Resources

Getting started

Support

Development

Topics

User Functions

Events

There are no upcoming events

What's New

Stories

1 new Stories in the last 2 weeks

Comments last 2 weeks

No new comments

Trackbacks last 2 weeks

No new trackback comments

Links last 2 weeks

No recent new links

NEW FILES last 14 days

No new files

Welcome to Geeklog Friday, May 24 2013 @ 07:28 PM EDT

> >

Reminder: Remove the install script!

Security
  • Thursday, June 04 2009 @ 03:40 PM EDT
  • Contributed by:
  • Views:
    8,012

A recent posting on the Bugtraq security mailing list should serve as a reminder to always remove the install script after a successful install or upgrade of Geeklog: MaXe points out an XSS, a path disclosure, and a remote file inclusion in the 1.5.x install script. The XSS is still present in the 1.6.0 install script and has been pointed out to us before by a person who called himself Nemesis.

We'll take care of this in the next 1.6.0 release (probably rc1). So again: Please follow the installation instructions and the built-in reminders to remove the install script and the other security tips that we provide before, during, and after the install.

What's Related

Story Options

Trackback

Trackback URL for this entry:
http://www.geeklog.net/trackback.php/remove-the-install-script

Here's what others have to say about 'Reminder: Remove the install script!':

[...] 1.6.0 is now available for download. This version fixes a few more issues with the new search, addresses the XSS reported for the install script, and also includes a more prominent reminder to remove the install script after installation or [...] [read more]

The following comments are owned by whomever posted them. This site is not responsible for what they say.

  • Reminder: Remove the install script!
  • Authored by:chrisx on Wednesday, June 17 2009 @ 01:31 AM EDT
It's a nice looking site but it's been a nightmare. First installation using fantastico, it will not install into public_html. It will not install in / the only way to get it to install is /public_html.
But then the url becomes www.yoursite.com/public_html. It will not install to www.yoursite.com
Next, there is no forum??? When i spent one hour deciding between this and others i checked everything and this demo clearly shows a forum, there is no forum.
It's a shame, it's a nice looking site but i can't use it. Why do you show a forum when there is none?
  • Forum and such
  • Authored by:Dirk on Wednesday, June 17 2009 @ 03:23 AM EDT

The Forum is a plugin that you can download separately. Not everybody needs one ...

And may I suggest that when you have a problem getting Geeklog up and running, you use the proper place to ask for help, which is the Installation Forum, and not some completely unrelated story. Thanks.

Post a Comment

Your Name
Create Account
Allowed HTML Tags:
<p>, <b>, <strong>, <i>, <a>, <em>, <br>, <tt>, <hr>, <li>, <ol>, <ul>, <code>, <pre>, [code], [raw], [page_break], [staticpage:]InformationInformation[staticpage: id alternate title] - Displays a link to a static page using the static page title as the title. An alternate title may be specified but is not required. , [event:]InformationInformation[event: id alternate title] - Displays a link to an Event Link from the Calendar using the Event Title as the title. An alternate title may be specified but is not required. , [poll:]InformationInformation[poll: id alternate title] - Displays a link to a poll using the Poll Topic as the title. An alternate title may be specified but is not required. , [link:]InformationInformation[link: id alternate title] - Displays a link to a Link from the Links Plugin using the Link Title as the title. An alternate title may be specified but is not required. , [faq:], [forum:]InformationInformation[forum: id alternate title] - Displays a link to a forum topic using the text 'here' as the title. An alternate title may be specified but is not required. , [file:], [story:]InformationInformation[story: id alternate title] - Displays a link to a Story using the Story Title as the title. An alternate title may be specified but is not required. , [user:]InformationInformation[user: name alternate title] - Displays a link to a User using the Username as the title. An alternate title may be specified but is not required.
 

Security code
This question is for testing whether you are a human visitor and to prevent automated spam submissions.

What code is in the image?
Enter the bolded text, case sensitive!
Important Stuff
  • Please try to keep posts on topic.
  • Try to reply to other people comments instead of starting new threads.
  • Read other people's messages before posting your own to avoid simply duplicating what has already been said.
  • Use a clear subject that describes what your message is about.
  • Your email address will NOT be made public.