GoFuckYourself.com - Adult Webmaster Forum - Fun With Tevs

Page 2 of 4

Show 40 post(s) from this thread on one page

GoFuckYourself.com - Adult Webmaster Forum (https://gfy.com/index.php)

- Fucking Around & Business Discussion (https://gfy.com/forumdisplay.php?f=26)

- - Fun With Tevs - Not Good If You Are Running Tevs (https://gfy.com/showthread.php?t=812300)

Damian_Maxcash

03-03-2008 05:20 PM

Quote:

Originally Posted by teksonline (Post 13864052)

I aint here to be liked, im here to pass along the 12 years of fucking hell and displeasure of working for you all.. so please dont ass kiss me you'll only get brown lips and no sugar

aint fucking talking about ip connections, i meant that anyone can fucking post to the database

No brown nosing here - just think back to the number of times you have seen me do this. I ALWAYS regret it.

Angry Jew Cat - Banned for Life

03-03-2008 05:21 PM

So teks, have you ever looked over vShare? If so, what's your technical opinion on that one as a tube script?

teksonline

03-03-2008 05:21 PM

Quote:

Originally Posted by Damian_Maxcash (Post 13864101)

No brown nosing here - just think back to the number of times you have seen me do this. I ALWAYS regret it.

Dont relate bitterness to coffin nails... I want to make sure I can't come back.... Trust me its what I want and I know it... sometimes its hard to leave... othertimes its a blessing, i will make my exit a blessign

sortie

03-03-2008 05:24 PM

Quote:

Originally Posted by teksonline (Post 13864093)

I've already fixed my scripts, i've actually 100% rewritten most of this script as most of it dont even work as it appears.

If you knew anything about anything you coder, you'd fucking know that
a simple form bot can and probably has already infected every tevs installation otu there, you should all be fucking thanking me

Well, if you fixed them already then what is all this ranting about?

Nobody should be thanking you for anything because you haven't fixed
anything for them or even explained what happened to cause you to
find a problem.

candyflip

03-03-2008 05:39 PM

Quote:

Originally Posted by Fungus (Post 13864040)

Ya know I was really not liking you till this post lol you hit the nail right on the head about sortie! :pimp

:1orglaugh:1orglaugh

mryellow

03-03-2008 05:40 PM

I did try to offer help to Zorgman in this area as well....

He doesn't quite get it.

-Ben

candyflip

03-03-2008 05:44 PM

Quote:

Originally Posted by teksonline (Post 13864093)

Does that me you managed unencoded the backend files?

teksonline

03-03-2008 05:44 PM

Quote:

Originally Posted by sortie (Post 13864137)

stfu fatty

teksonline

03-03-2008 05:45 PM

Quote:

Originally Posted by candyflip (Post 13864240)

Does that me you managed unencoded the backend files?

no it means i wrote my own fucking admin, how do you like those apples?

teksonline

03-03-2008 05:48 PM

why am i fighting with a bunch of trolls.. lol

im gone, i wont be back... have fun playing games with other trolls...

ughm... i laugh at the next moron to pay $10k to skin this board.. lol, worse then shoveling it into a fireplace hahah

candyflip

03-03-2008 05:49 PM

Quote:

Originally Posted by teksonline (Post 13864249)

no it means i wrote my own fucking admin, how do you like those apples?

So why exactly did you purchase multiple copies if it's garbage and you could do it yourself?

I know why I bought it. I can't code and wanted to test the waters before having something custom coded.

I have no doubt that Dean and company will square this up when he gets back online.

Iron Fist

03-03-2008 05:54 PM

Quote:

Originally Posted by Dennis Rodman (Post 13863721)

http://farm3.static.flickr.com/2114/...d6ecff43e4.jpg

Nicely played sir..

http://www.nnteenmodels.net/gfy/clapping.gif

sortie

03-03-2008 06:00 PM

Quote:

Originally Posted by teksonline (Post 13864267)

You are arguing with youself fatso. :1orglaugh

Everyone except the Rodman dick with the fake nick was on your side until
you starting blowing shit out of your mouth on everybody.

Socks

03-03-2008 06:07 PM

Drink much lately?

http://www.cherryflava.com/photos/un...ka_compare.jpg

gleem

03-03-2008 06:12 PM

thread of the year

farkedup

03-03-2008 06:43 PM

Quote:

Originally Posted by teksonline (Post 13864093)

I've already fixed my scripts, i've actually 100% rewritten most of this script as most of it dont even work as it appears.

have you rewritten 100% or just most?

here is a basic security function: http://entertainmentscript.com/sec.phps is 1 thing and running mysql_real_escape_string on EVERY user submitted $_POST or $_GET or $_REQUEST variable BEFORE inserting it into the DB will go a LONG ways.

This at the bottom of something like a config file will reject forms submitted from other places.

Code:

if (isset($_POST)){

$ip2 = (empty($_SERVER['REMOTE_ADDR'])) ? 'empty' : $_SERVER['REMOTE_ADDR'];

$ua = (empty($_SERVER['HTTP_USER_AGENT'])) ? 'empty' : $_SERVER['HTTP_USER_AGENT'];

$ru = (empty($_SERVER['REQUEST_URI'])) ? 'empty' : $_SERVER['REQUEST_URI'];

$rm = (empty($_SERVER['REQUEST_METHOD'])) ? 'empty' : $_SERVER['REQUEST_METHOD'];

if ($ua == "empty") { exit();}   

if ($ua == "-")         { exit();}

if ($ip2 == "empty"){ exit();} 

if ($ru == "empty") {exit();}   

if ($rm == "empty") { exit();}   

}

GrouchyAdmin

03-03-2008 06:48 PM

Some people should be shot for abusing ternaries.

crockett

03-03-2008 07:00 PM

Quote:

Originally Posted by teksonline (Post 13863945)

lets get soemthing straight, i own multiple licenses of this script.
and I am outraged at some of this fucking code i see here..
It's beyond fucking ridiculous in todays age to see such fucking crap
in todays coding world... and quite frankly this script is a $29 script
someone could write in 2 fucking days correctly...

so fuck off and die already I dont give a shit, once again
a nameless wonder on attack...

so why would you buy several copies of the scipt then check the code afterwards?

farkedup

03-03-2008 07:09 PM

the entire problem is security, the code other than that is fine.

situations like this:

Code:

@mysql_query("INSERT INTO tube_comments SET cmessage='$acomments', cvid='$vid', cyourname='$yourname', capproved='N', cdate=NOW()");

simply have: $yourname = $_POST['yourname'];

what HAS to be done is before you EVER insert anything into the DB you need to run something like this:

$number = mysql_real_escape_string($_POST['txtNumber']);

Also if you want a quick protection from form bots simply paste that code I posted into config.php

As you can imagine the fix is very simple BUT it happens in so many places that it will take a bit of time for a real fix to be posted.

Zorgman if you want any help let me know. I can certainly think of a few things I'd do to secure this thing and a few things that could REALLY improve the speed of this script.

halfpint

03-03-2008 07:23 PM

hello farkedup you have been a busy man of late havent talked to you in a while. If you aint busy later I will hit you up on ICQ

dig420

03-03-2008 07:26 PM

I'm getting ready to buy this script, farkedup or one of you other eggheads want to handle the install and the security fix?

farkedup

03-03-2008 07:33 PM

Quote:

Originally Posted by halfpint (Post 13864785)

hello farkedup you have been a busy man of late havent talked to you in a while. If you aint busy later I will hit you up on ICQ

I'm working on moving a bunch of my editable pages and templates into the DB and coding a caching system and then I have to code a tool to allow users to submit embed codes... THEN after all of that is done I'm going to recode some sections of my script so if you can think of anything that needs an overhaul please give me some suggestions! I think making these things easier to edit will help out a LOT of people.

candyflip

03-03-2008 07:38 PM

Quote:

Originally Posted by dig420 (Post 13864797)

I'm getting ready to buy this script, farkedup or one of you other eggheads want to handle the install and the security fix?

I just spoke with Dean and this is something that has been fixed. The problem was that some people didn't get the updated files. Simple as that.

halfpint

03-03-2008 07:42 PM

Quote:

Originally Posted by farkedup (Post 13864824)

Yep ok I will speak to you a bit later on ICQ

Va2k	03-03-2008 07:43 PM

Quote:

Originally Posted by candyflip (Post 13864841)

I just spoke with Dean and this is something that has been fixed. The problem was that some people didn't get the updated files. Simple as that.

Yea same here.. Dean is a ok top dawg im my book! :pimp

Zorgman

03-03-2008 07:59 PM

Hi Guys,

While I do not like the fact that teksonline has to resort to blackmail to tell someone that their is a problem, I thank him for pointing out a major problem that I didn't even know about.

Over 5 weeks ago I had a few programmers check the source code of TEVS for any errors I made. They came back with a few fixed and I put those fixes into place. I rezipped TEVS and uploaded it to the server. But it was my mistake I had uploaded it to the wrong directory. So up till now everyone has downloaded the old original files. - My Fault. I am sorry about that.

I believe a few installs that I did got the secure files but please contact me anyway with the below details.

If you have TEVS installed, please contact me right away and I will personally fix this for you.

Email: [email protected]

BTW - MrYellow, trying to force your services and script project on me and webmasters using TEVS is in way helping me or these webmasters. As I have pointed out, you took offense when I declined your offer and now you call me names like {wanked} and {tosser}. For what reason?

Zorgman

03-03-2008 08:06 PM

teksonline, I would also like to add. That since you had 100% re-written the admin controls which work fine on over 400 licenses so far. I can only asume you are using a stolen copy of TEVS.

I'v got no emails or support tickets from you nor icq or other forms of messages.

Any normal members would have asked questions before trying to blackmail someone. Unless their using stolen code.

Prove me wrong!

shermo

03-03-2008 08:07 PM

Quote:

Originally Posted by Zorgman (Post 13864924)

Thanks Dean! I just dropped you a line. :thumbsup

KrisKross

03-03-2008 08:15 PM

Quote:

Originally Posted by sortie (Post 13863703)

Not good.

php combined with mysql is known for this.

Riiiight. And CGI is bulletproof, right?

Just Alex

03-03-2008 08:26 PM

post it now, dude.

bashbug

03-03-2008 08:31 PM

Damn this guy is a real psychopath

marketsmart

03-03-2008 08:44 PM

ok wait.. i got lost here.. how was anyone blackmailed? was there money involved? if so, thats a criminal offense... if not moneym then what?

not trying to be a dick here, i just dont see blackmail here when someone just pointed out security leaks in an app.

hlowever, thiss should have been discussed in private rather then here...

KrisKross

03-03-2008 08:47 PM

Quote:

Originally Posted by marketsmart (Post 13865065)

Blackmail is the threat to reveal something damaging unless a demand is met.

NOTR	03-03-2008 08:51 PM

k0nr4d Didn't I hire you years ago?

sortie

03-03-2008 09:16 PM

Quote:

Originally Posted by KrisKross (Post 13864973)

Riiiight. And CGI is bulletproof, right?

Well, I'd say that it's impossible to inject something into a
mysql database that doesn't even exist.

But maybe you know something I dont know.

You did read what the stated problem was didn't you?

And for your information many servers, if not most, are now running php as cgi.

http://us3.php.net/security.cgi-bin

Read that. Please fucking read it!!!! :mad::mad::mad:

The notion that running php means never running cgi is the biggest lie ever sold!

KrisKross

03-03-2008 09:31 PM

Are you retarded?

Quote:

Originally Posted by sortie (Post 13865170)

QuaWee

03-03-2008 09:36 PM

Quote:

Originally Posted by marketsmart (Post 13865065)

Are you tarded?

marketsmart

03-03-2008 09:38 PM

Quote:

Originally Posted by QuaWee (Post 13865229)

Are you tarded?

maybe....

Nookster

03-03-2008 09:40 PM

You fuckin serious mang? You mean a simple:

Quote:

$var = mysql_real_escape_string($var);

would fix the sploit? LOL Man, I thought it would be better coded for sure. Sad to hear.

MattO

03-03-2008 09:56 PM

I'm glad I program in ColdFusion, bless you CFQueryParam.

All times are GMT -7. The time now is 07:50 AM.

Page 2 of 4

Show 40 post(s) from this thread on one page