Advanced search  

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Pages: [1]   Go Down

Author Topic: BUG?!? Profile visible without logon  (Read 3807 times)

0 Members and 1 Guest are viewing this topic.

cptechnik

  • Coppermine newbie
  • Offline Offline
  • Gender: Male
  • Posts: 4
BUG?!? Profile visible without logon
« on: August 16, 2007, 05:53:48 am »

my Profile ist cached by google!

Just test it on your gal:
http://[mydomain]/galerie/profile.php?uid=1

i tested it on demo from coppermine...
http://coppermine-gallery.net/demo/cpg14x/profile.php?uid=2

huh?!?

but i cant visit the userlist:
http://forum.coppermine-gallery.net/index.php?action=mlist



« Last Edit: August 20, 2007, 06:14:28 pm by Nibbler »
Logged

Hein Traag

  • Dev Team member
  • Coppermine addict
  • ****
  • Country: nl
  • Offline Offline
  • Gender: Male
  • Posts: 2166
  • A, B, Cpg
    • Personal website - Spintires.nl
Re: BUG?!? Profile visible without logon
« Reply #1 on: August 16, 2007, 07:32:17 am »

Not a bug but just the way it's built in. There are ways of hiding these from unregistered users eyes, search the board. I can see both member info and members list.
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Re: BUG?!? Profile visible without logon
« Reply #2 on: August 16, 2007, 07:38:39 am »

There is no sensitive information available on the profile page (you can't see the email address there). It's actually a feature, not a bug. As Hein suggested: disabled to link to the profile if you don't want it to be available for guests.
Be carefull when shouting "bug": a bug is a feature that doesn't work as expected. Your report doesn't qualify as a valid bug report.
Logged

cptechnik

  • Coppermine newbie
  • Offline Offline
  • Gender: Male
  • Posts: 4
Re: BUG?!? Profile visible without logon
« Reply #3 on: August 16, 2007, 07:00:40 pm »

Ok, ok, it is a FEATURE... not a bug...

"I can see both member info and members list." ...because you are logged on?

"search the board" - na, da tu ich mich sehr schwer...

"no sensitive information available on the profile page (you can't see the email address there)."
but i added 'additional information' on my gallery like website, messenger-uin...
guest can't see the memberlist, but if sombody know the direct link to the profile,
like "http://coppermine-gallery.net/demo/cpg14x/profile.php?uid=2", then the guest see all the information (except email).

the subdirectorys '/albums' are not call-able with .htaccess:
---
SetEnvIfNoCase Referer "^http://[mydomain]" local_ref=1
Order Allow,Deny
Allow from env=local_ref
---
but the profile.php is placed in the root-directory...

The tread shouldn't be a announcement, it should be a question...

i renamed the profile.php, and now searching for sollutions...
Logged

Nibbler

  • Guest
Re: BUG?!? Profile visible without logon
« Reply #4 on: August 16, 2007, 07:19:15 pm »

Just add the normal code to restrict the page to logged in users only. Add

Code: [Select]
if (!USER_ID) cpg_die(ERROR, $lang_errors['access_denied'], __FILE__, __LINE__);
After

Code: [Select]
require('include/init.inc.php');
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Re: BUG?!? Profile visible without logon
« Reply #5 on: August 16, 2007, 07:47:01 pm »

Nibbler's suggestion won't remove the links to the profile pages, it will just hide the profile information for guests.

If you have issues with the memberlist, post a link to your gallery for a start.

Don't post in German on the English support board.

Please respect the "one issue per thread" policy in the future. Your .htaccess issues definitely are not related.
Logged

cptechnik

  • Coppermine newbie
  • Offline Offline
  • Gender: Male
  • Posts: 4
Re: BUG?!? Profile visible without logon
« Reply #6 on: August 20, 2007, 05:49:20 pm »

@nibbler
Many, many thanks!
I knew, it was something like "if (user exists){do...}" but i don't want to learn all variables and output-functions... in this case i am a user, not a programmer...

thank you, nibbler!
Logged
Pages: [1]   Go Up
 

Page created in 0.018 seconds with 19 queries.