[ Closed ] Hacked by Altan (Page 3 of 5)

##
##
##        Mod title:  Group Change Security MOD.
##
##      Mod version:  1.0
##   Works on PunBB:  1.2.6
##     Release date:  2005-08-24
##           Author:  Öyvind A. Sörensen (oyvind.andre.sorensen@gmail.com)
##
##      Description:  Adds an additional security check when trying to 
##                    add a user to the administrator or moderator groups.
##
##   Affected files:  some_script.php
##                    include/foo.php
##
##       Affects DB:  Yes
##                    Adds 2 columns to the users table, and adds a value
##                    to your config table
##
##            Notes:  This mod adds a security check when trying to the
##                    moderator or administrator user groups. It will mail a
##                    random 128 character verification key to the e-mail
##                    adresses specified in the admin user panel, after
##                    asking to change groups.
##                    It will only be valid for the time specified in the
##                    newly added option under "Time and timeouts" under
##                    admin options. Default is 600 sec (10 minutes).
##                    If the key don't get verified within that period, or if
##                    an invalid key gets entered, the user will stay within
##                    his/her current user group.
##
##
##       DISCLAIMER:  Please note that "mods" are not officially supported by
##                    PunBB. Installation of this modification is done at your
##                    own risk. Backup your forum database and any and all
##                    applicable files before proceeding.
##
##


#
#---------[ 1. UPLOAD ]-------------------------------------------------------
#

install_mod.php to /
verify_group_change.php /lang/English/

#
#---------[ 2. RUN ]----------------------------------------------------------
#

install_mod.php


#
#---------[ 3. DELETE ]-------------------------------------------------------
#

install_mod.php


#
#---------[ 4. OPEN ]---------------------------------------------------------
#

profile.php


#
#---------[ 5. FIND (line: 470) ]---------------------------------------------
#

else if (isset($_POST['update_group_membership']))
{
    if ($pun_user['g_id'] > PUN_ADMIN)
        message($lang_common['No permission']);

    confirm_referrer('profile.php');

    $new_group_id = intval($_POST['group_id']);


#
#---------[ 6. AFTER ADD ]-------------------------------------------------
#

    if($new_group_id <= PUN_MOD) 
    {
        require PUN_ROOT.'include/email.php';
        
        // Get the username, current key & group change time of the user we want to add as a new mod or admin.
        $result = $db->query('SELECT username, mod_groupchange_key, mod_groupchange_time FROM '.$db->prefix.'users WHERE id='.$id) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
        list($username, $GCKey, $GCTime) = $db->fetch_row($result);
        
        $KeyToVerify = strip_tags(trim($_POST['activation_key'])); // The key we will try to verify
        $TimeRightNow = time(); // Get the current time
        $TimeOut = $pun_config['o_gc_key_timeout'];
        
        switch($GCKey):
            case NULL: // There are no current key in the database, so we'll generate a new one.
                $randkey = random_pass(128); // Generate a random key, 128 characters in length
                // Let's insert our key into the database
                $db->query('UPDATE '.$db->prefix.'users SET mod_groupchange_key=\''.$randkey.'\', mod_groupchange_time=\''.$TimeRightNow.'\' WHERE id='.$id) or error('Unable to change user group', __FILE__, __LINE__, $db->error());
            break;
            case !NULL: // There are already a key in the DB, so we'll attempt to validated it + check the age of it. If OK, we'll accept the group change. If failed, well, erase the values so that you'll have to start all over again.
                if(time()-$GCTime >= $TimeOut || $KeyToVerify !== $GCKey ) {
                    $db->query('UPDATE '.$db->prefix.'users SET mod_groupchange_key=\'\', mod_groupchange_time=\'\' WHERE id='.$id) or error('Unable to change user group', __FILE__, __LINE__, $db->error());
                    require PUN_ROOT.'lang/'.$pun_user['language'].'/verify_group_change.php';
                    redirect('profile.php?section=admin&id='.$id, $lang_verify_group_change['Verify failed']);
                } else {
                    // Success! The key was validated, and the user can safely be added to his new group.
                    $db->query('UPDATE '.$db->prefix.'users SET group_id='.$new_group_id.', mod_groupchange_key=\'\', mod_groupchange_time=\'\' WHERE id='.$id) or error('Unable to change user group', __FILE__, __LINE__, $db->error());
                    require PUN_ROOT.'lang/'.$pun_user['language'].'/verify_group_change.php';
                    redirect('profile.php?section=admin&id='.$id, $lang_verify_group_change['Verify success']);                    
                }
            break;
        endswitch;
        
        switch($new_group_id):
            case 1:
                $ipAdress = get_remote_address();
                require PUN_ROOT.'lang/'.$pun_user['language'].'/verify_group_change.php';
                pun_mail($pun_config['o_mailing_list'], $lang_verify_group_change['Verify admin mailsubject'], $lang_verify_group_change['Verify admin mailbody']);
                message($lang_verify_group_change['Verify groupchange']);
                break;
            case 2:
                $ipAdress = get_remote_address();
                require PUN_ROOT.'lang/'.$pun_user['language'].'/verify_group_change.php';
                pun_mail($pun_config['o_mailing_list'], $lang_verify_group_change['Verify mod mailsubject'], $lang_verify_group_change['Verify mod mailbody']);
                message($lang_verify_group_change['Verify groupchange']);
                break;
        endswitch;
    } 
    else
    {


#
#---------[ 7. FIND (line: 517) ]---------------------------------------------------------
#

    redirect('profile.php?section=admin&id='.$id, $lang_profile['Group membership redirect']);


#
#---------[ 8. BEFORE, ADD ]---------------------------------------------
#

    }


#
#---------[ 9. FIND (line: 1564) ]---------------------------------------------------
#

                        echo "\t\t\t\t\t\t\t\t".'<option value="'.$cur_group['g_id'].'">'.pun_htmlspecialchars($cur_group['g_title']).'</option>'."\n";
                }

?>
                            </select>


#
#---------[ 10. AFTER ADD ]--------------------------------------------
#

                            <label><?php require PUN_ROOT.'lang/'.$pun_user['language'].'/verify_group_change.php'; echo $lang_verify_group_change['Verify key'] ?><br /><input type="text" name="activation_key" value="" size="60" maxlength="128" /><br /></label>


#
#---------[ 11. OPEN ]-------------------------------------------------
#

admin_options.php


#
#---------[ 13. FIND (line: 105) ]---------------------------------------------
#

    $form['redirect_delay'] = intval($form['redirect_delay']);

    
#
#---------[ 14. AFTER ADD ]---------------------------------------------
#

    $form['gc_key_timeout'] = intval($form['gc_key_timeout']); // Added for the group change security mod


#
#---------[ 15. FIND (line: 319) ]---------------------------------------------
#

                                <tr>
                                    <th scope="row">Redirect time</th>
                                    <td>
                                        <input type="text" name="form[redirect_delay]" size="3" maxlength="3" value="<?php echo $pun_config['o_redirect_delay'] ?>" />
                                        <span>Number of seconds to wait when redirecting. If set to 0, no redirect page will be displayed (not recommended).</span>
                                    </td>
                                </tr>
                                

#
#---------[ 16. AFTER ADD ]---------------------------------------------
#

                                <tr>
                                    <th scope="row">Group change key timeout</th>
                                    <td>
                                        <input type="text" name="form[gc_key_timeout]" size="4" maxlength="4" value="<?php echo $pun_config['o_gc_key_timeout'] ?>" />
                                        <span>Number of seconds the group change activation key will be valid. Defaults to 600 seconds (10 minutes).</span>
                                    </td>
                                </tr>
                                

#
#---------[ 17. SAVE/UPLOAD ]-------------------------------------------------
#

function authenticate() {
  header('WWW-Authenticate: Basic realm="punBB Administration"');
  header('HTTP/1.0 401 Unauthorized');
  echo "You must enter a valid login ID and password to access this resource\n";
  exit;
  }
 
if (!isset($_SERVER['PHP_AUTH_USER'])) {
  authenticate();
  }
else  {
  $auth = file("./admin_pass.pwd");
  list($user, $password) = split(":", trim($auth[0]));
  if($_SERVER['PHP_AUTH_USER'] != $user || md5($_SERVER['PHP_AUTH_PW']) != $password)  {
    authenticate();
    }
  }

Tester:0cbc6611f5540bd0809a388dc95a615b

  $auth = file("./admin_pass.pwd");

Tester:0cbc6611f5540bd0809a388dc95a615b

if (!isset($_SERVER['PHP_AUTH_USER'])) {
 // authenticate();
  }
else  {
  $auth = file("./admin_pass.pwd");
  list($user, $password) = split(":", trim($auth[0]));
echo "$user $password";
/*
  if($_SERVER['PHP_AUTH_USER'] != $user || md5($_SERVER['PHP_AUTH_PW']) != $password)  {
    authenticate();
    }
*/
  }