Fun With Tevs - Not Good If You Are Running Tevs

**candyflip** · 03-03-2008, 03:49 PM

Originally posted by teksonline

no it means i wrote my own fucking admin, how do you like those apples?

So why exactly did you purchase multiple copies if it's garbage and you could do it yourself?

I know why I bought it. I can't code and wanted to test the waters before having something custom coded.

I have no doubt that Dean and company will square this up when he gets back online.

**Iron Fist** · 03-03-2008, 03:54 PM

Originally posted by Dennis Rodman

Nicely played sir..

**sortie** · 03-03-2008, 04:00 PM

Originally posted by teksonline

why am i fighting with a bunch of trolls.. lol

im gone, i wont be back... have fun playing games with other trolls...

ughm... i laugh at the next moron to pay $10k to skin this board.. lol, worse then shoveling it into a fireplace hahah

You are arguing with youself fatso.

Everyone except the Rodman dick with the fake nick was on your side until
you starting blowing shit out of your mouth on everybody.

**Socks** · 03-03-2008, 04:07 PM

Drink much lately?

**gleem** · 03-03-2008, 04:12 PM

thread of the year

**farkedup** · 03-03-2008, 04:43 PM

Originally posted by teksonline

I've already fixed my scripts, i've actually 100% rewritten most of this script as most of it dont even work as it appears.

have you rewritten 100% or just most?

here is a basic security function: http://entertainmentscript.com/sec.phps is 1 thing and running mysql_real_escape_string on EVERY user submitted $_POST or $_GET or $_REQUEST variable BEFORE inserting it into the DB will go a LONG ways.

This at the bottom of something like a config file will reject forms submitted from other places.

Code:

if (isset($_POST)){
$ip2 = (empty($_SERVER['REMOTE_ADDR'])) ? 'empty' : $_SERVER['REMOTE_ADDR'];
$ua = (empty($_SERVER['HTTP_USER_AGENT'])) ? 'empty' : $_SERVER['HTTP_USER_AGENT'];
$ru = (empty($_SERVER['REQUEST_URI'])) ? 'empty' : $_SERVER['REQUEST_URI'];
$rm = (empty($_SERVER['REQUEST_METHOD'])) ? 'empty' : $_SERVER['REQUEST_METHOD'];
if ($ua == "empty") { exit();}   
if ($ua == "-") 	{ exit();}
if ($ip2 == "empty"){ exit();} 
if ($ru == "empty") {exit();}   
if ($rm == "empty") { exit();}   
}

**GrouchyAdmin** · 03-03-2008, 04:48 PM

Some people should be shot for abusing ternaries.

**crockett** · 03-03-2008, 05:00 PM

Originally posted by teksonline

lets get soemthing straight, i own multiple licenses of this script.
and I am outraged at some of this fucking code i see here..
It's beyond fucking ridiculous in todays age to see such fucking crap
in todays coding world... and quite frankly this script is a $29 script
someone could write in 2 fucking days correctly...

so fuck off and die already I dont give a shit, once again
a nameless wonder on attack...

so why would you buy several copies of the scipt then check the code afterwards?

**farkedup** · 03-03-2008, 05:09 PM

the entire problem is security, the code other than that is fine.

situations like this:

Code:

@mysql_query("INSERT INTO tube_comments SET cmessage='$acomments', cvid='$vid', cyourname='$yourname', capproved='N', cdate=NOW()");

simply have: $yourname = $_POST['yourname'];

what HAS to be done is before you EVER insert anything into the DB you need to run something like this:

$number = mysql_real_escape_string($_POST['txtNumber']);

Also if you want a quick protection from form bots simply paste that code I posted into config.php

As you can imagine the fix is very simple BUT it happens in so many places that it will take a bit of time for a real fix to be posted.

Zorgman if you want any help let me know. I can certainly think of a few things I'd do to secure this thing and a few things that could REALLY improve the speed of this script.

**halfpint** · 03-03-2008, 05:23 PM

hello farkedup you have been a busy man of late havent talked to you in a while. If you aint busy later I will hit you up on ICQ

**dig420** · 03-03-2008, 05:26 PM

I'm getting ready to buy this script, farkedup or one of you other eggheads want to handle the install and the security fix?

**farkedup** · 03-03-2008, 05:33 PM

Originally posted by halfpint

hello farkedup you have been a busy man of late havent talked to you in a while. If you aint busy later I will hit you up on ICQ

I'm working on moving a bunch of my editable pages and templates into the DB and coding a caching system and then I have to code a tool to allow users to submit embed codes... THEN after all of that is done I'm going to recode some sections of my script so if you can think of anything that needs an overhaul please give me some suggestions! I think making these things easier to edit will help out a LOT of people.

**candyflip** · 03-03-2008, 05:38 PM

Originally posted by dig420

I'm getting ready to buy this script, farkedup or one of you other eggheads want to handle the install and the security fix?

I just spoke with Dean and this is something that has been fixed. The problem was that some people didn't get the updated files. Simple as that.

**halfpint** · 03-03-2008, 05:42 PM

Originally posted by farkedup

I'm working on moving a bunch of my editable pages and templates into the DB and coding a caching system and then I have to code a tool to allow users to submit embed codes... THEN after all of that is done I'm going to recode some sections of my script so if you can think of anything that needs an overhaul please give me some suggestions! I think making these things easier to edit will help out a LOT of people.

Yep ok I will speak to you a bit later on ICQ

**Va2k** · 03-03-2008, 05:43 PM

Originally posted by candyflip

I just spoke with Dean and this is something that has been fixed. The problem was that some people didn't get the updated files. Simple as that.

Yea same here.. Dean is a ok top dawg im my book!

**Zorgman** · 03-03-2008, 05:59 PM

Hi Guys,

While I do not like the fact that teksonline has to resort to blackmail to tell someone that their is a problem, I thank him for pointing out a major problem that I didn't even know about.

Over 5 weeks ago I had a few programmers check the source code of TEVS for any errors I made. They came back with a few fixed and I put those fixes into place. I rezipped TEVS and uploaded it to the server. But it was my mistake I had uploaded it to the wrong directory. So up till now everyone has downloaded the old original files. - My Fault. I am sorry about that.

I believe a few installs that I did got the secure files but please contact me anyway with the below details.

If you have TEVS installed, please contact me right away and I will personally fix this for you.

Email: [email protected]

BTW - MrYellow, trying to force your services and script project on me and webmasters using TEVS is in way helping me or these webmasters. As I have pointed out, you took offense when I declined your offer and now you call me names like {wanked} and {tosser}. For what reason?

**Zorgman** · 03-03-2008, 06:06 PM

teksonline, I would also like to add. That since you had 100% re-written the admin controls which work fine on over 400 licenses so far. I can only asume you are using a stolen copy of TEVS.

I'v got no emails or support tickets from you nor icq or other forms of messages.

Any normal members would have asked questions before trying to blackmail someone. Unless their using stolen code.

Prove me wrong!

**shermo** · 03-03-2008, 06:07 PM

Originally posted by Zorgman

Hi Guys,

While I do not like the fact that teksonline has to resort to blackmail to tell someone that their is a problem, I thank him for pointing out a major problem that I didn't even know about.

Over 5 weeks ago I had a few programmers check the source code of TEVS for any errors I made. They came back with a few fixed and I put those fixes into place. I rezipped TEVS and uploaded it to the server. But it was my mistake I had uploaded it to the wrong directory. So up till now everyone has downloaded the old original files. - My Fault. I am sorry about that.

I believe a few installs that I did got the secure files but please contact me anyway with the below details.

If you have TEVS installed, please contact me right away and I will personally fix this for you.

Email: [email protected]

BTW - MrYellow, trying to force your services and script project on me and webmasters using TEVS is in way helping me or these webmasters. As I have pointed out, you took offense when I declined your offer and now you call me names like {wanked} and {tosser}. For what reason?

Thanks Dean! I just dropped you a line.

**KrisKross** · 03-03-2008, 06:15 PM

Originally posted by sortie

Not good.

php combined with mysql is known for this.

Riiiight. And CGI is bulletproof, right?

**Just Alex** · 03-03-2008, 06:26 PM

post it now, dude.

**bashbug** · 03-03-2008, 06:31 PM

Damn this guy is a real psychopath

**marketsmart** · 03-03-2008, 06:44 PM

ok wait.. i got lost here.. how was anyone blackmailed? was there money involved? if so, thats a criminal offense... if not moneym then what?

not trying to be a dick here, i just dont see blackmail here when someone just pointed out security leaks in an app.

hlowever, thiss should have been discussed in private rather then here...

**KrisKross** · 03-03-2008, 06:47 PM

Originally posted by marketsmart

ok wait.. i got lost here.. how was anyone blackmailed? was there money involved? if so, thats a criminal offense... if not moneym then what?

not trying to be a dick here, i just dont see blackmail here when someone just pointed out security leaks in an app.

hlowever, thiss should have been discussed in private rather then here...

Blackmail is the threat to reveal something damaging unless a demand is met.

**NOTR** · 03-03-2008, 06:51 PM

k0nr4d Didn't I hire you years ago?

**sortie** · 03-03-2008, 07:16 PM

Originally posted by KrisKross

Riiiight. And CGI is bulletproof, right?

Well, I'd say that it's impossible to inject something into a
mysql database that doesn't even exist.

But maybe you know something I dont know.

You did read what the stated problem was didn't you?

And for your information many servers, if not most, are now running php as cgi.

http://us3.php.net/security.cgi-bin

Read that. Please fucking read it!!!!

The notion that running php means never running cgi is the biggest lie ever sold!

**KrisKross** · 03-03-2008, 07:31 PM

Are you retarded?

Originally posted by sortie

Well, I'd say that it's impossible to inject something into a
mysql database that doesn't even exist.

But maybe you know something I dont know.

You did read what the stated problem was didn't you?

And for your information many servers, if not most, are now running php as cgi.

http://us3.php.net/security.cgi-bin

Read that. Please fucking read it!!!!

The notion that running php means never running cgi is the biggest lie ever sold!

**QuaWee** · 03-03-2008, 07:36 PM

Originally posted by marketsmart

ok wait.. i got lost here.. how was anyone blackmailed? was there money involved? if so, thats a criminal offense... if not moneym then what?

not trying to be a dick here, i just dont see blackmail here when someone just pointed out security leaks in an app.

hlowever, thiss should have been discussed in private rather then here...

Are you tarded?

**marketsmart** · 03-03-2008, 07:38 PM

Originally posted by QuaWee

Are you tarded?

maybe....

**Nookster** · 03-03-2008, 07:40 PM

You fuckin serious mang? You mean a simple:

$var = mysql_real_escape_string($var);

would fix the sploit? LOL Man, I thought it would be better coded for sure. Sad to hear.

**MattO** · 03-03-2008, 07:56 PM

I'm glad I program in ColdFusion, bless you CFQueryParam.

**sortie** · 03-03-2008, 07:56 PM

Originally posted by KrisKross

Are you retarded?

No, but you are because you can't read.

Here, read.... http://us3.php.net/security.cgi-bin

Your php is most likely running as cgi on the server yet you claim that
php is somehow better than cgi.

**KrisKross** · 03-03-2008, 08:02 PM

Originally posted by sortie

No, but you are because you can't read.

Here, read.... http://us3.php.net/security.cgi-bin

Your php is most likely running as cgi on the server yet you claim that
php is somehow better than cgi.

I made no such claims, tardo.

**pr0** · 03-03-2008, 08:54 PM

Originally posted by Zorgman

Hi Guys,

While I do not like the fact that teksonline has to resort to blackmail to tell someone that their is a problem, I thank him for pointing out a major problem that I didn't even know about.

Over 5 weeks ago I had a few programmers check the source code of TEVS for any errors I made. They came back with a few fixed and I put those fixes into place. I rezipped TEVS and uploaded it to the server. But it was my mistake I had uploaded it to the wrong directory. So up till now everyone has downloaded the old original files. - My Fault. I am sorry about that.

I believe a few installs that I did got the secure files but please contact me anyway with the below details.

If you have TEVS installed, please contact me right away and I will personally fix this for you.

Email: [email protected]

BTW - MrYellow, trying to force your services and script project on me and webmasters using TEVS is in way helping me or these webmasters. As I have pointed out, you took offense when I declined your offer and now you call me names like {wanked} and {tosser}. For what reason?

I think everyone here at GFY is totally cool with ya....theres always gonna be a few script kiddies with mental issues. Just shake it off & continue selling your product bro

**Nookster** · 03-03-2008, 09:35 PM

So wait...he didn't know about battling against simple sql injection??? That's unbelievable.

**Nookster** · 03-03-2008, 09:54 PM

Originally posted by Nookster

So wait...he didn't know about battling against simple sql injection??? That's unbelievable.

Please say it 'aint so mang.

**Zorgman** · 03-04-2008, 07:10 AM

Originally posted by pr0

I think everyone here at GFY is totally cool with ya....theres always gonna be a few script kiddies with mental issues. Just shake it off & continue selling your product bro

Thanks pr0. I've updated about 200 sites today with the fixes and there is still about 220 to do. But we're get there. Another issue is, because the front end is raw code webmasters have changed their code so much that those fixes are no longer required. However 1 of them is a must and they have all done this themselves. Other webmasters who haven't changed the code at all really need to get this updated.

**mrkris** · 03-04-2008, 02:14 PM

As a developer, it saddens me to see people using the raw mysql* calls from PHP when you can use an abstraction layer that makes it DIFFICULT to allow SQL injection.

**farkedup** · 03-04-2008, 02:29 PM

You mean like whats packaged in PEAR? the problem is on scripts like this you're stuck using some pretty basic things at times.

I think its kind of pushing things to ask people for extras like FFMPEG but if you want the really cool features you really do need some extras.

**quantum-x** · 03-04-2008, 03:00 PM

Originally posted by farkedup

have you rewritten 100% or just most?

here is a basic security function: http://entertainmentscript.com/sec.phps is 1 thing and running mysql_real_escape_string on EVERY user submitted $_POST or $_GET or $_REQUEST variable BEFORE inserting it into the DB will go a LONG ways.

This at the bottom of something like a config file will reject forms submitted from other places.

Code:

if (isset($_POST)){
$ip2 = (empty($_SERVER['REMOTE_ADDR'])) ? 'empty' : $_SERVER['REMOTE_ADDR'];
$ua = (empty($_SERVER['HTTP_USER_AGENT'])) ? 'empty' : $_SERVER['HTTP_USER_AGENT'];
$ru = (empty($_SERVER['REQUEST_URI'])) ? 'empty' : $_SERVER['REQUEST_URI'];
$rm = (empty($_SERVER['REQUEST_METHOD'])) ? 'empty' : $_SERVER['REQUEST_METHOD'];
if ($ua == "empty") { exit();}   
if ($ua == "-") 	{ exit();}
if ($ip2 == "empty"){ exit();} 
if ($ru == "empty") {exit();}   
if ($rm == "empty") { exit();}   
}

Holy shit, that's worse than wordpress code.
I'm scared by the coding 'proficency' of people here.
Zorg: unless you're sanitising those strings further up, that's a nasty hole. And even if you are, not escaping is scary.

**Eric** · 03-04-2008, 03:16 PM

If you wanted to be banned alll you had to do was ask. Good Bye

**ThumbLord** · 03-04-2008, 03:18 PM

Eric at the Helm again, go baby go

**Zorgman** · 03-04-2008, 05:12 PM

teksonline
So Fucking Banned

Leason to everyone. Do NOT blackmail anyone in public.

Thanks Eric.

**sortie** · 03-05-2008, 09:19 AM

More expedient tools are in development :

**WarChild** · 03-05-2008, 09:23 AM

TEVS ... I guess it's kind of a cute little script.

**lazycash** · 03-05-2008, 09:45 AM

I hope if anything good comes out of this thread is that Zorg works on securing TEVS. I just bought the script and am clueless on coding, but don't exactly feel comfortable installing the script based on some of the accusations in this script.

**Gonzozilla** · 03-05-2008, 11:32 AM

Originally posted by teksonline

Want the truth?

I really dont give to shits anymore about anyone on or in this industry, i have 12 years of business relationships and only thing I have learned, is oyur all skillless, you're all thieves, and you would all ass rape your own mothers if given the chance

Looks like you don't know the difference between "to" "too" & "two".

You don't "give two shits".

**dozey** · 03-05-2008, 02:31 PM

Originally posted by sortie

For every charlatan who had a smart word in this thread; just wait until you're spewing forth the same contempt as some script kiddie sodomises your cookie cutter tube site.

I guess when mr. exit said "php combined with mysql is known for this," what he probably meant was "php / mysql developers are known to develop abhorrent code like this." Which is absolutely true.

Make no mistake, there are time-honoured patterns and practises to avoid this exact situation. They exist for a reason. Does TEVS adhere to any of them? I sincerely doubt it. (no, inline mysql_real_whatever doesn't count)

That said, TEVS might well be the best commercial script out there. That's just the way most of these scripts are.

But by all means, persist with the usual webmaster antics, semantics and disputes. The objective truth of the matter will be waiting to shaft you and your pride though.

**dozey** · 03-05-2008, 02:46 PM

Originally posted by farkedup

Code:

if (isset($_POST)){
$ip2 = (empty($_SERVER['REMOTE_ADDR'])) ? 'empty' : $_SERVER['REMOTE_ADDR'];
$ua = (empty($_SERVER['HTTP_USER_AGENT'])) ? 'empty' : $_SERVER['HTTP_USER_AGENT'];
$ru = (empty($_SERVER['REQUEST_URI'])) ? 'empty' : $_SERVER['REQUEST_URI'];
$rm = (empty($_SERVER['REQUEST_METHOD'])) ? 'empty' : $_SERVER['REQUEST_METHOD'];
if ($ua == "empty") { exit();}   
if ($ua == "-") 	{ exit();}
if ($ip2 == "empty"){ exit();} 
if ($ru == "empty") {exit();}   
if ($rm == "empty") { exit();}   
}

Concise version follows

Code:

die("Incompetent");

**sortie** · 03-05-2008, 03:15 PM

Originally posted by dozey

For every charlatan who had a smart word in this thread; just wait until you're spewing forth the same contempt as some script kiddie sodomises your cookie cutter tube site.

I guess when mr. exit said "php combined with mysql is known for this," what he probably meant was "php / mysql developers are known to develop abhorrent code like this." Which is absolutely true.

Make no mistake, there are time-honoured patterns and practises to avoid this exact situation. They exist for a reason. Does TEVS adhere to any of them? I sincerely doubt it. (no, inline mysql_real_whatever doesn't count)

That said, TEVS might well be the best commercial script out there. That's just the way most of these scripts are.

But by all means, persist with the usual webmaster antics, semantics and disputes. The objective truth of the matter will be waiting to shaft you and your pride though.

Whatever dude.

You need to develope a sense of humor or either you don't read worth a shit.

And by the fucking way I'm that one who made the php/sql comment.

The fact is that if someone programs in php it's because the can't fucking learn PERL or C.

Php is basically a cgi script written in C to make things easier to program.
It's only "needed" by idiots.

And a load of idiots don't even know that php runs as cgi and claim php
will replace cgi.

Here read this : http://en.wikipedia.org/wiki/Php

Originally posted by Wiki

PHP was written as a set of Common Gateway Interface (CGI) binaries in the C programming language by the Danish/Greenlandic programmer Rasmus Lerdorf in 1994

**dozey** · 03-05-2008, 03:34 PM

I know you made the comment, sortie = French for exit. I didn't catch your humor, no. Can't help but look at these issues in dismay.

I'm won't risk affirming anything you said in detail, just incase I miss more humor

Suffice to say it is all true and causes ongoing problems.

Fun With Tevs - Not Good If You Are Running Tevs

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment