Advanced search  

News:

CPG Release 1.6.26
Correct PHP8.2 issues with user and language managers.
Additional fixes for PHP 8.2
Correct PHP8 error with SMF 2.0 bridge.
Correct IPTC supplimental category parsing.
Download and info HERE

Pages: [1]   Go Down

Author Topic: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*  (Read 125265 times)

0 Members and 1 Guest are viewing this topic.

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« on: September 25, 2005, 12:49:37 pm »

A XSS vulnerability has been found in the language selector. Everybody who runs coppermine (any version older than cpg1.3.5) will have to apply this security fix as soon as possible.

We have released a brand new package of the stable branch (cpg1.3.x) named "cpg1.3.5" that contains the above mentioned fix, plus some fixes of minor issues:
Download cpg1.3.5.
The vulnerability existed in the devel code (cpg1.4.x) as well, that's why users who are testing the devel version are strongly encouraged to update their version as well (doing a CVS checkout).



Experienced users who don't want to do the upgrade (because their coppermine install is heavily modified) can apply the fix manually as well (instead of doing the recommended upgrade to cpg1.3.5).

Instructions for manual fix:
In init.inc.php:

Replace
Code: [Select]
$HTML_SUBST = array('"' => '&quot;', '<' => '&lt;', '>' => '&gt;');

with
Code: [Select]
$HTML_SUBST = array('&' => '&amp;', '"' => '&quot;', '<' => '&lt;', '>' => '&gt;', '%26' => '&amp;', '%22' => '&quot;', '%3C' => '&lt;', '%3E' => '&gt;');

Replace
Code: [Select]
if (is_array($HTTP_GET_VARS)) {
        foreach ($HTTP_GET_VARS as $key => $value) {
            $HTTP_GET_VARS[$key] = strtr(stripslashes($value), $HTML_SUBST);
            if (isset($$key)) unset($$key);
        }
    }

with
Code: [Select]
if (is_array($HTTP_GET_VARS)) {
        foreach ($HTTP_GET_VARS as $key => $value) {
            unset($HTTP_GET_VARS[$key]);
            $HTTP_GET_VARS[strtr(stripslashes($key), $HTML_SUBST)] = strtr(stripslashes($value), $HTML_SUBST);
            if (isset($$key)) unset($$key);
        }
    }

Add
Code: [Select]
/**
     * Sanitize $_GET also, as we have used it in many places
     */
    if (is_array($_GET)) {
        foreach ($_GET as $key => $value) {
            unset($_GET[$key]);
            $_GET[strtr(stripslashes($key), $HTML_SUBST)] = strtr(stripslashes($value), $HTML_SUBST);
            if (isset($$key)) unset($$key);
        }
    }

after
Code: [Select]
if (is_array($HTTP_GET_VARS)) {
        foreach ($HTTP_GET_VARS as $key => $value) {
            unset($HTTP_GET_VARS[$key]);
            $HTTP_GET_VARS[strtr(stripslashes($key), $HTML_SUBST)] = strtr(stripslashes($value), $HTML_SUBST);
            if (isset($$key)) unset($$key);
        }
    }



Joachim
« Last Edit: November 23, 2005, 10:42:23 pm by GauGau »
Logged

celeritycat

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 33
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #1 on: September 26, 2005, 09:08:03 am »

I am running version 134. Can I just extract the init.inc.php from the zip file you posted and upload it to my include folder?
I am not that comfortable adding the code myself, but I also don't want to lose the changes I have now.
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #2 on: September 26, 2005, 09:11:58 am »

as suggested above: there are a number of other minor fixes as well, so the recommended way would be to overwrite all coppermine core files with the ones from the package - please refer to the upgrade instructions that come with the package. However, if you feel like this is too much for you, you could just replace the file include/init.inc.php to just address the particular vulerability that caused the maintenance release.
Logged

luchtzak

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 36
    • Luchtzak Aviation
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #3 on: September 27, 2005, 04:45:44 pm »

Applied the update to version 1.3.5, is it possible that coppermine runs faster now. I noticed faster pageloads...

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #4 on: September 30, 2005, 07:35:11 am »

I don't think so. There hasn't been removal or optimization of any queries or similar. Guess it's just coincidence, or it feels faster. Good to hear though that you're happy with it ;D.
Logged

ergo

  • Coppermine newbie
  • Offline Offline
  • Posts: 13
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #5 on: October 01, 2005, 02:59:38 pm »

are there any style related changes ??
Logged

Tranz

  • Dev Team member
  • Coppermine addict
  • ****
  • Country: 00
  • Offline Offline
  • Gender: Female
  • Posts: 6149
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #6 on: October 01, 2005, 05:06:20 pm »

are there any style related changes ??
Nope.
Logged

Makc666

  • Translator
  • Coppermine addict
  • **
  • Offline Offline
  • Gender: Male
  • Posts: 1614
  • Русский (ISO-8859-1) - Russian - Ğóññêèé (Windows)
    • Makc's home page
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #7 on: October 04, 2005, 04:33:39 pm »

========================
MAKE A BACK UP OF YOUR GALLERY
TRY TO PATCH FIRST TIME IN A TEMPORARY FOLDER, IF YOU DO NOT FULLY UNDERSTAND ANY OF THE STEPS OUTLINED BELOW THEN THIS METHOD IS NOT FOR YOU

========================
There was a fix in 1.3.4 in file displayimage.php
http://forum.coppermine-gallery.net/index.php?topic=20933.0
Code: [Select]
        //Sanitize the data - to fix the XSS vulnerability - Aditya
        foreach ($iptc as $key=>$data) {
          $iptc[$key] = htmlentities(strip_tags(trim($data,"\x7f..\xff\x0..\x1f")),ENT_QUOTES); //sanitize data against sql/html injection; trim any nongraphical non-ASCII character:
}
You have to remove it now manually if you upgrade from 1.3.3 with this fix:
http://forum.coppermine-gallery.net/index.php?topic=20933.0

========================
Step 0.
All steps were made under FreeBSD.
You can read about patch here:
http://www.phpbb.com/support/documents.php?mode=install#upgradeSTABLE_patch

========================
Step 1.
First of all!
I removed
/cpg133/lang/
/cpg134/lang/
/cpg135/lang/
dirs before patching, as it:
- becomes to big
- there is problems with patching in Japan (etc. country) languages.
- you can update lang files manually

========================
Step 2.
Second I run:
diff -crbBN cpg133 cpg135 >cpg-1.3.3_to_1.3.5.patch
and
diff -crbBN cpg134 cpg135 >cpg-1.3.4_to_1.3.5.patch

========================
Step 3.
Then I made a copy of gallery folder which I was going to patch
cp -R coppermine coppermine-new

========================
Step 4.
Also you must have to copy these files into your directory.
/coppermine/CHANGELOG
/coppermine/COPYING
/coppermine/install.php

You can take them from cpg1.3.3.zip, as you need old one:
http://prdownloads.sourceforge.net/coppermine/cpg1.3.3.zip?download
or
You can take them from cpg1.3.4.zip, as you need old one:
http://prdownloads.sourceforge.net/coppermine/cpg1.3.4.zip?download

========================
Step 5.
Put your patch file into:
/coppermine-new/cpg-1.3.3_to_1.3.5.patch
or
/coppermine-new/cpg-1.3.4_to_1.3.5.patch

========================
Step 6.
patch -cl -d /coppermine-new/ -p1 < /coppermine-new/cpg-1.3.3_to_1.3.5.patch
or
patch -cl -d /coppermine-new/ -p1 < /coppermine-new/cpg-1.3.4_to_1.3.5.patch
In this case you will see all results on your screen.
So make your Scroll Buffer big enough.
It will be about 1200 lines!

========================
Step 7.
Update your
/coppermine/lang/
dir with necessary files.
For example I use only Eng, Ger, Rus.

###########################
###!!! READ THIS ONE !!!###
###########################
During patch process you will (can) see two main information strings:
--> Hunk #3 succeeded at 216.
--> Hunk #1 failed at 1.

Example below.
Word "succeeded" means that there is no problems with patching of that part of code.
Word "failed" means there was some problem.

If you see "failed" for some file, you have to open file with name "FILENAME_WITH_ERROR.rej"
below for example it is "zipdownload.php.rej"
and look what the patch couldn't change and fix that manually.

After all such fixes you will have to delete all *.rej and *.orig files from coppermine directory and subdirs!

Word "done" means that patch go throw all "cpg-1.3.3_to_1.3.5.patch" file.

###########################
###### EXAMPLE START ######
###########################

--------------------------
|diff -crbBN cpg132/xp_publish.php cpg133/xp_publish.php
|*** cpg132/xp_publish.php      Sat Jul 24 17:03:00 2004
|--- cpg133/xp_publish.php      Tue Apr 19 05:17:00 2005
--------------------------
Patching file xp_publish.php using Plan A...
Hunk #1 succeeded at 1.
Hunk #2 succeeded at 205.
Hunk #3 succeeded at 216.
Hunk #4 succeeded at 333.
Hunk #5 succeeded at 571.
Hmm...  The next patch looks like a new-style context diff to me...
The text leading up to this was:
--------------------------
|diff -crbBN cpg132/zipdownload.php cpg133/zipdownload.php
|*** cpg132/zipdownload.php     Sat Jul 24 17:03:00 2004
|--- cpg133/zipdownload.php     Tue Apr 19 05:17:00 2005
--------------------------
Patching file zipdownload.php using Plan A...
Hunk #1 failed at 1.
Hunk #2 succeeded at 57.
1 out of 2 hunks failed--saving rejects to zipdownload.php.rej
done

###########################
###### EXAMPLE END ########
###########################

========================
Step 8.
Run: http://your.gallery.com/update.php

- If you have not already done so, create a folder called "edit" within your "albums" directory - this folder will be used by coppermine as a temporary folder, do not ftp-upload files there. Make sure the new "edit"-folder is CHMODed the same way your albums-directory is (755 or 777, depending on your server's config)
- Run the file "update.php" in the coppermine directory once in your browser (e.g. http://yourdomain.tld/coppermine/update.php). This will update your coppermine install by making all necessary changes in the database.

Taken from:
/cpg135/docs/index.htm#13
3.4 Upgrading from cpg1.2.0rc2 or better to version cpg1.3.5

========================
That it!
(c) Makc666 :)

makc666@newmail.ru
makc666@yahoo.com
« Last Edit: October 05, 2005, 07:08:29 am by Tarique Sani »
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #8 on: October 04, 2005, 11:29:07 pm »

above posting by Makc666 does not decribe the upgrade procedures suggested by the coppermine dev team - it's just Makc666's idea how to do things. Some of the steps he outlines are just plain wrong in my opinion. Although we welcome user contributions, I disagree with posting something that looks like a detailed readme/howto. Makc666 failed to say why in his opinion the upgrade steps should be altered in the way he describes. In the future, please post why you think something's wrong with our suggested upgrade instructions instead of boldly posting a guide of your own.

Joachim
Logged

Makc666

  • Translator
  • Coppermine addict
  • **
  • Offline Offline
  • Gender: Male
  • Posts: 1614
  • Русский (ISO-8859-1) - Russian - Ğóññêèé (Windows)
    • Makc's home page
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #9 on: October 04, 2005, 11:43:59 pm »

My patch files are for those people who have a lot of MODES installed in their galleries.
So they have only to apply my patch with out any new files upload.
This system is 100% the same as patch files for phpBB 2.x forum which is used there.
I didn't say that you upgrade instructions is bad. But they only sutable for galleries with out any modifications.
Thanks for your reply.
P.S. I just try to help people who know what I am posting.
« Last Edit: February 13, 2006, 06:32:23 pm by Makc666 »
Logged

Tarique Sani

  • VIP
  • Coppermine addict
  • ***
  • Offline Offline
  • Gender: Male
  • Posts: 2712
    • http://tariquesani.net
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #10 on: October 05, 2005, 07:07:30 am »

@Makc666 - thanks, this indeed is the correct way to patch an existing install if you have lots of MODs installed and is for people who know what they are doing :)

@Gaugau - I have added an additional disclaimer to Makc666's original post
Logged
SANIsoft PHP applications for E Biz

Satyr

  • Coppermine frequent poster
  • ***
  • Offline Offline
  • Gender: Male
  • Posts: 139
    • Gothic Model Gallery - Dark Photo Art
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #11 on: October 21, 2005, 12:14:39 am »

I have done like in the tuto of GauGau. Thank's Joachim!  :)
BTW, i am big fan of coppermine!  ;D
Logged
Kein Support über PN. Bitte im Forum posten, dann ist anderen auch geholfen.

http://www.gothicmodels.net/gothicmodels/gallery/

Testuser: Test23 PW: 123456

viciouz

  • Coppermine newbie
  • Offline Offline
  • Posts: 1
    • Big Phat Designs
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #12 on: October 27, 2005, 06:27:25 pm »

Though I dont know much about php programming,  I did apply this fix to my coppermine installation and my pages also seem to be loading faster.  Just thought I would throw that in.

Quick note: "Thanks a lot for all the help provided here, Ive always found answers within minutes when I had problems with configuration, layout, etc...
Ive used coppermine on four different websites so far and I find out something new every time.  Ive not yet seen a better photo gallery"

Thanks Again.
Logged

BlackCactus

  • Coppermine newbie
  • Offline Offline
  • Posts: 6
Re: Maintenance release: cpg1.3.5 fixes XSS vulnerability *MUST READ*
« Reply #13 on: November 24, 2005, 06:19:30 pm »

OK not sure tho,
was in my fantastico noticed update for coppermine, so  I proceeded with update maint fix, one thing im a back-up freak "thank God"when I went to my gallery noticed it had changed the igames template back to original state,I had modded the menu and added a homepage link to my site.now it wasn't even a big fix for me to revert it back by adding the 4 lines of code in english.php and igames/theme.php that I had revised in previous version.. Thought I just let others know, now I just made my own theme folder using igames theme and created new lang/english.php file and in the admin panel pointed to the new directory and edited styles.css ,template.html ,theme.php to point to new directory..That is what i get for being lazy in first place,but I was fortunate that I had not heavily modded the Igames theme....

P.S.
B.T.W. Best PhotoGallery in the World by far , Keep it coming, you guys are great and I appreciate all your time and hard work!!!
Logged
Pages: [1]   Go Up
 

Page created in 0.031 seconds with 20 queries.