Advanced search  

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Pages: [1]   Go Down

Author Topic: Uploading .exes through url  (Read 7752 times)

0 Members and 1 Guest are viewing this topic.

AlphaAddict

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 36
Uploading .exes through url
« on: October 03, 2005, 06:51:03 pm »

is there any way to get Coppermine Photo Gallery to accpet url .exe uploads?
it works with rar,zip etc

i can upload images etc but not .exes through the url

My gallery is here
« Last Edit: October 04, 2005, 04:00:48 pm by Nibbler »
Logged

Nibbler

  • Guest
Re: Uploading .exes through url
« Reply #1 on: October 03, 2005, 06:52:07 pm »

You'd need to manually add the new filetype into the filetypes table in the database.
Logged

Tranz

  • Dev Team member
  • Coppermine addict
  • ****
  • Country: 00
  • Offline Offline
  • Gender: Female
  • Posts: 6149
Re: Uploading .exes through url
« Reply #2 on: October 03, 2005, 08:29:30 pm »

It might be easier to zip the .exe since the browser might display a warning message when someone tries to download an .exe.
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Re: Uploading .exes through url
« Reply #3 on: October 04, 2005, 07:49:56 am »

also, make sure that only you as admin can upload at all, you wouldn't want others to upload harmful executables to your website.
Logged

AlphaAddict

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 36
Re: Uploading .exes through url
« Reply #4 on: October 04, 2005, 01:23:34 pm »

You'd need to manually add the new filetype into the filetypes table in the database.
how exactly would i do that?
Logged

Stramm

  • Dev Team member
  • Coppermine addict
  • ****
  • Country: 00
  • Offline Offline
  • Gender: Male
  • Posts: 6006
    • Bettis Wollwelt
Re: Uploading .exes through url
« Reply #5 on: October 04, 2005, 02:07:55 pm »

with a tool like phpmyadmin you have a look at your filetypes table, view it's contents and add a new line

AlphaAddict

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 36
Re: Uploading .exes through url
« Reply #6 on: October 04, 2005, 02:12:54 pm »

im not sure..
if i give you the login would you do it?
Logged

Stramm

  • Dev Team member
  • Coppermine addict
  • ****
  • Country: 00
  • Offline Offline
  • Gender: Male
  • Posts: 6006
    • Bettis Wollwelt
Re: Uploading .exes through url
« Reply #7 on: October 04, 2005, 02:32:00 pm »

no, I don't like it to much having logins for others servers. If something goes wrong now or in a few weeks you may point your finger at me... no ;)

but create a file addsql.php or whatever you like in your cpg main dir and add the following content
Code: [Select]
<?php
define
('IN_COPPERMINE'true);
require(
'include/init.inc.php');
if (!
GALLERY_ADMIN_MODE) die('Access denied');
pageheader("SQL");
if (
db_query("INSERT INTO {$CONFIG['TABLE_FILETYPES']} (extension, mime, content ) VALUES('exe' ,'application/x-msdownload', 'executable')")) {
echo 
'OK';
} else {
echo 
'Hmmmm.... nope';
}
pagefooter();
?>


call that file, and after that delete it. You need to be logged into CPG and you need to be in admin mode

AlphaAddict

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 36
Re: Uploading .exes through url
« Reply #8 on: October 04, 2005, 02:37:39 pm »

when you say "call" it what do you mean?
Logged

Stramm

  • Dev Team member
  • Coppermine addict
  • ****
  • Country: 00
  • Offline Offline
  • Gender: Male
  • Posts: 6006
    • Bettis Wollwelt
Re: Uploading .exes through url
« Reply #9 on: October 04, 2005, 02:43:19 pm »

you type the file's URL in the browser's address bar

AlphaAddict

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 36
Re: Uploading .exes through url
« Reply #10 on: October 04, 2005, 02:43:57 pm »

now i get


Notice: Undefined index: executable in /home/alphaadd/public_html/Gallery/include/media.functions.inc.php on line 33

Notice: Undefined index: in /home/alphaadd/public_html/Gallery/include/media.functions.inc.php on line 33

Notice: Undefined index: executable in /home/alphaadd/public_html/Gallery/include/media.functions.inc.php on line 33

Notice: Undefined index: in /home/alphaadd/public_html/Gallery/include/media.functions.inc.php on line 33
Logged

Nibbler

  • Guest
Re: Uploading .exes through url
« Reply #11 on: October 04, 2005, 02:49:49 pm »

Do the same as you just did, but use the following code instead:

Code: [Select]
<?php
define
('IN_COPPERMINE'true);
require(
'include/init.inc.php');
if (!
GALLERY_ADMIN_MODE) die('Access denied');
pageheader("SQL");
if (
db_query("UPDATE {$CONFIG['TABLE_FILETYPES']} SET content = 'document' WHERE extension = 'exe'")) {
echo 
'OK';
} else {
echo 
'Hmmmm.... nope';
}
pagefooter();
?>

Logged

Stramm

  • Dev Team member
  • Coppermine addict
  • ****
  • Country: 00
  • Offline Offline
  • Gender: Male
  • Posts: 6006
    • Bettis Wollwelt
Re: Uploading .exes through url
« Reply #12 on: October 04, 2005, 02:56:11 pm »

If you want to know more about notices just do a search. Has been answered hundreds of times.

As you see it's in media.functions.inc.php. This function checks media files cause coppermine is a program to handle media files and documents. Not executables. So you have three options. Turn notices off (as you already knw cause you did the search as suggested), edit media.functions.inc.php to support executable or delete the just added sql and re add it but with content=document (just an example). You can expect flaws here and there

edit: Ok, has already been answered ;)

AlphaAddict

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 36
Re: Uploading .exes through url
« Reply #13 on: October 04, 2005, 02:58:59 pm »

now the errors at the page top are gone but the bottom says
Error Report
The following uploads encountered errors: 
URI/URL Uploads: 
File Name/URL Error Message
1. http://www.heaventools.com/download/pexsetup.exe HTTP/1.1 302 Found
Logged

Nibbler

  • Guest
Re: Uploading .exes through url
« Reply #14 on: October 04, 2005, 03:01:01 pm »

That's because the actual URL is http://www.heaventools.com/files/dwnlnd/PE.Explorer_setup.exe apparently coppermine can't handle the redirection.
Logged

AlphaAddict

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 36
Re: Uploading .exes through url
« Reply #15 on: October 04, 2005, 03:40:02 pm »

ok now i get
Error Report
The following uploads encountered errors: 
URI/URL Uploads: 
File Name/URL Error Message
1. http://www.heaventools.com/files/dwnlnd/PE.Explorer_setup.exe Unknown MIME type
Logged

Nibbler

  • Guest
Re: Uploading .exes through url
« Reply #16 on: October 04, 2005, 03:43:59 pm »

OK, the correct MIME type is application/octet-stream, so upload and run the following code:

Code: [Select]
<?php
define
('IN_COPPERMINE'true);
require(
'include/init.inc.php');
if (!
GALLERY_ADMIN_MODE) die('Access denied');
pageheader("SQL");
if (
db_query("UPDATE {$CONFIG['TABLE_FILETYPES']} SET mime = 'application/octet-stream' WHERE extension = 'exe'")) {
echo 
'OK';
} else {
echo 
'Hmmmm.... nope';
}
pagefooter();
?>

Logged

AlphaAddict

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 36
Re: Uploading .exes through url
« Reply #17 on: October 04, 2005, 03:49:24 pm »

 :D works
Logged
Pages: [1]   Go Up
 

Page created in 0.022 seconds with 15 queries.