Na registreren is gebruiker admin

[Foei]

Help, ik heb een forum gemaakt met een hoop MOD's, vind dat gewoon leuk om te doen 8)

Alleen als k nu een test account registreer is die meteen admin Dat mag natuurlijk niet 8)

Wat kan k hier aan doen?

De lijst met MODs die er op zitten:

Auto Delete Users
birthday
birthday add on zodiac
gender
Overall forums permissions on one page
Admin ignore board disabled
Avatar on index
Dates For Humans
Avatar gallery hack
Add Last User Post Date to Members List
All Smilies in IFRAME
PM Info in Browser Status Bar
No Thread Stretch
Admin Userlist
Bin Mod
Customizable admin and modérators colors
Quick Reply
Resize Remote Avatars v1.1.0
Restrict Guest Access
Blank Template MOD
Auto group
bbcode_box for phpBB2
Smilies in Topic Titles
Stand Out Announcements
View Topic Name While Posting MOD


Nu denk ik dus dat het aan de mod ligt Admin ignore board disabled maar daarmee kon k ook niks vinden Vandaar dat k het nu even aan de experts vraag :thumb:

[Bee]

Dit is een groot veiligheidsprobleem

Deze fout kan onstaan zijn door een fout in includes/usercp_register.php (lijkt meest waarschijnlijk)

Zou je de code hiervan in een tekstbestand kunnen zetten, en deze hier kunnen linken?

[Foei]

http://chantal-johan.com/usercp_register.txt

[Luuk]

Zoek

Code: Selecteer alles

VALUES ($user_id, '" . str_replace("\'", "''", $username) . "', " . time() . ", '" . str_replace("\'", "''", $new_password) . "', '" . str_replace("\'", "''", $email) . "', '" . str_replace("\'", "''", $icq) . "', '" . str_replace("\'", "''", $website) . "', '" . str_replace("\'", "''", $occupation) . "', '" . str_replace("\'", "''", $location) . "', '" . str_replace("\'", "''", $interests) . "', '" . str_replace("\'", "''", $signature) . "', '$signature_bbcode_uid', $avatar_sql, $viewemail, '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', '" . str_replace("\'", "''", $yim) . "', '" . str_replace("\'", "''", $msn) . "', $attachsig, $allowsmilies, $allowhtml, $allowbbcode, $allowviewonline, $notifyreply, $notifypm, $popup_pm, $user_timezone, '" . str_replace("\'", "''", $user_dateformat) . "', '" . str_replace("\'", "''", $user_lang) . "', $user_style, 0, 1, '$birthday', '$next_birthday_greeting', '$gender', ";

Vervang met

Code: Selecteer alles

VALUES ($user_id, '" . str_replace("\'", "''", $username) . "', " . time() . ", '" . str_replace("\'", "''", $new_password) . "', '" . str_replace("\'", "''", $email) . "', '" . str_replace("\'", "''", $icq) . "', '" . str_replace("\'", "''", $website) . "', '" . str_replace("\'", "''", $occupation) . "', '" . str_replace("\'", "''", $location) . "', '" . str_replace("\'", "''", $interests) . "', '" . str_replace("\'", "''", $signature) . "', '$signature_bbcode_uid', $avatar_sql, $viewemail, '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', '" . str_replace("\'", "''", $yim) . "', '" . str_replace("\'", "''", $msn) . "', $attachsig, $allowsmilies, $allowhtml, $allowbbcode, $allowviewonline, $notifyreply, $notifypm, $popup_pm, $user_timezone, '" . str_replace("\'", "''", $user_dateformat) . "', '" . str_replace("\'", "''", $user_lang) . "', $user_style, '$gender', 0, 1, '$birthday', '$next_birthday_greeting', ";

[Foei]

Woehoe :thumb:

Tnx.
Zo'n klein foutje kan dus groote problemen veroorzaken 8)