Snitz Forums 2000
Snitz Forums 2000
Home | Profile | Register | Active Topics | Members | Search | FAQ
Username:
Password:
Save Password
Forgot your Password?

 All Forums
 Snitz Forums 2000 DEV-Group
 DEV Bug Reports (Closed)
 BUG + FIX Insecure post.asp if App variables lost
 Forum Locked  Topic Locked
 Printer Friendly
Previous Page | Next Page
Author Previous Topic Topic Next Topic
Page: of 4

Etymon
Advanced Member

United States
2383 Posts

Posted - 22 July 2008 :  16:57:35  Show Profile  Visit Etymon's Homepage
quote:
Originally posted by ruirib

There are hosts who don't allow FSO on their servers (we have an alternate mod setup for a reason). How would you do handle it in that case?



For me, personally, I would give the forum owner a choice. They could use the response: Response.Write("Server Error, The Application variables are not loaded") message or they could use their own message ... say something more like "Sorry, we are down for maintenance at this time. We will be back up and running as soon as we work on some things."

I wouldn't say anything regarding the server. Folks might think something is seriously wrong with the site and may feel dicey about coming back again. Site guests might even think a plain text message is a hack if there is nothing official-looking accompanying the message like a site logo and a familiar layout/color scheme.

Of course, the colors, logo, etc. would have to be hard-coded by the site owner, but a hard-coded template could be provided as well.<

Edited by - Etymon on 23 July 2008 04:25:00
Go to Top of Page

HuwR
Forum Admin

United Kingdom
20582 Posts

Posted - 23 July 2008 :  04:26:34  Show Profile  Visit HuwR's Homepage
obviously you can use whatever message you want, but because of the reason for the code you will need to hard code it into config.asp or redirect them to another page that has no db access etc.<
Go to Top of Page

ruirib
Snitz Forums Admin

Portugal
26364 Posts

Posted - 23 July 2008 :  04:32:23  Show Profile  Send ruirib a Yahoo! Message
quote:
Originally posted by Podge

quote:
The exact code you posted, Podge, will be executed every single time a user tries to access the forum.
Only if the database is available. There is a check at the very beginning. If the database is available then the application variables should be loaded without problem, no ?

Why would HuwR's code work above and not the check thats already there in config.asp ? Its basically the same check, just for a different application variable.


Not exactly sure what you mean. They both do tests, one tries to load stuff from the Db, the other, knowing the previous Db load attempt failed, stops page processing.<


Snitz 3.4 Readme | Like the support? Support Snitz too
Go to Top of Page

Podge
Support Moderator

Ireland
3775 Posts

Posted - 23 July 2008 :  05:15:05  Show Profile  Send Podge an ICQ Message  Send Podge a Yahoo! Message
The code I quoted from config.asp checks for database availability before trying to load the application variables. It won't go into a continiuous loop but it should be executed every time someone tries to view a forum page (it obviously doesn't in some cases).

This is the check in config.asp
If Application(strCookieURL & "ConfigLoaded")= "" Or IsNull(Application(strCookieURL & "ConfigLoaded")) Or blnSetup="Y" Then

This is HuwR's check
if Application(strCookieURL & "STRVERSION")= "" Or IsNull(Application(strCookieURL & "STRVERSION")) then


I don't see why one would catch the problem and the other wouldn't.<

Podge.

The Hunger Site - Click to donate free food | My Blog | Snitz 3.4.05 AutoInstall (Beta!)

My Mods: CAPTCHA Mod | GateKeeper Mod
Tutorial: Enable subscriptions on your board

Warning: The post above or below may contain nuts.
Go to Top of Page

HuwR
Forum Admin

United Kingdom
20582 Posts

Posted - 23 July 2008 :  06:14:00  Show Profile  Visit HuwR's Homepage
the problem is that the first check ascertains that there is no app vriables so it tries to load them from the db, this can also fail and leave you with empty app variables (db errors are trapped in config.asp and not shown), my check is there to halt the response and prevent security issues arising if the app variables have failed to load from the db.

If you want to do it a different way then like I said, feel free.<
Go to Top of Page

modifichicci
Average Member

Italy
787 Posts

Posted - 23 July 2008 :  10:31:20  Show Profile  Visit modifichicci's Homepage
Why not a setup.asp modified file with only the variable restore routine?<

Ernia e Laparocele
Forum di Ernia e Laparocele
Acces - MySql Migration Tutorial
Adamantine forum
Go to Top of Page

HuwR
Forum Admin

United Kingdom
20582 Posts

Posted - 23 July 2008 :  10:34:58  Show Profile  Visit HuwR's Homepage
rather than continually carping on and saying why don't you do this or why don't you do that, come up with a better solution that works and post it.<
Go to Top of Page

modifichicci
Average Member

Italy
787 Posts

Posted - 23 July 2008 :  11:07:37  Show Profile  Visit modifichicci's Homepage
To work on it I would only know if it is an accettable solution, as you know better then all of us the snitz code.
And I cannot say if a solution is working as I cannot reproduce the loss of variables, so it is an hypothesis that I submit to your opinion.
Sorry, and excuse me.<

Ernia e Laparocele
Forum di Ernia e Laparocele
Acces - MySql Migration Tutorial
Adamantine forum
Go to Top of Page

ruirib
Snitz Forums Admin

Portugal
26364 Posts

Posted - 23 July 2008 :  11:21:18  Show Profile  Send ruirib a Yahoo! Message
Actually, somethings need to be made clear:

1. Even when running setup.asp, it's config.asp that does the loading of application variables.

2. The loading of variables code, in config.asp, starts around line#135, with

if Application(strCookieURL & "ConfigLoaded")= "" Or IsNull(Application(strCookieURL & "ConfigLoaded")) Or blnSetup="Y" Then

setup.asp just sets the blnSetup variable to "Y" and includes config.asp.

3. I just did some testing by resetting IIS, shutting down the database server (using MySQL for this) and then visiting a local forum version. The message from the fix posted here shows up. I then started the MySQL server. Visiting any page, with the default config.asp, still shows the app variables not loaded message.

4. I changed line#135, config.asp from

if Application(strCookieURL & "ConfigLoaded")= "" Or IsNull(Application(strCookieURL & "ConfigLoaded")) Or blnSetup="Y" Then

to

if Application(strCookieURL & "STRVERSION")= "" Or IsNull(Application(strCookieURL & "STRVERSION")) Or blnSetup="Y" Then

that is, for the code used in the fix to test if the variables are loaded.

With this change application variables are automatically loaded, when the database is available again, without the need to run setup.asp.

5. As such, it seems that the problem lies with the current way config.asp detects whether the app variables are loaded or not, but it is easy to fix. Just replace your line#135 (the number may vary) by the line I posted, and you the app variables will be automatically loaded, just as if you ran setup.asp.

I tested this, it worked as described. For those who were not happy with the current fix alone, add this small change and you will get what you've been asking for.

P.S.: I don't know why one test works and the other does not. If someone cares to investigate, the help is appreciated.
<


Snitz 3.4 Readme | Like the support? Support Snitz too
Go to Top of Page

HuwR
Forum Admin

United Kingdom
20582 Posts

Posted - 23 July 2008 :  11:28:09  Show Profile  Visit HuwR's Homepage
ok, config.asp sets Application(strCookieURL & "ConfigLoaded") even if the loading of the app variables fails, it probably shouldn't be.<
Go to Top of Page

ruirib
Snitz Forums Admin

Portugal
26364 Posts

Posted - 23 July 2008 :  11:39:17  Show Profile  Send ruirib a Yahoo! Message
Yes, probably where you now have in lines# 224-242

if blnLoadConfig then
		Application.Lock
		do while not rsConfig.EOF
			Application(strCookieURL & Trim(UCase(rsConfig("C_VARIABLE")))) = Trim(rsConfig("C_VALUE"))
			rsConfig.MoveNext
		loop
		Application.UnLock
		rsConfig.close
	end if

	my_Conn.Close
	set my_Conn = nothing

	on error goto 0
	Application.Lock
	Application(strCookieURL & "ConfigLoaded")= "YES"
	Application.UnLock
End If

you should really have

	if blnLoadConfig then
		Application.Lock
		do while not rsConfig.EOF
			Application(strCookieURL & Trim(UCase(rsConfig("C_VARIABLE")))) = Trim(rsConfig("C_VALUE"))
			rsConfig.MoveNext
		Loop
		
		Application(strCookieURL & "ConfigLoaded")= "YES"
                
		Application.UnLock
		rsConfig.close
	end if

	my_Conn.Close
	set my_Conn = nothing
	
End If

<


Snitz 3.4 Readme | Like the support? Support Snitz too
Go to Top of Page

ruirib
Snitz Forums Admin

Portugal
26364 Posts

Posted - 23 July 2008 :  11:42:58  Show Profile  Send ruirib a Yahoo! Message
Yes, I can confirm that this fixes the issue, without the need to change line#135. So the problem really was the setting of

Application(strCookieURL & "ConfigLoaded")= "YES"

even if the config was not loaded.<


Snitz 3.4 Readme | Like the support? Support Snitz too
Go to Top of Page

HuwR
Forum Admin

United Kingdom
20582 Posts

Posted - 23 July 2008 :  13:19:59  Show Profile  Visit HuwR's Homepage
cool, have updated the initial post with this extra fix, and changed the wording to say to try later. hopefully it should mean that only one or two people ever get the message as it should now at least try to reload them the next time a page is accessed rather than needing setup.asp to be run.<
Go to Top of Page

ruirib
Snitz Forums Admin

Portugal
26364 Posts

Posted - 23 July 2008 :  13:26:39  Show Profile  Send ruirib a Yahoo! Message
Great .

<


Snitz 3.4 Readme | Like the support? Support Snitz too
Go to Top of Page

Podge
Support Moderator

Ireland
3775 Posts

Posted - 23 July 2008 :  14:15:59  Show Profile  Send Podge an ICQ Message  Send Podge a Yahoo! Message
Sorry Rui & HuwR but should you not check to see if the application variables have actually been loaded without error before assigning Application(strCookieURL & "ConfigLoaded")= "YES"

i.e. something like this


	if blnLoadConfig then
		Application.Lock
		do while not rsConfig.EOF
			Application(strCookieURL & Trim(UCase(rsConfig("C_VARIABLE")))) = Trim(rsConfig("C_VALUE"))
			rsConfig.MoveNext
		Loop
		
                if Application(strCookieURL & "STRVERSION")="" Or IsNull(Application(strCookieURL & "STRVERSION")) then
                            Response.Write("Server Error, The Application variables are not loaded. Please try again later.")
                            Response.End
                else
                            Application(strCookieURL & "ConfigLoaded")= "YES"
                end if
                
		Application.UnLock
		rsConfig.close
	end if

	my_Conn.Close
	set my_Conn = nothing
	
End If

<

Podge.

The Hunger Site - Click to donate free food | My Blog | Snitz 3.4.05 AutoInstall (Beta!)

My Mods: CAPTCHA Mod | GateKeeper Mod
Tutorial: Enable subscriptions on your board

Warning: The post above or below may contain nuts.
Go to Top of Page
Page: of 4 Previous Topic Topic Next Topic  
Previous Page | Next Page
 Forum Locked  Topic Locked
 Printer Friendly
Jump To:
Snitz Forums 2000 © 2000-2021 Snitz™ Communications Go To Top Of Page
This page was generated in 0.1 seconds. Powered By: Snitz Forums 2000 Version 3.4.07