inc.php file change this: <br /> <br /><pre><font class="small">code:</font><hr> <br /> $What = find_environmental ("SCRIPT_NAME"); <br /> if ( ($user['U_Status'] != "Administrator") <br /> && ( (!stristr($What,"createtable")) && (!stristr($What,"altertable")) <br /> && (!stristr($What,"ubbimport.php")) ) ) { <br /> $error = "Database error only visible to forum administrators"; <br /> } <br /> else { <br /> $this->errordesc = mysql_error(); <br /> } <br /> <br /></pre><hr> <br /> <br />to this: <br /> <br /><pre><font class="small">code:</font><hr> <br /> $What = find_environmental ("PHP_SELF"); <br /> if ( ($user['U_Status'] != "Administrator") <br /> && ( (!stristr($What,"createtable")) && (!stristr($What,"altertable")) <br /> && (!stristr($What,"ubbimport.php")) ) ) { <br /> $error = "Database error only visible to forum administrators"; <br /> } <br /> else { <br /> $this->errordesc = mysql_error(); <br /> } <br /> <br /></pre><hr> <br /> <br /> <br />And see if that will give you a more descriptive error message. Then post the error message here. <br /> <br />I think I'll mention this change to Scream and see if this needs to be added to 6.1 as I have never been able to get a descriptive error message either. This could be do to how php is set and what environmentals are avialable to the users too.


Edited by Dave_L (09/16/02 05:57 PM)
_________________________
~Dave
ChattersOnline.com

Top
#224710 - 09/16/02 05:55 PM Re: Differences in database security from 6.0.3 to 6.1 [Re: sjsaunders]
Dave_L_dup1 Offline
Addict

Registered: 04/23/02
Posts: 1929
Loc: Virginia, USA
If you mention that, also mention that if the SQL error is suppressed, it should be appended to a log file, with a timestamp, IP and username. <img src="/forum/images/icons/wink.gif" alt="" /><br /><br />The same timestamp should also be included in the displayed " ... only visible ..." message, to facilitate matching it up with the full message in the log file.<br /><br />That would be helpful for user-reported MySQL errors, as well as ones that you get yourself.
_________________________
UBB.threads beta tester / threadsdev.com moderator
Software consulting services including UBB.threads problem resolution / installs / upgrades / customization.

Top
#224711 - 09/16/02 05:56 PM Re: Differences in database security from 6.0.3 to 6.1 [Re: neuron]
JustDave Offline
That 70's Guy

Registered: 06/24/01
Posts: 4097
Well perhaps that's not the problem then. Are you logged in as an Admin and can the script that is generating the errors read the cookie to verify your status?<br /><br /><br />The sql error is more descriptive than the one displayed to non admins...
_________________________
~Dave
ChattersOnline.com

Top
#224712 - 09/16/02 06:00 PM Re: Differences in database security from 6.0.3 to 6.1 [Re: sjsaunders]
Aglavalin Offline
Enthusiast

Registered: 06/18/02
Posts: 394
Loc: Southern California
I do not get this error when loged in as an admin, only on a non-admin login.

Top
#224713 - 09/16/02 06:04 PM Re: Differences in database security from 6.0.3 to 6.1 [Re: neuron]
JustDave Offline
That 70's Guy

Registered: 06/24/01
Posts: 4097
Ok then let's just show everyone the actual error then so we can get an idea of what it is. <br /> <br />change this: <br /> <br /><pre><font class="small">code:</font><hr> <br /> $What = find_environmental ("SCRIPT_NAME"); <br /> if ( ($user['U_Status'] != "Administrator") <br /> && ( (!stristr($What,"createtable")) && (!stristr($What,"altertable")) <br /> && (!stristr($What,"ubbimport.php")) ) ) { <br /> $error = "Database error only visible to forum administrators"; <br /> } <br /> else { <br /> $this->errordesc = mysql_error(); <br /> } <br /> <br /></pre><hr> <br /> <br />to this: <br /> <br /><pre><font class="small">code:</font><hr> <br /> $What = find_environmental ("SCRIPT_NAME"); <br /> if ( ($user['U_Status'] != "Administrator") <br /> && ( (!stristr($What,"createtable")) && (!stristr($What,"altertable")) <br /> && (!stristr($What,"ubbimport.php")) ) ) { <br /> $error = "Database error only visible to forum administrators"; <br /> $this->errordesc = mysql_error(); <br /> } <br /> else { <br /> $this->errordesc = mysql_error(); <br /> } <br /></pre><hr> <br /> <br />in your mysql.inc.php file and then login as a non admin user and see what the error could be. <img src="/forum/images/icons/smile.gif" alt="" />


Edited by Dave_L (09/16/02 08:07 PM)
_________________________
~Dave
ChattersOnline.com

Top
#224714 - 09/16/02 06:12 PM Re: Differences in database security from 6.0.3 to 6.1 [Re: sjsaunders]
Aglavalin Offline
Enthusiast

Registered: 06/18/02
Posts: 394
Loc: Southern California
Still the same error, no additional error message given to non-admin. Still works fine with no error for admin.

Top
#224715 - 09/16/02 06:16 PM Re: Differences in database security from 6.0.3 to 6.1 [Re: neuron]
JustDave Offline
That 70's Guy

Registered: 06/24/01
Posts: 4097
That's odd. I thought there would be a description with any sql error.<br /><br />It's hard to say what the problem is untill we can see what is causing the error with mysql. <img src="/forum/images/icons/crazy.gif" alt="" />
_________________________
~Dave
ChattersOnline.com

Top
#224716 - 09/16/02 06:24 PM Re: Differences in database security from 6.0.3 to 6.1 [Re: sjsaunders]
Aglavalin Offline
Enthusiast

Registered: 06/18/02
Posts: 394
Loc: Southern California
This is too weird, a reboot did no good. Maybe I'll check for a MySQL upgrade, I know I'm one version of PHP behind too. The same code works fine on a different section of the website with a different table of it's own. Maybe I'll check to see if this table got corrupted. If that fails, then I'll kick the server!

Top



Latest Posts
[7.2.1] - Naked shoutbox
by bellaonline
05/05/12 05:00 PM
[7.x] Stop Forum Spam Integration v0.4
by bellaonline
05/05/12 03:53 PM
Shout Box

(Views)Popular Topics
Known public proxy servers 1689885
Integrated Index Page (IIP) 5.3.1 555705
Finished-[6.5.2] Games Arcade Deluxe v1.9 501236
Integrated Index Page (IIP) 5.1.1 415112
TLD Bv2.1 Released - Threads Links Directory 396822
[6.0x] Who's Online 4.0.0 [Finished] 389412
Finished-[6.5.1] Integrated Index Page (IIP) 6.5 330423
Q & A 298663
Slash UBB 266936
[6.3.x] [beta] Hit Hack 2.0 227970
Forum Stats
13621 Members
59 Forums
37191 Topics
295716 Posts

Max Online: 686 @ 06/28/07 07:04 AM

 

 

 
fusionbb message board php hacks