quote:

---

Hey Alan,

Server priviledges that are required in order to move files between directories can be a security risk -- escpecially with web sniffers that are looking for places to put potentially dangerous exe files.

Why not make your mod look at the contents of a directory and change the database parameters to "add" or "remove" avatars. (I'm not sure why "moving" files is neccessary.) In this way, security is not a compromised. Until then, I would suggest that users at least change the directory names to something other than "Avatars" and "New_Avatars". EVERYONE that reads about this mod can have access to these directories for any server that has implemented this mod! If you at least change the names, then someone has to go out of there way to hack in.

FOr sites hosted by NT Server, the other thing that you can do is to use code like this:

<%
		If Request.ServerVariables("LOGON_USER")="" Then
			Response.Status = "401 Access Denied"
		end if
%>

This uses NT authentication before files are moved. This way permissions are kept and whatever you use for a password on your server allows you the access that you need. (You need Internet Explorer 5.5 or higher.) I put the above code at the top of the admin_add_avatar.asp, and it seems to work fine.

Great mod by the way... I think I said this before though!

Cheers!



Rob Poretti
Sascom Marketing Group ~ Toronto
vox.905.825.5373 fax.905.825.5960

Edited by - Rob Poretti on 18 August 2001 14:23:41

---

O MY GOD, this is something serious . should i go ahead and change the code?

 
     <td bgcolor="<% =CColor %>" align="center">
 <% if Trim(rs("M_AVATAR_URL")) <> "" and lcase(rs("M_AVATAR_URL")) <> "noavatar.gif" and (IsNull(rs("M_AVATAR_URL")) = false) then %>
	<%	'## Forum_SQL - Get Avatar Settings from DB
				strSql = "SELECT " & strTablePrefix & "AVATAR2.A_WSIZE"
				strSql = strSql & ", " & strTablePrefix & "AVATAR2.A_HSIZE"
				strSql = strSql & ", " & strTablePrefix & "AVATAR2.A_BORDER"
				strSql = strSql & " FROM " & strTablePrefix & "AVATAR2"

			set rsav = my_Conn.Execute (strSql) %>
     <img src="<% =rs("M_AVATAR_URL") %>" align="absmiddle" width="<% =rsav("A_WSIZE") %>" height="<% =rsav("A_HSIZE") %>" border="<% =rsav("A_BORDER") %>" hspace="0">

      <% set rsav = nothing 
		 end if%>
		 </td>