I got his email. But I have changed the file permission for the cinfigdata.pm file, but then fileman won't work, what should be the correct permission setting for this file?

name: yeckr
country:
comment: hi there...i want to warn you, your site can easily be hacked, since your fileman password can be viewed by anyone:
http://xianghua.freeshell.org/cgi-bin/fileman/ConfigData.pm

666, but 664 may work.

Cheers

Andy (mod)
andy@ultranerds.co.uk

---

Want to give me something back for my help? Please see my Amazon Wish List
GLinks ULTRA Package | GLinks ULTRA Package PRO
Links SQL Plugins | Website Design and SEO | UltraNerds | ULTRAGLobals Plugin | Pre-Made Template Sets | FREE GLinks Plugins!

but using 666/664 someone can easily see my password by going to the CinfigData.pm's address

Only other way I can think of doing it, is adding in CHMOD commands;


This would obviously require you editing the script, and finding anywhere that ConfigData.pm is written to.

Hope that helps.

Andy (mod)
andy@ultranerds.co.uk

---

Want to give me something back for my help? Please see my Amazon Wish List
GLinks ULTRA Package | GLinks ULTRA Package PRO
Links SQL Plugins | Website Design and SEO | UltraNerds | ULTRAGLobals Plugin | Pre-Made Template Sets | FREE GLinks Plugins!

I am getting abit confused here.

All I am saying, is to add those parts of codes around when Fileman writes to ConfingData.pm. It will CHMOD the file correctly for writing to it, and then set it back to 644, so its not viewable via the web.

Cheers

Andy (mod)
andy@ultranerds.co.uk

---

Want to give me something back for my help? Please see my Amazon Wish List
GLinks ULTRA Package | GLinks ULTRA Package PRO
Links SQL Plugins | Website Design and SEO | UltraNerds | ULTRAGLobals Plugin | Pre-Made Template Sets | FREE GLinks Plugins!

can't find in the script anything to do with Configdata

Hi,

There is another way to handle it, just follow the instruction below to work it out:

- Move the ConfigData.pm to /path_to/private/lib

- Search for $CFG_PATH = "ConfigData.pm" in FileMan.pm ( around line #26) and change to:
$CFG_PATH = '/path_to/private/lib/ConfigData.pm';

- Change the pwd_single subroutine a little bit:

sub pwd_single () {
#------------------------------------------------------
# Change password in single version
#
my $self = shift;
($self->{cfg}->{single}) or die $LANGUAGE{ERR_VERSION};
my $fn = "$self->{cfg}->{priv_path}/lib/ConfigData.pm";
.....

}

Now, the ConfigData.pm cannot be accessed through URL any more.

TheStone.

B.

This is the very first thing I noticed after I installed the script - ConfigData.pm is left to be poked at will.

A lot of good things I want to say about the program, but PLEASE FIX it in your next release.

Hi,

Actually, We already fixed it and added some new features in the next release, but we haven't released it yet.

TheStone.

B.