GoFuckYourself.com - Adult Webmaster Forum - Fun With Tevs

Page 2 of 3

Show 40 post(s) from this thread on one page

GoFuckYourself.com - Adult Webmaster Forum (https://gfy.com/index.php)

- Fucking Around & Business Discussion (https://gfy.com/forumdisplay.php?f=26)

- - Fun With Tevs - Not Good If You Are Running Tevs (https://gfy.com/showthread.php?t=812300)

candyflip

03-03-2008 05:49 PM

Quote:

Originally Posted by teksonline (Post 13864249)

no it means i wrote my own fucking admin, how do you like those apples?

So why exactly did you purchase multiple copies if it's garbage and you could do it yourself?

I know why I bought it. I can't code and wanted to test the waters before having something custom coded.

I have no doubt that Dean and company will square this up when he gets back online.

Iron Fist

03-03-2008 05:54 PM

Quote:

Originally Posted by Dennis Rodman (Post 13863721)

http://farm3.static.flickr.com/2114/...d6ecff43e4.jpg

Nicely played sir..

http://www.nnteenmodels.net/gfy/clapping.gif

sortie

03-03-2008 06:00 PM

Quote:

Originally Posted by teksonline (Post 13864267)

why am i fighting with a bunch of trolls.. lol

im gone, i wont be back... have fun playing games with other trolls...

ughm... i laugh at the next moron to pay $10k to skin this board.. lol, worse then shoveling it into a fireplace hahah

You are arguing with youself fatso. :1orglaugh

Everyone except the Rodman dick with the fake nick was on your side until
you starting blowing shit out of your mouth on everybody.

Socks

03-03-2008 06:07 PM

Drink much lately?

http://www.cherryflava.com/photos/un...ka_compare.jpg

gleem

03-03-2008 06:12 PM

thread of the year

farkedup

03-03-2008 06:43 PM

Quote:

Originally Posted by teksonline (Post 13864093)

I've already fixed my scripts, i've actually 100% rewritten most of this script as most of it dont even work as it appears.

have you rewritten 100% or just most?

here is a basic security function: http://entertainmentscript.com/sec.phps is 1 thing and running mysql_real_escape_string on EVERY user submitted $_POST or $_GET or $_REQUEST variable BEFORE inserting it into the DB will go a LONG ways.

This at the bottom of something like a config file will reject forms submitted from other places.

Code:

if (isset($_POST)){

$ip2 = (empty($_SERVER['REMOTE_ADDR'])) ? 'empty' : $_SERVER['REMOTE_ADDR'];

$ua = (empty($_SERVER['HTTP_USER_AGENT'])) ? 'empty' : $_SERVER['HTTP_USER_AGENT'];

$ru = (empty($_SERVER['REQUEST_URI'])) ? 'empty' : $_SERVER['REQUEST_URI'];

$rm = (empty($_SERVER['REQUEST_METHOD'])) ? 'empty' : $_SERVER['REQUEST_METHOD'];

if ($ua == "empty") { exit();}   

if ($ua == "-")         { exit();}

if ($ip2 == "empty"){ exit();} 

if ($ru == "empty") {exit();}   

if ($rm == "empty") { exit();}   

}

GrouchyAdmin

03-03-2008 06:48 PM

Some people should be shot for abusing ternaries.

crockett

03-03-2008 07:00 PM

Quote:

Originally Posted by teksonline (Post 13863945)

lets get soemthing straight, i own multiple licenses of this script.
and I am outraged at some of this fucking code i see here..
It's beyond fucking ridiculous in todays age to see such fucking crap
in todays coding world... and quite frankly this script is a $29 script
someone could write in 2 fucking days correctly...

so fuck off and die already I dont give a shit, once again
a nameless wonder on attack...

so why would you buy several copies of the scipt then check the code afterwards?

farkedup

03-03-2008 07:09 PM

the entire problem is security, the code other than that is fine.

situations like this:

Code:

@mysql_query("INSERT INTO tube_comments SET cmessage='$acomments', cvid='$vid', cyourname='$yourname', capproved='N', cdate=NOW()");

simply have: $yourname = $_POST['yourname'];

what HAS to be done is before you EVER insert anything into the DB you need to run something like this:

$number = mysql_real_escape_string($_POST['txtNumber']);

Also if you want a quick protection from form bots simply paste that code I posted into config.php

As you can imagine the fix is very simple BUT it happens in so many places that it will take a bit of time for a real fix to be posted.

Zorgman if you want any help let me know. I can certainly think of a few things I'd do to secure this thing and a few things that could REALLY improve the speed of this script.

halfpint

03-03-2008 07:23 PM

hello farkedup you have been a busy man of late havent talked to you in a while. If you aint busy later I will hit you up on ICQ

dig420

03-03-2008 07:26 PM

I'm getting ready to buy this script, farkedup or one of you other eggheads want to handle the install and the security fix?

farkedup

03-03-2008 07:33 PM

Quote:

Originally Posted by halfpint (Post 13864785)

hello farkedup you have been a busy man of late havent talked to you in a while. If you aint busy later I will hit you up on ICQ

I'm working on moving a bunch of my editable pages and templates into the DB and coding a caching system and then I have to code a tool to allow users to submit embed codes... THEN after all of that is done I'm going to recode some sections of my script so if you can think of anything that needs an overhaul please give me some suggestions! I think making these things easier to edit will help out a LOT of people.

candyflip

03-03-2008 07:38 PM

Quote:

Originally Posted by dig420 (Post 13864797)

I'm getting ready to buy this script, farkedup or one of you other eggheads want to handle the install and the security fix?

I just spoke with Dean and this is something that has been fixed. The problem was that some people didn't get the updated files. Simple as that.

halfpint

03-03-2008 07:42 PM

Quote:

Originally Posted by farkedup (Post 13864824)

Yep ok I will speak to you a bit later on ICQ

Va2k	03-03-2008 07:43 PM

Quote:

Originally Posted by candyflip (Post 13864841)

I just spoke with Dean and this is something that has been fixed. The problem was that some people didn't get the updated files. Simple as that.

Yea same here.. Dean is a ok top dawg im my book! :pimp

Zorgman

03-03-2008 07:59 PM

Hi Guys,

While I do not like the fact that teksonline has to resort to blackmail to tell someone that their is a problem, I thank him for pointing out a major problem that I didn't even know about.

Over 5 weeks ago I had a few programmers check the source code of TEVS for any errors I made. They came back with a few fixed and I put those fixes into place. I rezipped TEVS and uploaded it to the server. But it was my mistake I had uploaded it to the wrong directory. So up till now everyone has downloaded the old original files. - My Fault. I am sorry about that.

I believe a few installs that I did got the secure files but please contact me anyway with the below details.

If you have TEVS installed, please contact me right away and I will personally fix this for you.

Email: [email protected]

BTW - MrYellow, trying to force your services and script project on me and webmasters using TEVS is in way helping me or these webmasters. As I have pointed out, you took offense when I declined your offer and now you call me names like {wanked} and {tosser}. For what reason?

Zorgman

03-03-2008 08:06 PM

teksonline, I would also like to add. That since you had 100% re-written the admin controls which work fine on over 400 licenses so far. I can only asume you are using a stolen copy of TEVS.

I'v got no emails or support tickets from you nor icq or other forms of messages.

Any normal members would have asked questions before trying to blackmail someone. Unless their using stolen code.

Prove me wrong!

shermo

03-03-2008 08:07 PM

Quote:

Originally Posted by Zorgman (Post 13864924)

Thanks Dean! I just dropped you a line. :thumbsup

KrisKross

03-03-2008 08:15 PM

Quote:

Originally Posted by sortie (Post 13863703)

Not good.

php combined with mysql is known for this.

Riiiight. And CGI is bulletproof, right?

Just Alex

03-03-2008 08:26 PM

post it now, dude.

bashbug

03-03-2008 08:31 PM

Damn this guy is a real psychopath

marketsmart

03-03-2008 08:44 PM

ok wait.. i got lost here.. how was anyone blackmailed? was there money involved? if so, thats a criminal offense... if not moneym then what?

not trying to be a dick here, i just dont see blackmail here when someone just pointed out security leaks in an app.

hlowever, thiss should have been discussed in private rather then here...

KrisKross

03-03-2008 08:47 PM

Quote:

Originally Posted by marketsmart (Post 13865065)

Blackmail is the threat to reveal something damaging unless a demand is met.

NOTR	03-03-2008 08:51 PM

k0nr4d Didn't I hire you years ago?

sortie

03-03-2008 09:16 PM

Quote:

Originally Posted by KrisKross (Post 13864973)

Riiiight. And CGI is bulletproof, right?

Well, I'd say that it's impossible to inject something into a
mysql database that doesn't even exist.

But maybe you know something I dont know.

You did read what the stated problem was didn't you?

And for your information many servers, if not most, are now running php as cgi.

http://us3.php.net/security.cgi-bin

Read that. Please fucking read it!!!! :mad::mad::mad:

The notion that running php means never running cgi is the biggest lie ever sold!

KrisKross

03-03-2008 09:31 PM

Are you retarded?

Quote:

Originally Posted by sortie (Post 13865170)

QuaWee

03-03-2008 09:36 PM

Quote:

Originally Posted by marketsmart (Post 13865065)

Are you tarded?

marketsmart

03-03-2008 09:38 PM

Quote:

Originally Posted by QuaWee (Post 13865229)

Are you tarded?

maybe....

Nookster

03-03-2008 09:40 PM

You fuckin serious mang? You mean a simple:

Quote:

$var = mysql_real_escape_string($var);

would fix the sploit? LOL Man, I thought it would be better coded for sure. Sad to hear.

MattO

03-03-2008 09:56 PM

I'm glad I program in ColdFusion, bless you CFQueryParam.

sortie

03-03-2008 09:56 PM

Quote:

Originally Posted by KrisKross (Post 13865211)

Are you retarded?

No, but you are because you can't read.

Here, read.... http://us3.php.net/security.cgi-bin

Your php is most likely running as cgi on the server yet you claim that
php is somehow better than cgi. :1orglaugh:1orglaugh:1orglaugh

KrisKross

03-03-2008 10:02 PM

Quote:

Originally Posted by sortie (Post 13865301)

I made no such claims, tardo.

pr0	03-03-2008 10:54 PM

Quote:

Originally Posted by Zorgman (Post 13864924)

I think everyone here at GFY is totally cool with ya....theres always gonna be a few script kiddies with mental issues. Just shake it off & continue selling your product bro :thumbsup

Nookster

03-03-2008 11:35 PM

So wait...he didn't know about battling against simple sql injection??? That's unbelievable.

Nookster

03-03-2008 11:54 PM

Quote:

Originally Posted by Nookster (Post 13865716)

So wait...he didn't know about battling against simple sql injection??? That's unbelievable.

Please say it 'aint so mang. :(

Zorgman

03-04-2008 09:10 AM

Quote:

Originally Posted by pr0 (Post 13865553)

I think everyone here at GFY is totally cool with ya....theres always gonna be a few script kiddies with mental issues. Just shake it off & continue selling your product bro :thumbsup

Thanks pr0. I've updated about 200 sites today with the fixes and there is still about 220 to do. But we're get there. Another issue is, because the front end is raw code webmasters have changed their code so much that those fixes are no longer required. However 1 of them is a must and they have all done this themselves. Other webmasters who haven't changed the code at all really need to get this updated.

mrkris

03-04-2008 04:14 PM

As a developer, it saddens me to see people using the raw mysql* calls from PHP when you can use an abstraction layer that makes it DIFFICULT to allow SQL injection.

:2 cents:

farkedup

03-04-2008 04:29 PM

You mean like whats packaged in PEAR? the problem is on scripts like this you're stuck using some pretty basic things at times.

I think its kind of pushing things to ask people for extras like FFMPEG but if you want the really cool features you really do need some extras.

quantum-x

03-04-2008 05:00 PM

Quote:

Originally Posted by farkedup (Post 13864609)

Code:

if (isset($_POST)){

$ip2 = (empty($_SERVER['REMOTE_ADDR'])) ? 'empty' : $_SERVER['REMOTE_ADDR'];

$ua = (empty($_SERVER['HTTP_USER_AGENT'])) ? 'empty' : $_SERVER['HTTP_USER_AGENT'];

$ru = (empty($_SERVER['REQUEST_URI'])) ? 'empty' : $_SERVER['REQUEST_URI'];

$rm = (empty($_SERVER['REQUEST_METHOD'])) ? 'empty' : $_SERVER['REQUEST_METHOD'];

if ($ua == "empty") { exit();}   

if ($ua == "-")         { exit();}

if ($ip2 == "empty"){ exit();} 

if ($ru == "empty") {exit();}   

if ($rm == "empty") { exit();}   

}

Holy shit, that's worse than wordpress code.
I'm scared by the coding 'proficency' of people here.
Zorg: unless you're sanitising those strings further up, that's a nasty hole. And even if you are, not escaping is scary.

Eric	03-04-2008 05:16 PM

If you wanted to be banned alll you had to do was ask. Good Bye

ThumbLord

03-04-2008 05:18 PM

Eric at the Helm again, go baby go

Zorgman

03-04-2008 07:12 PM

teksonline
So Fucking Banned

Leason to everyone. Do NOT blackmail anyone in public.

Thanks Eric.

sortie

03-05-2008 11:19 AM

http://blackmonsters.com/backfire.jpg

More expedient tools are in development :

http://blackmonsters.com/GunBackfire.gif

WarChild

03-05-2008 11:23 AM

TEVS ... I guess it's kind of a cute little script. :1orglaugh:1orglaugh:1orglaugh

lazycash

03-05-2008 11:45 AM

I hope if anything good comes out of this thread is that Zorg works on securing TEVS. I just bought the script and am clueless on coding, but don't exactly feel comfortable installing the script based on some of the accusations in this script.

Gonzozilla

03-05-2008 01:32 PM

Quote:

Originally Posted by teksonline (Post 13863783)

Want the truth?

I really dont give to shits anymore about anyone on or in this industry, i have 12 years of business relationships and only thing I have learned, is oyur all skillless, you're all thieves, and you would all ass rape your own mothers if given the chance

Looks like you don't know the difference between "to" "too" & "two".

You don't "give two shits". :thumbsup

dozey

03-05-2008 04:31 PM

Quote:

Originally Posted by sortie (Post 13874276)

http://blackmonsters.com/backfire.jpg

For every charlatan who had a smart word in this thread; just wait until you're spewing forth the same contempt as some script kiddie sodomises your cookie cutter tube site.

I guess when mr. exit said "php combined with mysql is known for this," what he probably meant was "php / mysql developers are known to develop abhorrent code like this." Which is absolutely true.

Make no mistake, there are time-honoured patterns and practises to avoid this exact situation. They exist for a reason. Does TEVS adhere to any of them? I sincerely doubt it. (no, inline mysql_real_whatever doesn't count)

That said, TEVS might well be the best commercial script out there. That's just the way most of these scripts are.

But by all means, persist with the usual webmaster antics, semantics and disputes. The objective truth of the matter will be waiting to shaft you and your pride though.

:2 cents:

dozey

03-05-2008 04:46 PM

Quote:

Originally Posted by farkedup (Post 13864609)

Code:

if (isset($_POST)){

$ip2 = (empty($_SERVER['REMOTE_ADDR'])) ? 'empty' : $_SERVER['REMOTE_ADDR'];

$ua = (empty($_SERVER['HTTP_USER_AGENT'])) ? 'empty' : $_SERVER['HTTP_USER_AGENT'];

$ru = (empty($_SERVER['REQUEST_URI'])) ? 'empty' : $_SERVER['REQUEST_URI'];

$rm = (empty($_SERVER['REQUEST_METHOD'])) ? 'empty' : $_SERVER['REQUEST_METHOD'];

if ($ua == "empty") { exit();}   

if ($ua == "-")         { exit();}

if ($ip2 == "empty"){ exit();} 

if ($ru == "empty") {exit();}   

if ($rm == "empty") { exit();}   

}

Concise version follows

Code:

die("Incompetent");

sortie

03-05-2008 05:15 PM

Quote:

Originally Posted by dozey (Post 13876481)

Whatever dude.

You need to develope a sense of humor or either you don't read worth a shit.

And by the fucking way I'm that one who made the php/sql comment.

The fact is that if someone programs in php it's because the can't fucking learn PERL or C.

Php is basically a cgi script written in C to make things easier to program.
It's only "needed" by idiots.

And a load of idiots don't even know that php runs as cgi and claim php
will replace cgi. :1orglaugh:1orglaugh:1orglaugh:1orglaugh

Here read this : http://en.wikipedia.org/wiki/Php

Quote:

Originally Posted by Wiki

PHP was written as a set of Common Gateway Interface (CGI) binaries in the C programming language by the Danish/Greenlandic programmer Rasmus Lerdorf in 1994

dozey

03-05-2008 05:34 PM

I know you made the comment, sortie = French for exit. I didn't catch your humor, no. Can't help but look at these issues in dismay.

I'm won't risk affirming anything you said in detail, just incase I miss more humor :)
Suffice to say it is all true and causes ongoing problems.

All times are GMT -7. The time now is 02:36 AM.

Page 2 of 3

Show 40 post(s) from this thread on one page