amuck-landowner

Feathur Launch (VPS Control Panel => 0.6.0.1 => Free For Private Use)

BlueVM

BlueVM

New Member
Verified Provider
@Flapadar - The way the system works is based on email. The username is just there to make the user feel better. It doesn't impact administrators in anyway and the system doesn't use the username field for anything (at all).

If you enter someone elses email into the forgot password box their password remains the same. It only changes if they click the link and proceed to enter a new password.

Also you entering their email into the login box over and over will only ban your IP not theirs from login.
 
Last edited by a moderator:
R

RiotSecurity

New Member
Last edited by a moderator:
BlueVM

BlueVM

New Member
Verified Provider
1. I suppose you're right on the autoloader. Perhaps I'll update the code to support that.

2. I don't see the particular issue with that line of code. It's admin side, if you have an admin pulling things from the database they shouldn't be, you have more issues than code itself can solve.

--

Bottom line: It's your preference for how the program is coded, there's nothing particularly wrong with the code.
 
Last edited by a moderator:
sundaymouse

sundaymouse

New Member
The master server installed as according to the tutorial in github goes out to be 0.5.6 version. I also found that add server function doesn't seem to work, as the page white out after you press the submission.
 
BlueVM

BlueVM

New Member
Verified Provider
@sundaymouse - Mind if I take a look at your install? I haven't seen that before (our copy has no issues with adding servers) so I'd like to see what causes it...
 
sundaymouse

sundaymouse

New Member
BlueVM said:
@sundaymouse - Mind if I take a look at your install? I haven't seen that before (our copy has no issues with adding servers) so I'd like to see what causes it...
Click to expand...
I installed the master in your $1/mo 256MB OVZ. And unfortunately I have already reloaded the OS. Never mind, probably the problem with low memory and phpcgi dying out. I will try the installation on a larger RAM later.
 
libro22

libro22

Member
Francisco said:
Well, if you use a proper MVC then the database would be a library/class that would be extended into the core controller and then can be called at any point.


A lot of the exploits in WHMCS are because they use global variables and force register_globals on. What register_globals does is you could set a variable in the URL and it'd set a variable of the same name in your code, allowing you to inject things like a beast.


Justin wasn't kidding when he said there was 30k+ lines of code. I've not had a chance to audit very much of it but it would have been nice if he had used a more advanced MVC.


Most of the bigger MVC's have validation classes and things like that to make it so the 19 depth if statements don't happen. You feed it a few function calls and it's game.


I think the biggest issue I've seen so far is that they do raw SQL queries in the code. Now, they're using PDO's bindings which means SQL injects are pretty much not going to happen, but because they aren't pushing things into a Model, a column name change means they have to update every file that calls said column, instead of just that single file and a couple templates.


Francisco
Click to expand...
Is extending a class better than using a 'registry' class? I'm quite new with MVC.
 
peterw

peterw

New Member
Francisco said:
I think the biggest issue I've seen so far is that they do raw SQL queries in the code. Now, they're using PDO's bindings which means SQL injects are pretty much not going to happen, but because they aren't pushing things into a Model, a column name change means they have to update every file that calls said column, instead of just that single file and a couple templates.
Click to expand...
Database models are very important and should be used in every project, because schema upgrade and validation can be done automatically.
 
You must log in or register to reply here.
Top
amuck-landowner