 |
 |
 |
 |
#93246 - 02/19/04 12:43 PM
Will be needing some help soonly
|
Member
Registered: 02/20/03
Posts: 178
Loc: highspire, pa
|
Here's my site,: http://dragboatalley.com/cgi-bin/ultimatebb.cgi it's running on a Win2k server that I co-lease, so I have complete remote control of the box (No ISP to jerk you around), and i managed to get php installed and the accelerator working if that matters. I've also gotten pretty good at translating unix/linux instructions to windows and can assist someone thats not strong in Win32 environments. Only weird thing about my setup is I do use sendmail instead of SMTP (note2self - dang i forgot to mention that gripe on 6.8 feature request topic). Oh yeah, and I do have one hack currently in place... the banner ad engine I use refused to play nicely when setup in a template and other front-end java applets caused to much trouble for aol users. I'll be upgrading from 6.6 classic to 6.7 this weekend. After which I'm interested in possibly hiring someone to do some mods for me. Fair Warning - I'm one tough cookie, very picky about details, and an old school windows developer who could do this stuff myself, if A) I didnt hate perl so intensely; and B) I didnt have so much other work on my plate right now that generates revenue (this site is a personal interest project... and initial investment from advertisers is long gone). So my budget is limited and I might not be the easiest person to work with; but the upside is I understand geek speak, I'll definitely be a repeat customer as time goes by, and I can effectively take the reins for maintaining these mods when the job is done with little-to-no followup required (my daily life includes tightly managed source code libraries and beyond compare tedium). So if you need work, your availability will be open sometime in next 30 days, and you got the patience to deal with a very anal-retentive developer like me, Here's what I'm interested in getting done... 1) Urgent Priority - Login process doctoring.  My site has a competitor with a long dirty history of nasty tricks and abusing their members, and I got big target on my back for launching a site that's run professionally. We've already had 3 or 4 episodes where a password crack hacker tool was used to compromise user accounts. And it took just under two hours to crack a password on an account that didnt have Publicly Displayed Name set to hide the login name. So I'm looking for some kind of safety net... customized flood protection would suffice if thats the best that can be done without serious brain surgery. But I'd really be interested in some way to temporarily lock an account after X number of failed attempts. I'm also open for other suggestions if you have any regarding preventing brute force login hacks. 2) Slightly-urgent priority - it sure would be nice to lock down Publicly Displayed Name abit more if possible. Like making it a required field and forcing it to be different from login name. 3) Medium Priority - I could do great things on my site with the Calendar mod!! 4) Low Priority - hit hack sure would make my members happy. Personally, I'm not too keen on it myself... I'd a bought threads if I was. But I'm real tired of hearing about hit counts on topics  Depending on the price, I may wanna do these mods in phases, and/or I may eventually have the time to do the last two issues myself. But I definitely need issues 1 and 2 done in the near future. If your interested in this work, please send me a private message or email thru this board. If that doesnt get you a fast enough response (my clients like to keep me tied to my chair), pick up the phone and call me at 717-985-9191. thanks!
|
|
Top
|
|
|
|
 |
 |
 |
 |
|
|
|
|
#93247 - 02/19/04 02:09 PM
Re: Will be needing some help soonly
|
Admin Emeritus
Resident Code Hacker
Registered: 01/09/00
Posts: 5438
Loc: Lynnwood, WA
|
quote:
...I didnt hate perl so intensely... Oi! I'll have to cure you of that. 1) Adding a simple (broken) floodcheck to the login process is simple. ultimatebb.cgi, find: if ($ubb eq 'do_login') {Add under: &RequireCode("$vars_config{CGIPath}/ubb_lib_posting.cgi");
&floodcheck;Do note that this will block any multiple login attempts, even if the attempt will be successful, so expect users that make lots of typos to be very, very annoyed. Locking an account is a few degrees more complex. 2) PDN uniqueness... Mm. Okay, this is somewhat easy. First thought. Untested code. ubb_registration.cgi. Find: &CheckForExistingNames($lc_username);
&CheckForExistingNames($lc_public_name); Add under: if($lc_username eq $lc_public_name) {
&StandardHTML("Error message here");
}Replace "Error message here" with your error of choice, of course. You'll note that there's no blank PDN check - that's because $lc_public_name will be equal to $lc_username if there's no PDN. Now, for the profile edit form. Edit ubb_profile.cgi. Find: Add under: if(($lc_old_public_name ne $lc_new_public_name) && ($lc_new_public_name eq $lc_un)) {
&StandardHTML("Don't DO that!");
}Replace the error as required, etc, etc. Again, this is untested code, written on the fly. Now, a warning. We've found that many common usernames and PDNs are used over the life of a board. Users that choose two different names have twice the chance of hitting a reserved name. Users tend not to read the error message that tells them which of their names is taken, which will be a support issue for you. 3) Here's the calendar for 6.7: http://www.ubbdev.com/ubb/ultimatebb.php/topic/33/99.html 4) This is the hit hack for 6.4, which may well work in 6.7: http://www.ubbdev.com/ubb/ultimatebb.php/topic/33/18.html
_________________________
UBB.classic: Love it or hate it, it was mine.
|
|
Top
|
|
|
|
|
|
|
|
|
|
|
|
|
#93255 - 02/19/04 07:07 PM
Re: Will be needing some help soonly
|
Spotlight Winner
Registered: 06/28/01
Posts: 2642
Loc: Southern California | Guitar o...
|
|
|
Top
|
|
|
|
|
|
|
|
|
|
|
|
#93257 - 02/20/04 12:34 PM
Re: Will be needing some help soonly
|
Member
Registered: 02/20/03
Posts: 178
Loc: highspire, pa
|
Originally posted by Charles Capps: 1) Adding a simple (broken) floodcheck to the login process is simple. ultimatebb.cgi, find: if ($ubb eq 'do_login') {Add under: &RequireCode("$vars_config{CGIPath}/ubb_lib_posting.cgi");
&floodcheck;dang hackers busted into my login again last nite. So I just tried to load above tweak on 6.6 and ran into problem... I get this error message: Undefined subroutine &main::floodcheck called at C:websitesubb6_dragboatalleycgi-binultimatebb.cgi line 399.here's what the code looks like: if ($ubb eq 'do_login') {
&GetOrPost("POST");
my $ip_number = &GetIPAddress;
&check_ip_bans($ip_number);
$skip_cookie_check = 'true';
&RequireCode("$vars_config{CGIPath}/ubb_lib_2.cgi");
&floodcheck;
my @user_info = &verify_id("$in{username}", "$in{password}"); # -> lib_2!did i stick this floodcheck line in the wrong place maybe???
|
|
Top
|
|
|
|
|
|
|
|
|
|
oh geeze... ummm... did i mention i get dangerously inspired? :rolleyes:
Previous Topic
Index