PEAK XOOPS - Xoops Protector 2.57 
| Main : XOOPS Modules : |
|
||||||||||||
36785 
87.58 KB 
tar.gz|zip|php5 
Comments list
GIJOE
Posted on 2006/9/5 6:53
device
Posted on 2006/9/4 18:05
Hello GIJOE and Everyone!
Ive been introduce to Xoops a few month ago and I found out that Xoops really rock! Or in other word Im kinda in a rookie class about all this. So please be patient with me.. hehe. Anyways, wherever I may wonder around the net..(learning more about Xoops) I always ended up to Xoop Protector, whenever security issues kicks in and highly recomended too..Congrats!
So the story began when Ive downloaded Protector 2.57 and tried to install it into my test website running Apache 2,PHP5, MYSQL5..etc, and Xoops 2.2.13. And also on Xoops 2.0.15. ( Im learning ..ok ) Well everything runs fine, on both of them, until Ive modified the mainfile.php file according to your guideline. And afterthat..my website retuns empty page. Ive tried to do the same on a hosting service Ive subcribed. Well they runs PHP 4 and MySQL 4 also..but then the same thing happens. So, the question is "what am I missing here?"
So MR GIJOE and friends..can you guide me throughly about Protector installation? A "Dummie" kinda guideline would really help..Not for me but also ther rookies that shared the same fate as I did. And of course we would really appreciate that..
Ive been introduce to Xoops a few month ago and I found out that Xoops really rock! Or in other word Im kinda in a rookie class about all this. So please be patient with me.. hehe. Anyways, wherever I may wonder around the net..(learning more about Xoops) I always ended up to Xoop Protector, whenever security issues kicks in and highly recomended too..Congrats!
So the story began when Ive downloaded Protector 2.57 and tried to install it into my test website running Apache 2,PHP5, MYSQL5..etc, and Xoops 2.2.13. And also on Xoops 2.0.15. ( Im learning ..ok ) Well everything runs fine, on both of them, until Ive modified the mainfile.php file according to your guideline. And afterthat..my website retuns empty page. Ive tried to do the same on a hosting service Ive subcribed. Well they runs PHP 4 and MySQL 4 also..but then the same thing happens. So, the question is "what am I missing here?"
So MR GIJOE and friends..can you guide me throughly about Protector installation? A "Dummie" kinda guideline would really help..Not for me but also ther rookies that shared the same fate as I did. And of course we would really appreciate that..
GIJOE
Posted on 2006/7/22 5:26
mainfile.dist.php は、mainfile.php を作るための雛形ですので、そこにパッチを当てても意味がありません。
あくまで、mainfile.php です。
もし似たような部分が本当に存在しないのだとしたら、mainfile.php 待避Hackみたいなのがかかっているかもしれませんね。
あくまで、mainfile.php です。
もし似たような部分が本当に存在しないのだとしたら、mainfile.php 待避Hackみたいなのがかかっているかもしれませんね。
osaemon
Posted on 2006/7/21 22:24 | Last modified
現在、xoopsを構築中で、評判を聞き、Protector2.57をダウンロード、インストールさせていただきました。
うまくいったかに思えたのですが、セキュリティガイドを見たところ、
「'mainfile.php' : missing precheck 非推奨
READMEに記述された通りに、mainfile.php にパッチを当てて下さい」
と表示されていました。
確かに、mainfile.phpにはパッチは当てていません。
というのが、ダウンロードの記事中に具体例として
define('XOOPS_GROUP_ADMIN', '1');
define('XOOPS_GROUP_USERS', '2');
define('XOOPS_GROUP_ANONYMOUS', '3');
include( XOOPS_ROOT_PATH . '/modules/protector/include/precheck.inc.php' ) ;
if (!isset($xoopsOption['nocommon']) && XOOPS_ROOT_PATH != '' ) {
include XOOPS_ROOT_PATH."/include/common.php";
}
include( XOOPS_ROOT_PATH . '/modules/protector/include/postcheck.inc.php' ) ;
となっていたため、当該mainfile.phpを見てみたのですが、該当するような部分がなかったので、他のファイルを探したところ、mainfile.dist.phpに
define("XOOPS_GROUP_ADMIN", "1");
define("XOOPS_GROUP_USERS", "2");
define("XOOPS_GROUP_ANONYMOUS", "3");
include( XOOPS_ROOT_PATH . '/modules/protector/include/precheck.inc.php' ) ;
if (!isset($xoopsOption['nocommon']) && XOOPS_ROOT_PATH != '') {
include XOOPS_ROOT_PATH."/include/common.php";
}
include( XOOPS_ROOT_PATH . '/modules/protector/include/postcheck.inc.php' ) ;
}
という部分を見つけたので、こちらが当該ファイルだと思い、こちらにパッチを当てました。
しかし、以上のような始末です。
いったいどこが間違っていたのでしょうか。
素人なのでご教示いただければと思い、こちらに書き込みました。
当方の環境は次のとおりです。
サーバー xrea
xoops 2.0.15
よろしくお願いします。
うまくいったかに思えたのですが、セキュリティガイドを見たところ、
「'mainfile.php' : missing precheck 非推奨
READMEに記述された通りに、mainfile.php にパッチを当てて下さい」
と表示されていました。
確かに、mainfile.phpにはパッチは当てていません。
というのが、ダウンロードの記事中に具体例として
define('XOOPS_GROUP_ADMIN', '1');
define('XOOPS_GROUP_USERS', '2');
define('XOOPS_GROUP_ANONYMOUS', '3');
include( XOOPS_ROOT_PATH . '/modules/protector/include/precheck.inc.php' ) ;
if (!isset($xoopsOption['nocommon']) && XOOPS_ROOT_PATH != '' ) {
include XOOPS_ROOT_PATH."/include/common.php";
}
include( XOOPS_ROOT_PATH . '/modules/protector/include/postcheck.inc.php' ) ;
となっていたため、当該mainfile.phpを見てみたのですが、該当するような部分がなかったので、他のファイルを探したところ、mainfile.dist.phpに
define("XOOPS_GROUP_ADMIN", "1");
define("XOOPS_GROUP_USERS", "2");
define("XOOPS_GROUP_ANONYMOUS", "3");
include( XOOPS_ROOT_PATH . '/modules/protector/include/precheck.inc.php' ) ;
if (!isset($xoopsOption['nocommon']) && XOOPS_ROOT_PATH != '') {
include XOOPS_ROOT_PATH."/include/common.php";
}
include( XOOPS_ROOT_PATH . '/modules/protector/include/postcheck.inc.php' ) ;
}
という部分を見つけたので、こちらが当該ファイルだと思い、こちらにパッチを当てました。
しかし、以上のような始末です。
いったいどこが間違っていたのでしょうか。
素人なのでご教示いただければと思い、こちらに書き込みました。
当方の環境は次のとおりです。
サーバー xrea
xoops 2.0.15
よろしくお願いします。
tl
Posted on 2005/12/24 8:56 | Last modified
Firefox 1.0.7 has the prefetch as default and I have been able to deny any firefox 1.0.7 access by adding the following lines into .htaccess
I have also added the following lines into header.php
It seems not working. Firefox 1.5 with prefetch on will continue the crawling through all the links except it is getting 403 denied (I am not sure if it is because of the codes or the the lines in .htaccess - I have not done the test).
If protector could detect "prefetch", then it would be great if it could stop the crawling right away so no valuable resource get wasted by prefetch.
I am seriously thinking of banning firefox all together (including those with prefetch off) because of this extremly abusive feature.
RewriteCond %{HTTP:x-moz} ^prefetch [OR]
RewriteCond %{X-moz} ^prefetch
I have also added the following lines into header.php
//stop prefetching
if ((isset($_SERVER['HTTP_X_MOZ'])) && ($_SERVER['HTTP_X_MOZ'] == 'prefetch')) {
header('HTTP/1.0 403 Forbidden');
echo '403: Forbidden<br><br>Prefetching not allowed.';
exit;
}
It seems not working. Firefox 1.5 with prefetch on will continue the crawling through all the links except it is getting 403 denied (I am not sure if it is because of the codes or the the lines in .htaccess - I have not done the test).
If protector could detect "prefetch", then it would be great if it could stop the crawling right away so no valuable resource get wasted by prefetch.
I am seriously thinking of banning firefox all together (including those with prefetch off) because of this extremly abusive feature.
GIJOE
Posted on 2005/12/24 6:54
hi tl.
Quote:
It is possible if the client sends "This access is prefetch".
Do you mean google or the other reliable application service ?
If so, they tell us "This access is prefetch" by sending HTTP_USER_AGENT or the other HTTP request header.
I'm sorry that I'm not familier with such informations.
Quote:
Any plan adding an option against prefetch. Currently, DOS would be triggered if preftech were enabled. But the problem is that prefetch would continue to go through all the links regardless. It would be great if prefetch were detected, Protector would immediately stop rendering to the browser and maybe a warning message to the user (immediately replacing what the page they are seeing).
Is this possible?
It is possible if the client sends "This access is prefetch".
Do you mean google or the other reliable application service ?
If so, they tell us "This access is prefetch" by sending HTTP_USER_AGENT or the other HTTP request header.
I'm sorry that I'm not familier with such informations.
tl
Posted on 2005/12/22 8:07
GIJOE:
Any plan adding an option against prefetch. Currently, DOS would be triggered if preftech were enabled. But the problem is that prefetch would continue to go through all the links regardless. It would be great if prefetch were detected, Protector would immediately stop rendering to the browser and maybe a warning message to the user (immediately replacing what the page they are seeing).
Is this possible?
tl
Any plan adding an option against prefetch. Currently, DOS would be triggered if preftech were enabled. But the problem is that prefetch would continue to go through all the links regardless. It would be great if prefetch were detected, Protector would immediately stop rendering to the browser and maybe a warning message to the user (immediately replacing what the page they are seeing).
Is this possible?
tl
Login