Recent Topics
  1. b2evolution CMS Support Forums
  2. b2evolution Support
  3. General Support
  4. Dawn evo_hitlog DOS vulnerability?

Dawn evo_hitlog DOS vulnerability?

1 Mar 14, 2006 00:25    

I run Dawn. The tables were corrupted and required tech support to be rebuilt.
This was successful however tech support supplied the following feedback and I want to know what B2 developers comments are on the following ..... and if I have any options to disable hitlogs without loosing other functionality.

I had to rebuild your evo_hitlog table, so this has mainly the data from the sql dump present.
All other tables were ok.
You should be aware that the use of evo_hitlog has a potential denial of service issue due to the way they deal with hitcounts (counting entries in a database rather than storing a number), we have had to disable sites due to this previously, if you do not need this feature we recommend disabling it as this type of denial of service situation often arises from HTTP_REFERRER spam being directed at sites running evolution blog.
Regards,

Does commenting out the following help? ....

<?php
		log_hit();	// log the hit on this page
		debug_info(); // output debug info if requested
	?>

Back to top

2 May 23, 2006 22:52

Yes, if you comment out log_hit() on all of your skins, your hit log will be disabled. Make sure you do all skins, because spammers even hit skins that you're not currently using.

Back to top

3 May 24, 2006 01:57

Thanks for that, I hadn't dealt with the "other" skins

Back to top

4 May 24, 2006 04:21

personman wrote:

Yes, if you comment out log_hit() on all of your skins, your hit log will be disabled. Make sure you do all skins, because spammers even hit skins that you're not currently using.

Out of curiosity if you do not allow skin switching (i.e. you force one skin to run only) is it still necessary to comment out the log_hit() on all skins?

Back to top

5 May 24, 2006 04:29

is it still necessary to comment out the log_hit() on all skins?

I would/did. I also deleted all but 2 skins, my "hacked to bits" one and the default "custom" one

Back to top

6 May 24, 2006 04:39

In version 0.9.x you (or a spammer) can view a blog in another skin by going to index.php?skin=whatever even if skin switching is disabled. In version 1.8 that doesn't work. It forces the default skin if skin switching is turned off.

Back to top

7 May 24, 2006 16:29

personman wrote:

In version 0.9.x you (or a spammer) can view a blog in another skin by going to index.php?skin=whatever even if skin switching is disabled. In version 1.8 that doesn't work. It forces the default skin if skin switching is turned off.

All be darned... you are spot on with this... thanks :)

Back to top


Form is loading...