Snitz Forums 2000 - (v3.4.03) BUG+FIX: Unsecured Access DB alert

Snitz Forums 2000

Username:	Password:
Save Password
Forgot your Password?

All Forums

Snitz Forums 2000 DEV-Group

DEV Bug Reports (Closed)

(v3.4.03) BUG+FIX: Unsecured Access DB alert

Forum Locked

Topic Locked

Printer Friendly

Author

Topic

nylonTiger
Starting Member

9 Posts

Posted - 15 April 2003 : 16:54:37

admin_home.asp file, line 66 should includes lcase() conversions.

if instr(lcase(strConnString), lcase(Server.MapPath("snitz_forums_2000.mdb")))> 0 then

Otherwise a connection string like

strConnString = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=c:\inetpub\forum\snitz_forums_2000.mdb"

where c:\inetpub\forum is the forum application directory, may bypass the alert

Edited by - nylonTiger on 15 April 2003 16:56:39

HuwR
Forum Admin

United Kingdom
20584 Posts

Posted - 15 April 2003 : 18:33:33

Your suggestion is correct, but your reasoning a little flawed, since your example is already all in lowercase

I presume you meantsomething like...
strConnString = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:\INETPUB\FORUM\SNITZ_FORUMS_2000.mdb"
where it has capital letters etc.

nylonTiger
Starting Member

9 Posts

Posted - 16 April 2003 : 12:22:54

I think the Server.MapPath function returns "C:\..." not "c:\...".

RichardKinser
Snitz Forums Admin

USA
16655 Posts

Posted - 17 June 2003 : 09:26:40

changed line #69 of admin_home.asp from this:

		if instr(strConnString, Server.MapPath("snitz_forums_2000.mdb"))> 0 then

to this:

		if instr(lcase(strConnString), lcase(Server.MapPath("snitz_forums_2000.mdb"))) > 0 then

could also change it to this, would accomplish the same thing:

		if instr(1, strConnString, Server.MapPath("snitz_forums_2000.mdb"), 1) > 0 then

RichardKinser
Snitz Forums Admin

USA
16655 Posts

Posted - 17 June 2003 : 09:27:26

fixed in v3.4.04

Topic

Forum Locked

Topic Locked

Printer Friendly

Jump To:

Snitz Forums 2000

This page was generated in 0.14 seconds.