GetSimple Support Forum › GetSimple › Announcements v
security report 3.1.2

Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Thread Modes
security report 3.1.2
shawn_a Offline
Lead Developer
*******
Posts: 6,266
Threads: 181
Joined: Sep 2011
#6
2013-01-10, 09:56:34
Mediation of cookie spoofing suggestions are as follows.

Make sure you are using a SALT in your install.

Check for data/other/authorization.xml
This should have been created during install, its possible there is an issue and that this is missing for some, please check your sites and let us know.

The safest bet is follow the wiki on securing your site, and use a custom salt in your config.

The code execution issue is only for authenticated users.

Alternativly you can modify the default salt used in 3.1.2

admin/inc/common.php #147
PHP Code:
$SALT = sha1($SITEURL); 

And change that to something unpredictable sha1('somerandomstring');
Or add a nice die('Critical File Missing');
NEW: SA Admin Toolbar Plugin | View All My Plugins
- Shawn A aka Tablatronix
Website Find
Reply


Messages In This Thread
security report 3.1.2 - by shawn_a - 2013-01-10, 04:30:06
RE: SECURITY EXPLOIT 3.1.2 - by n00dles101 - 2013-01-10, 06:34:09
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-10, 06:37:54
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-10, 07:01:33
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-10, 08:15:49
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-10, 09:56:34
RE: SECURITY EXPLOIT 3.1.2 - by Connie - 2013-01-10, 17:27:27
RE: SECURITY EXPLOIT 3.1.2 - by D.O. - 2013-01-10, 18:08:20
RE: SECURITY EXPLOIT 3.1.2 - by HauntIT - 2013-01-10, 19:17:26
RE: SECURITY EXPLOIT 3.1.2 - by D.O. - 2013-01-10, 20:11:07
RE: SECURITY EXPLOIT 3.1.2 - by HauntIT - 2013-01-10, 21:04:24
RE: SECURITY EXPLOIT 3.1.2 - by Connie - 2013-01-10, 22:01:31
RE: SECURITY EXPLOIT 3.1.2 - by HauntIT - 2013-01-10, 22:48:39
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-11, 00:00:50
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-11, 00:21:51
RE: SECURITY EXPLOIT 3.1.2 - by HauntIT - 2013-01-11, 01:06:06
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-11, 01:14:43
RE: SECURITY EXPLOIT 3.1.2 - by shawn_a - 2013-01-11, 01:38:58
RE: security report 3.1.2 - by shawn_a - 2013-01-11, 06:55:04
RE: security report 3.1.2 - by HauntIT - 2013-01-11, 17:40:42
RE: security report 3.1.2 - by shawn_a - 2013-01-11, 23:10:14
RE: security report 3.1.2 - by n00dles101 - 2013-01-12, 01:05:43
RE: security report 3.1.2 - by shawn_a - 2013-01-12, 02:03:11
RE: security report 3.1.2 - by D.O. - 2013-01-17, 18:55:34
RE: security report 3.1.2 - by n00dles101 - 2013-01-17, 19:39:31
RE: security report 3.1.2 - by D.O. - 2013-01-17, 21:08:04



Users browsing this thread: 1 Guest(s)